vendor: update buildkit to v0.27.0-rc1

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

vendor/github.com/moby/buildkit/api/services/control/control.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/api/services/control/control.proto
 

vendor/github.com/moby/buildkit/api/types/worker.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/api/types/worker.proto
 

vendor/github.com/moby/buildkit/cache/remotecache/gha/ghatypes/config.go

@@ -0,0 +1,23 @@
+package ghatypes
+
+import "github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
+
+type CacheConfig struct {
+	Sign   *SignConfig  `toml:"sign"`
+	Verify VerifyConfig `toml:"verify"`
+}
+
+type SignConfig struct {
+	Command []string `toml:"command"`
+}
+
+type VerifyConfig struct {
+	Required bool         `toml:"required"`
+	Policy   VerifyPolicy `toml:"policy"`
+}
+
+type VerifyPolicy struct {
+	TimestampThreshold int `toml:"timestampThreshold"`
+	TlogThreshold      int `toml:"tlogThreshold"`
+	certificate.Summary
+}

vendor/github.com/moby/buildkit/client/build.go

@@ -178,6 +178,36 @@ func (g *gatewayClientForBuild) ReleaseContainer(ctx context.Context, in *gatewa
 	return g.gateway.ReleaseContainer(ctx, in, opts...)
 }
 
+func (g *gatewayClientForBuild) ReadFileContainer(ctx context.Context, in *gatewayapi.ReadFileRequest, opts ...grpc.CallOption) (*gatewayapi.ReadFileResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.ReadFileContainer(ctx, in, opts...)
+}
+
+func (g *gatewayClientForBuild) ReadDirContainer(ctx context.Context, in *gatewayapi.ReadDirRequest, opts ...grpc.CallOption) (*gatewayapi.ReadDirResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.ReadDirContainer(ctx, in, opts...)
+}
+
+func (g *gatewayClientForBuild) StatFileContainer(ctx context.Context, in *gatewayapi.StatFileRequest, opts ...grpc.CallOption) (*gatewayapi.StatFileResponse, error) {
+	if g.caps != nil {
+		if err := g.caps.Supports(gatewayapi.CapGatewayExecFilesystem); err != nil {
+			return nil, err
+		}
+	}
+	ctx = buildid.AppendToOutgoingContext(ctx, g.buildID)
+	return g.gateway.StatFileContainer(ctx, in, opts...)
+}
+
 func (g *gatewayClientForBuild) ExecProcess(ctx context.Context, opts ...grpc.CallOption) (gatewayapi.LLBBridge_ExecProcessClient, error) {
 	if g.caps != nil {
 		if err := g.caps.Supports(gatewayapi.CapGatewayExec); err != nil {

vendor/github.com/moby/buildkit/cmd/buildkitd/config/config.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"github.com/moby/buildkit/cache/remotecache/gha/ghatypes"
 	resolverconfig "github.com/moby/buildkit/util/resolver/config"
 )
 
@@ -46,6 +47,12 @@ type Config struct {
 	// ProvenanceEnvDir is the directory where extra config is loaded
 	// that is added to the provenance of builds. Defaults to /etc/buildkit/provenance.d/ ,
 	ProvenanceEnvDir string `toml:"provenanceEnvDir"`
+
+	Cache CacheConfig `toml:"cache"`
+}
+
+type CacheConfig struct {
+	GHA *ghatypes.CacheConfig `toml:"gha"`
 }
 
 type SystemConfig struct {

vendor/github.com/moby/buildkit/executor/resources/types/systypes.go

@@ -57,7 +57,6 @@ type SysMemoryStat struct {
 }
 
 type SysSample struct {
-	//nolint
 	Timestamp_     time.Time      `json:"timestamp"`
 	CPUStat        *SysCPUStat    `json:"cpuStat,omitempty"`
 	ProcStat       *ProcStat      `json:"procStat,omitempty"`

vendor/github.com/moby/buildkit/executor/resources/types/types.go

@@ -20,7 +20,6 @@ type Samples struct {
 
 // Sample represents a wrapper for sampled data of cgroupv2 controllers
 type Sample struct {
-	//nolint
 	Timestamp_ time.Time      `json:"timestamp"`
 	CPUStat    *CPUStat       `json:"cpuStat,omitempty"`
 	MemoryStat *MemoryStat    `json:"memoryStat,omitempty"`

vendor/github.com/moby/buildkit/frontend/dockerfile/linter/ruleset.go

@@ -163,7 +163,6 @@ var (
 		Format: func(cmd, file string) string {
 			return fmt.Sprintf("Attempting to %s file %q that is excluded by .dockerignore", cmd, file)
 		},
-		Experimental: true,
 	}
 	RuleInvalidDefinitionDescription = LinterRule[func(string, string) string]{
 		Name:        "InvalidDefinitionDescription",

vendor/github.com/moby/buildkit/frontend/dockerfile/parser/parser.go

@@ -49,25 +49,29 @@ func (node *Node) Location() []Range {
 // Dump dumps the AST defined by `node` as a list of sexps.
 // Returns a string suitable for printing.
 func (node *Node) Dump() string {
-	str := strings.ToLower(node.Value)
+	var str strings.Builder
+	str.WriteString(strings.ToLower(node.Value))
 
 	if len(node.Flags) > 0 {
-		str += fmt.Sprintf(" %q", node.Flags)
+		fmt.Fprintf(&str, " %q", node.Flags)
 	}
 
 	for _, n := range node.Children {
-		str += "(" + n.Dump() + ")\n"
+		str.WriteByte('(')
+		str.WriteString(n.Dump())
+		str.WriteString(")\n")
 	}
 
 	for n := node.Next; n != nil; n = n.Next {
+		str.WriteByte(' ')
 		if len(n.Children) > 0 {
-			str += " " + n.Dump()
+			str.WriteString(n.Dump())
 		} else {
-			str += " " + strconv.Quote(n.Value)
+			str.WriteString(strconv.Quote(n.Value))
 		}
 	}
 
-	return strings.TrimSpace(str)
+	return strings.TrimSpace(str.String())
 }
 
 func (node *Node) lines(start, end int) {
@@ -367,6 +371,8 @@ func Parse(rwc io.Reader) (*Result, error) {
 			for _, heredoc := range heredocs {
 				terminator := []byte(heredoc.Name)
 				terminated := false
+				var content strings.Builder
+				content.WriteString(heredoc.Content)
 				for scanner.Scan() {
 					bytesRead := scanner.Bytes()
 					currentLine++
@@ -379,12 +385,13 @@ func Parse(rwc io.Reader) (*Result, error) {
 						terminated = true
 						break
 					}
-					heredoc.Content += string(bytesRead)
+					content.Write(bytesRead)
 				}
 				if !terminated {
 					return nil, withLocation(errors.New("unterminated heredoc"), startLine, currentLine)
 				}
 
+				heredoc.Content = content.String()
 				child.Heredocs = append(child.Heredocs, heredoc)
 			}
 		}

vendor/github.com/moby/buildkit/frontend/dockerui/build.go

@@ -34,7 +34,6 @@ func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, erro
 	eg, ctx := errgroup.WithContext(ctx)
 
 	for i, tp := range targets {
-		i, tp := i, tp
 		eg.Go(func() error {
 			ref, img, baseImg, err := fn(ctx, tp, i)
 			if err != nil {

vendor/github.com/moby/buildkit/frontend/gateway/client/client.go

@@ -66,6 +66,9 @@ type Mount struct {
 type Container interface {
 	Start(context.Context, StartRequest) (ContainerProcess, error)
 	Release(context.Context) error
+	ReadFile(ctx context.Context, req ReadContainerRequest) ([]byte, error)
+	StatFile(ctx context.Context, req StatContainerRequest) (*fstypes.Stat, error)
+	ReadDir(ctx context.Context, req ReadDirContainerRequest) ([]*fstypes.Stat, error)
 }
 
 // StartRequest encapsulates the arguments to define a process within a
@@ -111,6 +114,11 @@ type ReadRequest struct {
 	Range    *FileRange
 }
 
+type ReadContainerRequest struct {
+	ReadRequest
+	MountIndex int
+}
+
 type FileRange struct {
 	Offset int
 	Length int
@@ -121,10 +129,20 @@ type ReadDirRequest struct {
 	IncludePattern string
 }
 
+type ReadDirContainerRequest struct {
+	ReadDirRequest
+	MountIndex int
+}
+
 type StatRequest struct {
 	Path string
 }
 
+type StatContainerRequest struct {
+	StatRequest
+	MountIndex int
+}
+
 // SolveRequest is same as frontend.SolveRequest but avoiding dependency
 type SolveRequest struct {
 	Evaluate       bool

vendor/github.com/moby/buildkit/frontend/gateway/grpcclient/client.go

@@ -1193,6 +1193,70 @@ func (ctr *container) Release(ctx context.Context) error {
 	return err
 }
 
+func (ctr *container) ReadFile(ctx context.Context, req client.ReadContainerRequest) ([]byte, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> ReadFileContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.ReadFileRequest{
+		Ref:        ctr.id,
+		FilePath:   req.Filename,
+		MountIndex: int32(req.MountIndex),
+	}
+	if req.Range != nil {
+		in.Range = &pb.FileRange{
+			Length: int64(req.Range.Length),
+			Offset: int64(req.Range.Offset),
+		}
+	}
+
+	resp, err := ctr.client.ReadFileContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Data, nil
+}
+
+func (ctr *container) ReadDir(ctx context.Context, req client.ReadDirContainerRequest) ([]*fstypes.Stat, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> ReadDirContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.ReadDirRequest{
+		Ref:            ctr.id,
+		DirPath:        req.Path,
+		IncludePattern: req.IncludePattern,
+		MountIndex:     int32(req.MountIndex),
+	}
+
+	resp, err := ctr.client.ReadDirContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Entries, nil
+}
+
+func (ctr *container) StatFile(ctx context.Context, req client.StatContainerRequest) (*fstypes.Stat, error) {
+	if err := ctr.caps.Supports(pb.CapGatewayExecFilesystem); err != nil {
+		return nil, err
+	}
+
+	bklog.G(ctx).Debugf("|---> StatFileContainer %s@%d", ctr.id, req.MountIndex)
+	in := &pb.StatFileRequest{
+		Ref:        ctr.id,
+		Path:       req.Path,
+		MountIndex: int32(req.MountIndex),
+	}
+
+	resp, err := ctr.client.StatFileContainer(ctx, in)
+	if err != nil {
+		return nil, err
+	}
+	return resp.Stat, nil
+}
+
 type containerProcess struct {
 	execMsgs *messageForwarder
 	id       string

vendor/github.com/moby/buildkit/frontend/gateway/pb/caps.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck
 
 import "github.com/moby/buildkit/util/apicaps"
 
@@ -52,6 +52,10 @@ const (
 	// created via gateway exec.
 	CapGatewayExecSignals apicaps.CapID = "gateway.exec.signals"
 
+	// CapGatewayExecFilesystem is the capability to interact with the filesystem for
+	// containers directly through the gateway.
+	CapGatewayExecFilesystem apicaps.CapID = "gateway.exec.filesystem"
+
 	// CapFrontendCaps can be used to check that frontends define support for certain capabilities
 	CapFrontendCaps apicaps.CapID = "frontend.caps"
 
@@ -201,6 +205,13 @@ func init() {
 		Status:  apicaps.CapStatusExperimental,
 	})
 
+	Caps.Init(apicaps.Cap{
+		ID:      CapGatewayExecFilesystem,
+		Name:    "gateway exec filesystem",
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapFrontendCaps,
 		Name:    "frontend capabilities",

vendor/github.com/moby/buildkit/frontend/gateway/pb/exit.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_frontend //nolint:revive,staticcheck
+package moby_buildkit_v1_frontend //nolint:staticcheck
 
 import (
 	"fmt"

vendor/github.com/moby/buildkit/frontend/gateway/pb/gateway.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/frontend/gateway/pb/gateway.proto
 
@@ -1678,6 +1678,7 @@ type ReadFileRequest struct {
 	Ref           string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	FilePath      string                 `protobuf:"bytes,2,opt,name=FilePath,proto3" json:"FilePath,omitempty"`
 	Range         *FileRange             `protobuf:"bytes,3,opt,name=Range,proto3" json:"Range,omitempty"`
+	MountIndex    int32                  `protobuf:"varint,4,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1733,6 +1734,13 @@ func (x *ReadFileRequest) GetRange() *FileRange {
 	return nil
 }
 
+func (x *ReadFileRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type FileRange struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Offset        int64                  `protobuf:"varint,1,opt,name=Offset,proto3" json:"Offset,omitempty"`
@@ -1834,6 +1842,7 @@ type ReadDirRequest struct {
 	Ref            string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	DirPath        string                 `protobuf:"bytes,2,opt,name=DirPath,proto3" json:"DirPath,omitempty"`
 	IncludePattern string                 `protobuf:"bytes,3,opt,name=IncludePattern,proto3" json:"IncludePattern,omitempty"`
+	MountIndex     int32                  `protobuf:"varint,4,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -1889,6 +1898,13 @@ func (x *ReadDirRequest) GetIncludePattern() string {
 	return ""
 }
 
+func (x *ReadDirRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type ReadDirResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Entries       []*types.Stat          `protobuf:"bytes,1,rep,name=entries,proto3" json:"entries,omitempty"`
@@ -1937,6 +1953,7 @@ type StatFileRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Ref           string                 `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	Path          string                 `protobuf:"bytes,2,opt,name=Path,proto3" json:"Path,omitempty"`
+	MountIndex    int32                  `protobuf:"varint,3,opt,name=MountIndex,proto3" json:"MountIndex,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1985,6 +2002,13 @@ func (x *StatFileRequest) GetPath() string {
 	return ""
 }
 
+func (x *StatFileRequest) GetMountIndex() int32 {
+	if x != nil {
+		return x.MountIndex
+	}
+	return 0
+}
+
 type StatFileResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Stat          *types.Stat            `protobuf:"bytes,1,opt,name=stat,proto3" json:"stat,omitempty"`
@@ -3354,25 +3378,34 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\\\n" +
 	"\rSolveResponse\x12\x10\n" +
 	"\x03ref\x18\x01 \x01(\tR\x03ref\x129\n" +
-	"\x06result\x18\x03 \x01(\v2!.moby.buildkit.v1.frontend.ResultR\x06result\"{\n" +
+	"\x06result\x18\x03 \x01(\v2!.moby.buildkit.v1.frontend.ResultR\x06result\"\x9b\x01\n" +
 	"\x0fReadFileRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x1a\n" +
 	"\bFilePath\x18\x02 \x01(\tR\bFilePath\x12:\n" +
-	"\x05Range\x18\x03 \x01(\v2$.moby.buildkit.v1.frontend.FileRangeR\x05Range\";\n" +
+	"\x05Range\x18\x03 \x01(\v2$.moby.buildkit.v1.frontend.FileRangeR\x05Range\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x04 \x01(\x05R\n" +
+	"MountIndex\";\n" +
 	"\tFileRange\x12\x16\n" +
 	"\x06Offset\x18\x01 \x01(\x03R\x06Offset\x12\x16\n" +
 	"\x06Length\x18\x02 \x01(\x03R\x06Length\"&\n" +
 	"\x10ReadFileResponse\x12\x12\n" +
-	"\x04Data\x18\x01 \x01(\fR\x04Data\"d\n" +
+	"\x04Data\x18\x01 \x01(\fR\x04Data\"\x84\x01\n" +
 	"\x0eReadDirRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x18\n" +
 	"\aDirPath\x18\x02 \x01(\tR\aDirPath\x12&\n" +
-	"\x0eIncludePattern\x18\x03 \x01(\tR\x0eIncludePattern\"?\n" +
+	"\x0eIncludePattern\x18\x03 \x01(\tR\x0eIncludePattern\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x04 \x01(\x05R\n" +
+	"MountIndex\"?\n" +
 	"\x0fReadDirResponse\x12,\n" +
-	"\aentries\x18\x01 \x03(\v2\x12.fsutil.types.StatR\aentries\"7\n" +
+	"\aentries\x18\x01 \x03(\v2\x12.fsutil.types.StatR\aentries\"W\n" +
 	"\x0fStatFileRequest\x12\x10\n" +
 	"\x03Ref\x18\x01 \x01(\tR\x03Ref\x12\x12\n" +
-	"\x04Path\x18\x02 \x01(\tR\x04Path\":\n" +
+	"\x04Path\x18\x02 \x01(\tR\x04Path\x12\x1e\n" +
+	"\n" +
+	"MountIndex\x18\x03 \x01(\x05R\n" +
+	"MountIndex\":\n" +
 	"\x10StatFileResponse\x12&\n" +
 	"\x04stat\x18\x01 \x01(\v2\x12.fsutil.types.StatR\x04stat\"#\n" +
 	"\x0fEvaluateRequest\x12\x10\n" +
@@ -3460,7 +3493,7 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x06Bundle\x10\x01*&\n" +
 	"\x11InTotoSubjectKind\x12\b\n" +
 	"\x04Self\x10\x00\x12\a\n" +
-	"\x03Raw\x10\x012\xbd\v\n" +
+	"\x03Raw\x10\x012\x84\x0e\n" +
 	"\tLLBBridge\x12\x81\x01\n" +
 	"\x12ResolveImageConfig\x124.moby.buildkit.v1.frontend.ResolveImageConfigRequest\x1a5.moby.buildkit.v1.frontend.ResolveImageConfigResponse\x12~\n" +
 	"\x11ResolveSourceMeta\x123.moby.buildkit.v1.frontend.ResolveSourceMetaRequest\x1a4.moby.buildkit.v1.frontend.ResolveSourceMetaResponse\x12Z\n" +
@@ -3474,7 +3507,10 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x06Inputs\x12(.moby.buildkit.v1.frontend.InputsRequest\x1a).moby.buildkit.v1.frontend.InputsResponse\x12o\n" +
 	"\fNewContainer\x12..moby.buildkit.v1.frontend.NewContainerRequest\x1a/.moby.buildkit.v1.frontend.NewContainerResponse\x12{\n" +
 	"\x10ReleaseContainer\x122.moby.buildkit.v1.frontend.ReleaseContainerRequest\x1a3.moby.buildkit.v1.frontend.ReleaseContainerResponse\x12a\n" +
-	"\vExecProcess\x12&.moby.buildkit.v1.frontend.ExecMessage\x1a&.moby.buildkit.v1.frontend.ExecMessage(\x010\x01\x12W\n" +
+	"\vExecProcess\x12&.moby.buildkit.v1.frontend.ExecMessage\x1a&.moby.buildkit.v1.frontend.ExecMessage(\x010\x01\x12l\n" +
+	"\x11ReadFileContainer\x12*.moby.buildkit.v1.frontend.ReadFileRequest\x1a+.moby.buildkit.v1.frontend.ReadFileResponse\x12i\n" +
+	"\x10ReadDirContainer\x12).moby.buildkit.v1.frontend.ReadDirRequest\x1a*.moby.buildkit.v1.frontend.ReadDirResponse\x12l\n" +
+	"\x11StatFileContainer\x12*.moby.buildkit.v1.frontend.StatFileRequest\x1a+.moby.buildkit.v1.frontend.StatFileResponse\x12W\n" +
 	"\x04Warn\x12&.moby.buildkit.v1.frontend.WarnRequest\x1a'.moby.buildkit.v1.frontend.WarnResponseBHZFgithub.com/moby/buildkit/frontend/gateway/pb;moby_buildkit_v1_frontendb\x06proto3"
 
 var (
@@ -3658,23 +3694,29 @@ var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_depIdxs = []
 	39, // 79: moby.buildkit.v1.frontend.LLBBridge.NewContainer:input_type -> moby.buildkit.v1.frontend.NewContainerRequest
 	41, // 80: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:input_type -> moby.buildkit.v1.frontend.ReleaseContainerRequest
 	43, // 81: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:input_type -> moby.buildkit.v1.frontend.ExecMessage
-	37, // 82: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
-	14, // 83: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
-	16, // 84: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
-	25, // 85: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
-	28, // 86: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
-	30, // 87: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
-	32, // 88: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
-	34, // 89: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
-	36, // 90: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
-	10, // 91: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
-	12, // 92: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
-	40, // 93: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
-	42, // 94: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
-	43, // 95: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
-	38, // 96: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
-	83, // [83:97] is the sub-list for method output_type
-	69, // [69:83] is the sub-list for method input_type
+	26, // 82: moby.buildkit.v1.frontend.LLBBridge.ReadFileContainer:input_type -> moby.buildkit.v1.frontend.ReadFileRequest
+	29, // 83: moby.buildkit.v1.frontend.LLBBridge.ReadDirContainer:input_type -> moby.buildkit.v1.frontend.ReadDirRequest
+	31, // 84: moby.buildkit.v1.frontend.LLBBridge.StatFileContainer:input_type -> moby.buildkit.v1.frontend.StatFileRequest
+	37, // 85: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
+	14, // 86: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
+	16, // 87: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
+	25, // 88: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
+	28, // 89: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
+	30, // 90: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
+	32, // 91: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
+	34, // 92: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
+	36, // 93: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
+	10, // 94: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
+	12, // 95: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
+	40, // 96: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
+	42, // 97: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
+	43, // 98: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
+	28, // 99: moby.buildkit.v1.frontend.LLBBridge.ReadFileContainer:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
+	30, // 100: moby.buildkit.v1.frontend.LLBBridge.ReadDirContainer:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
+	32, // 101: moby.buildkit.v1.frontend.LLBBridge.StatFileContainer:output_type -> moby.buildkit.v1.frontend.StatFileResponse
+	38, // 102: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
+	86, // [86:103] is the sub-list for method output_type
+	69, // [69:86] is the sub-list for method input_type
 	69, // [69:69] is the sub-list for extension type_name
 	69, // [69:69] is the sub-list for extension extendee
 	0,  // [0:69] is the sub-list for field type_name

vendor/github.com/moby/buildkit/frontend/gateway/pb/gateway.proto

@@ -36,6 +36,11 @@ service LLBBridge {
 	rpc ReleaseContainer(ReleaseContainerRequest) returns (ReleaseContainerResponse);
 	rpc ExecProcess(stream ExecMessage) returns (stream ExecMessage);
 
+	// apicaps:CapGatewayExecFilesystem
+	rpc ReadFileContainer(ReadFileRequest) returns (ReadFileResponse);
+	rpc ReadDirContainer(ReadDirRequest) returns (ReadDirResponse);
+	rpc StatFileContainer(StatFileRequest) returns (StatFileResponse);
+
 	// apicaps:CapGatewayWarnings
 	rpc Warn(WarnRequest) returns (WarnResponse);
 }
@@ -228,6 +233,7 @@ message ReadFileRequest {
 	string Ref = 1;
 	string FilePath = 2;
 	FileRange Range = 3;
+	int32 MountIndex = 4;
 }
 
 message FileRange {
@@ -243,6 +249,7 @@ message ReadDirRequest {
 	string Ref = 1;
 	string DirPath = 2;
 	string IncludePattern = 3;
+	int32 MountIndex = 4;
 }
 
 message ReadDirResponse {
@@ -252,6 +259,7 @@ message ReadDirResponse {
 message StatFileRequest {
 	string Ref = 1;
 	string Path = 2;
+	int32 MountIndex = 3;
 }
 
 message StatFileResponse {
@@ -374,4 +382,4 @@ message Descriptor {
 	string digest = 2;
 	int64 size = 3;
 	map<string, string> annotations = 5;
-}
+}

vendor/github.com/moby/buildkit/frontend/gateway/pb/gateway_grpc.pb.go

@@ -32,6 +32,9 @@ const (
 	LLBBridge_NewContainer_FullMethodName       = "/moby.buildkit.v1.frontend.LLBBridge/NewContainer"
 	LLBBridge_ReleaseContainer_FullMethodName   = "/moby.buildkit.v1.frontend.LLBBridge/ReleaseContainer"
 	LLBBridge_ExecProcess_FullMethodName        = "/moby.buildkit.v1.frontend.LLBBridge/ExecProcess"
+	LLBBridge_ReadFileContainer_FullMethodName  = "/moby.buildkit.v1.frontend.LLBBridge/ReadFileContainer"
+	LLBBridge_ReadDirContainer_FullMethodName   = "/moby.buildkit.v1.frontend.LLBBridge/ReadDirContainer"
+	LLBBridge_StatFileContainer_FullMethodName  = "/moby.buildkit.v1.frontend.LLBBridge/StatFileContainer"
 	LLBBridge_Warn_FullMethodName               = "/moby.buildkit.v1.frontend.LLBBridge/Warn"
 )
 
@@ -60,6 +63,10 @@ type LLBBridgeClient interface {
 	NewContainer(ctx context.Context, in *NewContainerRequest, opts ...grpc.CallOption) (*NewContainerResponse, error)
 	ReleaseContainer(ctx context.Context, in *ReleaseContainerRequest, opts ...grpc.CallOption) (*ReleaseContainerResponse, error)
 	ExecProcess(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[ExecMessage, ExecMessage], error)
+	// apicaps:CapGatewayExecFilesystem
+	ReadFileContainer(ctx context.Context, in *ReadFileRequest, opts ...grpc.CallOption) (*ReadFileResponse, error)
+	ReadDirContainer(ctx context.Context, in *ReadDirRequest, opts ...grpc.CallOption) (*ReadDirResponse, error)
+	StatFileContainer(ctx context.Context, in *StatFileRequest, opts ...grpc.CallOption) (*StatFileResponse, error)
 	// apicaps:CapGatewayWarnings
 	Warn(ctx context.Context, in *WarnRequest, opts ...grpc.CallOption) (*WarnResponse, error)
 }
@@ -205,6 +212,36 @@ func (c *lLBBridgeClient) ExecProcess(ctx context.Context, opts ...grpc.CallOpti
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type LLBBridge_ExecProcessClient = grpc.BidiStreamingClient[ExecMessage, ExecMessage]
 
+func (c *lLBBridgeClient) ReadFileContainer(ctx context.Context, in *ReadFileRequest, opts ...grpc.CallOption) (*ReadFileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReadFileResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_ReadFileContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *lLBBridgeClient) ReadDirContainer(ctx context.Context, in *ReadDirRequest, opts ...grpc.CallOption) (*ReadDirResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReadDirResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_ReadDirContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *lLBBridgeClient) StatFileContainer(ctx context.Context, in *StatFileRequest, opts ...grpc.CallOption) (*StatFileResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StatFileResponse)
+	err := c.cc.Invoke(ctx, LLBBridge_StatFileContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *lLBBridgeClient) Warn(ctx context.Context, in *WarnRequest, opts ...grpc.CallOption) (*WarnResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(WarnResponse)
@@ -240,6 +277,10 @@ type LLBBridgeServer interface {
 	NewContainer(context.Context, *NewContainerRequest) (*NewContainerResponse, error)
 	ReleaseContainer(context.Context, *ReleaseContainerRequest) (*ReleaseContainerResponse, error)
 	ExecProcess(grpc.BidiStreamingServer[ExecMessage, ExecMessage]) error
+	// apicaps:CapGatewayExecFilesystem
+	ReadFileContainer(context.Context, *ReadFileRequest) (*ReadFileResponse, error)
+	ReadDirContainer(context.Context, *ReadDirRequest) (*ReadDirResponse, error)
+	StatFileContainer(context.Context, *StatFileRequest) (*StatFileResponse, error)
 	// apicaps:CapGatewayWarnings
 	Warn(context.Context, *WarnRequest) (*WarnResponse, error)
 }
@@ -290,6 +331,15 @@ func (UnimplementedLLBBridgeServer) ReleaseContainer(context.Context, *ReleaseCo
 func (UnimplementedLLBBridgeServer) ExecProcess(grpc.BidiStreamingServer[ExecMessage, ExecMessage]) error {
 	return status.Errorf(codes.Unimplemented, "method ExecProcess not implemented")
 }
+func (UnimplementedLLBBridgeServer) ReadFileContainer(context.Context, *ReadFileRequest) (*ReadFileResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReadFileContainer not implemented")
+}
+func (UnimplementedLLBBridgeServer) ReadDirContainer(context.Context, *ReadDirRequest) (*ReadDirResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ReadDirContainer not implemented")
+}
+func (UnimplementedLLBBridgeServer) StatFileContainer(context.Context, *StatFileRequest) (*StatFileResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method StatFileContainer not implemented")
+}
 func (UnimplementedLLBBridgeServer) Warn(context.Context, *WarnRequest) (*WarnResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Warn not implemented")
 }
@@ -536,6 +586,60 @@ func _LLBBridge_ExecProcess_Handler(srv interface{}, stream grpc.ServerStream) e
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type LLBBridge_ExecProcessServer = grpc.BidiStreamingServer[ExecMessage, ExecMessage]
 
+func _LLBBridge_ReadFileContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReadFileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).ReadFileContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_ReadFileContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).ReadFileContainer(ctx, req.(*ReadFileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _LLBBridge_ReadDirContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReadDirRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).ReadDirContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_ReadDirContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).ReadDirContainer(ctx, req.(*ReadDirRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _LLBBridge_StatFileContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StatFileRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(LLBBridgeServer).StatFileContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: LLBBridge_StatFileContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(LLBBridgeServer).StatFileContainer(ctx, req.(*StatFileRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _LLBBridge_Warn_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(WarnRequest)
 	if err := dec(in); err != nil {
@@ -609,6 +713,18 @@ var LLBBridge_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ReleaseContainer",
 			Handler:    _LLBBridge_ReleaseContainer_Handler,
 		},
+		{
+			MethodName: "ReadFileContainer",
+			Handler:    _LLBBridge_ReadFileContainer_Handler,
+		},
+		{
+			MethodName: "ReadDirContainer",
+			Handler:    _LLBBridge_ReadDirContainer_Handler,
+		},
+		{
+			MethodName: "StatFileContainer",
+			Handler:    _LLBBridge_StatFileContainer_Handler,
+		},
 		{
 			MethodName: "Warn",
 			Handler:    _LLBBridge_Warn_Handler,

vendor/github.com/moby/buildkit/frontend/gateway/pb/gateway_vtproto.pb.go

@@ -667,6 +667,7 @@ func (m *ReadFileRequest) CloneVT() *ReadFileRequest {
 	r.Ref = m.Ref
 	r.FilePath = m.FilePath
 	r.Range = m.Range.CloneVT()
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -725,6 +726,7 @@ func (m *ReadDirRequest) CloneVT() *ReadDirRequest {
 	r.Ref = m.Ref
 	r.DirPath = m.DirPath
 	r.IncludePattern = m.IncludePattern
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -770,6 +772,7 @@ func (m *StatFileRequest) CloneVT() *StatFileRequest {
 	r := new(StatFileRequest)
 	r.Ref = m.Ref
 	r.Path = m.Path
+	r.MountIndex = m.MountIndex
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -2264,6 +2267,9 @@ func (this *ReadFileRequest) EqualVT(that *ReadFileRequest) bool {
 	if !this.Range.EqualVT(that.Range) {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -2330,6 +2336,9 @@ func (this *ReadDirRequest) EqualVT(that *ReadDirRequest) bool {
 	if this.IncludePattern != that.IncludePattern {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -2389,6 +2398,9 @@ func (this *StatFileRequest) EqualVT(that *StatFileRequest) bool {
 	if this.Path != that.Path {
 		return false
 	}
+	if this.MountIndex != that.MountIndex {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -4858,6 +4870,11 @@ func (m *ReadFileRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x20
+	}
 	if m.Range != nil {
 		size, err := m.Range.MarshalToSizedBufferVT(dAtA[:i])
 		if err != nil {
@@ -4998,6 +5015,11 @@ func (m *ReadDirRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x20
+	}
 	if len(m.IncludePattern) > 0 {
 		i -= len(m.IncludePattern)
 		copy(dAtA[i:], m.IncludePattern)
@@ -5109,6 +5131,11 @@ func (m *StatFileRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if m.MountIndex != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MountIndex))
+		i--
+		dAtA[i] = 0x18
+	}
 	if len(m.Path) > 0 {
 		i -= len(m.Path)
 		copy(dAtA[i:], m.Path)
@@ -7065,6 +7092,9 @@ func (m *ReadFileRequest) SizeVT() (n int) {
 		l = m.Range.SizeVT()
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7117,6 +7147,9 @@ func (m *ReadDirRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -7157,6 +7190,9 @@ func (m *StatFileRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.MountIndex != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MountIndex))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -12506,6 +12542,25 @@ func (m *ReadFileRequest) UnmarshalVT(dAtA []byte) error {
 				return err
 			}
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -12827,6 +12882,25 @@ func (m *ReadDirRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.IncludePattern = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
@@ -13035,6 +13109,25 @@ func (m *StatFileRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.Path = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MountIndex", wireType)
+			}
+			m.MountIndex = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MountIndex |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])

vendor/github.com/moby/buildkit/session/auth/auth.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/auth/auth.proto
 

vendor/github.com/moby/buildkit/session/filesync/filesync.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/filesync/filesync.proto
 

vendor/github.com/moby/buildkit/session/secrets/secrets.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/secrets/secrets.proto
 

vendor/github.com/moby/buildkit/session/sshforward/ssh.go

@@ -80,7 +80,8 @@ func MountSSHSocket(ctx context.Context, c session.Caller, opt SocketOpt) (sockP
 
 	sockPath = filepath.Join(dir, "ssh_auth_sock")
 
-	l, err := net.Listen("unix", sockPath)
+	listener := net.ListenConfig{}
+	l, err := listener.Listen(context.TODO(), "unix", sockPath)
 	if err != nil {
 		return "", nil, errors.WithStack(err)
 	}

vendor/github.com/moby/buildkit/session/sshforward/ssh.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/sshforward/ssh.proto
 

vendor/github.com/moby/buildkit/session/sshforward/sshprovider/agentprovider.go

@@ -194,7 +194,8 @@ func toDialer(paths []string, raw bool) (func(context.Context) (net.Conn, error)
 }
 
 func unixSocketDialer(path string) (net.Conn, error) {
-	return net.DialTimeout("unix", path, 2*time.Second)
+	dialer := net.Dialer{Timeout: 2 * time.Second}
+	return dialer.DialContext(context.TODO(), "unix", path)
 }
 
 type readOnlyAgent struct {

vendor/github.com/moby/buildkit/session/upload/upload.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/session/upload/upload.proto
 

vendor/github.com/moby/buildkit/solver/errdefs/errdefs.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/solver/errdefs/errdefs.proto
 

vendor/github.com/moby/buildkit/solver/errdefs/solve.go

@@ -14,7 +14,7 @@ func init() {
 	typeurl.Register((*Solve)(nil), "github.com/moby/buildkit", "errdefs.Solve+json")
 }
 
-//nolint:revive,staticcheck
+//nolint:staticcheck
 type IsSolve_Subject isSolve_Subject
 
 // SolveError will be returned when an error is encountered during a solve that

vendor/github.com/moby/buildkit/solver/pb/ops.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/solver/pb/ops.proto
 

vendor/github.com/moby/buildkit/sourcepolicy/pb/json.go

@@ -1,4 +1,4 @@
-package moby_buildkit_v1_sourcepolicy //nolint:revive,staticcheck
+package moby_buildkit_v1_sourcepolicy //nolint:staticcheck
 
 import (
 	"github.com/moby/buildkit/util/gogo/proto"

vendor/github.com/moby/buildkit/sourcepolicy/pb/policy.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/sourcepolicy/pb/policy.proto
 

vendor/github.com/moby/buildkit/sourcepolicy/policysession/denyerror.go

@@ -0,0 +1,54 @@
+package policysession
+
+import (
+	"github.com/containerd/typeurl/v2"
+	spb "github.com/moby/buildkit/sourcepolicy/pb"
+	"github.com/moby/buildkit/util/grpcerrors"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	typeurl.Register((*DecisionResponse)(nil), "github.com/moby/buildkit", "policysession.DecisionResponse+json")
+}
+
+// DenyMessagesError wraps an error with policy deny messages so they can be
+// propagated as a typed error detail.
+type DenyMessagesError struct {
+	Messages []*DenyMessage
+	error
+}
+
+func (e *DenyMessagesError) Unwrap() error {
+	return e.error
+}
+
+func (e *DenyMessagesError) ToProto() grpcerrors.TypedErrorProto {
+	return &DecisionResponse{
+		Action:       spb.PolicyAction_DENY,
+		DenyMessages: e.Messages,
+	}
+}
+
+// WrapDenyMessages adds deny messages to an error when available.
+func WrapDenyMessages(err error, msgs []*DenyMessage) error {
+	if err == nil || len(msgs) == 0 {
+		return err
+	}
+	return &DenyMessagesError{Messages: msgs, error: err}
+}
+
+// DenyMessages extracts policy deny messages from an error chain.
+func DenyMessages(err error) []*DenyMessage {
+	var out []*DenyMessage
+	var de *DenyMessagesError
+	if errors.As(err, &de) {
+		out = DenyMessages(de.Unwrap())
+		out = append(out, de.Messages...)
+	}
+	return out
+}
+
+// WrapError implements grpcerrors.TypedErrorProto for DecisionResponse.
+func (d *DecisionResponse) WrapError(err error) error {
+	return WrapDenyMessages(err, d.GetDenyMessages())
+}

vendor/github.com/moby/buildkit/sourcepolicy/policysession/policysession.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/sourcepolicy/policysession/policysession.proto
 

vendor/github.com/moby/buildkit/util/apicaps/pb/caps.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/util/apicaps/pb/caps.proto
 

vendor/github.com/moby/buildkit/util/errutil/errutil.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/containerd/containerd/v2/core/remotes/docker"
 	remoteserrors "github.com/containerd/containerd/v2/core/remotes/errors"
@@ -81,11 +82,13 @@ func (e *formattedDockerError) Error() string {
 	case 1:
 		return format(e.dErr[0])
 	default:
-		msg := "errors:\n"
+		var msg strings.Builder
+		msg.WriteString("errors:\n")
 		for _, err := range e.dErr {
-			msg += format(err) + "\n"
+			msg.WriteString(format(err))
+			msg.WriteByte('\n')
 		}
-		return msg
+		return msg.String()
 	}
 }
 

vendor/github.com/moby/buildkit/util/gitutil/git_cli.go

@@ -145,7 +145,7 @@ func (cli *GitCLI) Run(ctx context.Context, args ...string) (_ []byte, err error
 		if cli.exec == nil {
 			cmd = exec.CommandContext(ctx, gitBinary)
 		} else {
-			cmd = exec.Command(gitBinary)
+			cmd = exec.CommandContext(context.TODO(), gitBinary)
 		}
 
 		cmd.Dir = cli.dir

vendor/github.com/moby/buildkit/util/resolver/limited/group.go

@@ -20,7 +20,10 @@ type contextKeyT string
 
 var contextKey = contextKeyT("buildkit/util/resolver/limited")
 
-var Default = New(4)
+// DefaultMaxConcurrency is the default number of concurrent connections per registry.
+var DefaultMaxConcurrency int64 = 4
+
+var Default = New(int(DefaultMaxConcurrency))
 
 type Group struct {
 	mu   sync.Mutex

vendor/github.com/moby/buildkit/util/stack/stack.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.10
+// 	protoc-gen-go v1.36.11
 // 	protoc        v3.11.4
 // source: github.com/moby/buildkit/util/stack/stack.proto
 

vendor/github.com/moby/buildkit/util/testutil/dockerd/client/client.go

@@ -235,14 +235,17 @@ func (cli *Client) Dialer() func(context.Context) (net.Conn, error) {
 		}
 		switch cli.proto {
 		case "unix":
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		case "npipe":
 			return DialPipe(cli.addr, 32*time.Second)
 		default:
 			if tlsConfig := cli.tlsConfig(); tlsConfig != nil {
-				return tls.Dial(cli.proto, cli.addr, tlsConfig)
+				dialer := tls.Dialer{Config: tlsConfig}
+				return dialer.DialContext(ctx, cli.proto, cli.addr)
 			}
-			return net.Dial(cli.proto, cli.addr)
+			dialer := net.Dialer{}
+			return dialer.DialContext(ctx, cli.proto, cli.addr)
 		}
 	}
 }

vendor/github.com/moby/buildkit/util/testutil/dockerd/daemon.go

@@ -2,6 +2,7 @@ package dockerd
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"io"
 	"os"
@@ -140,7 +141,7 @@ func (d *Daemon) StartWithError(daemonLogs map[string]*bytes.Buffer, providedArg
 	}
 
 	d.args = append(d.args, providedArgs...)
-	d.cmd = exec.Command(dockerdBinary, d.args...)
+	d.cmd = exec.CommandContext(context.TODO(), dockerdBinary, d.args...)
 	d.cmd.Env = append(d.envs, "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE=1", "BUILDKIT_DEBUG_EXEC_OUTPUT=1", "BUILDKIT_DEBUG_PANIC_ON_ERROR=1")
 
 	if daemonLogs != nil {

vendor/github.com/moby/buildkit/util/testutil/integration/registry.go

@@ -56,7 +56,7 @@ http:
 		}
 	}
 
-	cmd := exec.Command("registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "registry", "serve", filepath.Join(dir, "config.yaml")) //nolint:gosec // test utility
 	rc, err := cmd.StderrPipe()
 	if err != nil {
 		return "", nil, err

vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go

@@ -76,7 +76,7 @@ func (sb *sandbox) Cmd(args ...string) *exec.Cmd {
 			args = split
 		}
 	}
-	cmd := exec.Command("buildctl", args...)
+	cmd := exec.CommandContext(context.TODO(), "buildctl", args...)
 	cmd.Env = append(cmd.Env, os.Environ()...)
 	cmd.Env = append(cmd.Env, "BUILDKIT_HOST="+sb.Address())
 	if v := os.Getenv("GO_TEST_COVERPROFILE"); v != "" {
@@ -188,7 +188,7 @@ func printBuildkitdDebugLogs(t *testing.T, addr string) {
 }
 
 func RootlessSupported(uid int) bool {
-	cmd := exec.Command("sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), "sudo", "-u", fmt.Sprintf("#%d", uid), "-i", "--", "exec", "unshare", "-U", "true") //nolint:gosec // test utility
 	b, err := cmd.CombinedOutput()
 	if err != nil {
 		bklog.L.Warnf("rootless mode is not supported on this host: %v (%s)", err, string(b))

vendor/github.com/moby/buildkit/util/testutil/workers/containerd.go

@@ -191,7 +191,7 @@ disabled_plugins = ["io.containerd.grpc.v1.cri"]
 		}, c.ExtraEnv...), "containerd-rootless.sh", "-c", configFile)
 	}
 
-	cmd := exec.Command(containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), containerdArgs[0], containerdArgs[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(os.Environ(), c.ExtraEnv...)
 
 	ctdStop, err := integration.StartCmd(cmd, cfg.Logs)
@@ -278,7 +278,7 @@ func runStargzSnapshotter(cfg *integration.BackendConfig) (address string, cl fu
 
 	address = filepath.Join(tmpStargzDir, "containerd-stargz-grpc.sock")
 	stargzRootDir := filepath.Join(tmpStargzDir, "root")
-	cmd := exec.Command(binary,
+	cmd := exec.CommandContext(context.TODO(), binary,
 		"--log-level", "debug",
 		"--address", address,
 		"--root", stargzRootDir)

vendor/github.com/moby/buildkit/util/testutil/workers/dockerd.go

@@ -207,7 +207,8 @@ func (c Moby) New(ctx context.Context, cfg *integration.BackendConfig) (b integr
 	f.Close()
 	os.Remove(localPath)
 
-	listener, err := net.Listen(buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
+	listenerConfig := net.ListenConfig{}
+	listener, err := listenerConfig.Listen(context.TODO(), buildkitdNetworkProtocol, getBuildkitdNetworkAddr(localPath))
 	if err != nil {
 		return nil, nil, errors.Wrapf(err, "dockerd listener error: %s", integration.FormatLogs(cfg.Logs))
 	}

vendor/github.com/moby/buildkit/util/testutil/workers/util.go

@@ -2,6 +2,7 @@ package workers
 
 import (
 	"bytes"
+	"context"
 	"fmt"
 	"os"
 	"os/exec"
@@ -95,7 +96,7 @@ func runBuildkitd(
 	debugAddress := getBuildkitdDebugAddr(tmpdir)
 
 	args = append(args, "--root", tmpdir, "--addr", address, "--debug")
-	cmd := exec.Command(args[0], args[1:]...) //nolint:gosec // test utility
+	cmd := exec.CommandContext(context.TODO(), args[0], args[1:]...) //nolint:gosec // test utility
 	cmd.Env = append(
 		os.Environ(),
 		"BUILDKIT_DEBUG_EXEC_OUTPUT=1",

vendor/github.com/moby/policy-helpers/types/name.go

@@ -0,0 +1,172 @@
+package types
+
+import (
+	"strings"
+)
+
+const (
+	githubPrefix                 = "https://github.com/"
+	githubBuilderURIExperimental = githubPrefix + "docker/github-builder-experimental/.github/workflows/"
+	githubBuilderURI             = githubPrefix + "docker/github-builder/.github/workflows/"
+
+	githubIssuer     = "https://token.actions.githubusercontent.com"
+	googleUserIssuer = "https://accounts.google.com"
+	githubUserIssuer = githubPrefix + "login/oauth"
+
+	sigstoreIssuer = "CN=sigstore-intermediate,O=sigstore.dev"
+)
+
+func (s SignatureInfo) DetectKind() Kind {
+	if isDHI(s) {
+		return KindDockerHardenedImage
+	}
+	if isGithubBuilder(s) {
+		return KindDockerGithubBuilder
+	}
+	if isGithubSelfSigned(s) {
+		return KindSelfSignedGithubRepo
+	}
+	if isSelfSigned(s) {
+		return KindSelfSigned
+	}
+	return KindUntrusted
+}
+
+func (s SignatureInfo) Name() string {
+	switch s.Kind {
+	case KindDockerHardenedImage:
+		return s.Kind.String() + " (" + s.DockerReference + ")"
+
+	case KindDockerGithubBuilder:
+		n := s.Kind.String()
+		if strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURIExperimental) {
+			n += " Experimental"
+		}
+		n += " (" + strings.TrimPrefix(s.Signer.SourceRepositoryURI, githubPrefix)
+
+		if v, ok := strings.CutPrefix(s.Signer.SourceRepositoryRef, "refs/heads/"); ok {
+			n += "@" + v
+		} else if v, ok := strings.CutPrefix(s.Signer.SourceRepositoryRef, "refs/tags/"); ok {
+			n += "@" + v
+		}
+		n += ")"
+		return n
+
+	case KindSelfSignedGithubRepo:
+
+		return s.Kind.String() + " (" + strings.TrimPrefix(s.Signer.SourceRepositoryURI, githubPrefix) + ")"
+
+	case KindSelfSigned:
+		n := s.Kind.String()
+		if s.Signer.RunnerEnvironment != "github-hosted" {
+			n += " Local"
+		}
+		switch s.Signer.Issuer {
+		case googleUserIssuer:
+			n += " (Google: " + s.Signer.SubjectAlternativeName + ")"
+		case githubUserIssuer:
+			n += " (GitHub: " + s.Signer.SubjectAlternativeName + ")"
+		}
+		return n
+
+	default:
+		return s.Kind.String()
+	}
+}
+
+func isDHI(s SignatureInfo) bool {
+	if !s.IsDHI {
+		return false
+	}
+	if s.DockerReference == "" {
+		return false
+	}
+	return true
+}
+
+func isGithubBuilder(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	isGithubBuilder := strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURI)
+	isExperimental := strings.HasPrefix(s.Signer.BuildSignerURI, githubBuilderURIExperimental)
+	if !isGithubBuilder && !isExperimental {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SubjectAlternativeName, githubBuilderURI) && !strings.HasPrefix(s.Signer.SubjectAlternativeName, githubBuilderURIExperimental) {
+		return false
+	}
+
+	if s.Signer.Issuer != githubIssuer {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SourceRepositoryURI, githubPrefix) {
+		return false
+	}
+
+	if s.Signer.RunnerEnvironment != "github-hosted" {
+		return false
+	}
+
+	if len(s.Timestamps) == 0 {
+		return false
+	}
+
+	if s.SignatureType != SignatureBundleV03 {
+		return false
+	}
+
+	return true
+}
+
+func isSelfSigned(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	return true
+}
+
+func isGithubSelfSigned(s SignatureInfo) bool {
+	if s.Signer == nil {
+		return false
+	}
+
+	if s.Signer.CertificateIssuer != sigstoreIssuer {
+		return false
+	}
+
+	if s.Signer.Issuer != githubIssuer {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SourceRepositoryURI, "https://github.com/") {
+		return false
+	}
+
+	signerURIPrefix := s.Signer.SourceRepositoryURI + "/.github/workflows/"
+	if !strings.HasPrefix(s.Signer.BuildSignerURI, signerURIPrefix) {
+		return false
+	}
+
+	if !strings.HasPrefix(s.Signer.SubjectAlternativeName, signerURIPrefix) {
+		return false
+	}
+
+	if s.Signer.RunnerEnvironment != "github-hosted" {
+		return false
+	}
+
+	return true
+}

vendor/github.com/moby/policy-helpers/types/siginfo.go

@@ -6,6 +6,51 @@ import (
 	"github.com/sigstore/sigstore-go/pkg/fulcio/certificate"
 )
 
+type Kind int
+
+const (
+	KindDockerGithubBuilder  Kind = 1
+	KindDockerHardenedImage  Kind = 2
+	KindSelfSignedGithubRepo Kind = 3
+	KindSelfSigned           Kind = 4
+	KindUntrusted            Kind = 1000
+)
+
+func (k Kind) String() string {
+	switch k {
+	case KindDockerGithubBuilder:
+		return "Docker GitHub Builder"
+	case KindDockerHardenedImage:
+		return "Docker Hardened Image"
+	case KindSelfSignedGithubRepo:
+		return "GitHub Self-Signed"
+	case KindSelfSigned:
+		return "Self-Signed"
+	case KindUntrusted:
+		return "Untrusted"
+	default:
+		return "Invalid"
+	}
+}
+
+type SignatureType int
+
+const (
+	SignatureBundleV03       SignatureType = 1
+	SignatureSimpleSigningV1 SignatureType = 2
+)
+
+func (st SignatureType) String() string {
+	switch st {
+	case SignatureBundleV03:
+		return "Sigstore Bundle"
+	case SignatureSimpleSigningV1:
+		return "SimpleSigning v1"
+	default:
+		return "Unknown"
+	}
+}
+
 type TimestampVerificationResult struct {
 	Type      string    `json:"type"`
 	URI       string    `json:"uri"`
@@ -18,6 +63,8 @@ type TrustRootStatus struct {
 }
 
 type SignatureInfo struct {
+	Kind            Kind                          `json:"kind"`
+	SignatureType   SignatureType                 `json:"signatureType"`
 	Signer          *certificate.Summary          `json:"signer,omitempty"`
 	Timestamps      []TimestampVerificationResult `json:"timestamps,omitempty"`
 	DockerReference string                        `json:"dockerReference,omitempty"`

vendor/github.com/moby/policy-helpers/verifier.go

@@ -47,7 +47,12 @@ func NewVerifier(cfg Config) (*Verifier, error) {
 	return v, nil
 }
 
-func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundleBytes []byte) (*types.SignatureInfo, error) {
+func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundleBytes []byte, opt ...ArtifactVerifyOpt) (*types.SignatureInfo, error) {
+	opts := &ArtifactVerifyOpts{}
+	for _, o := range opt {
+		o(opts)
+	}
+
 	anyCert, err := anyCerificateIdentity()
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -87,15 +92,18 @@ func (v *Verifier) VerifyArtifact(ctx context.Context, dgst digest.Digest, bundl
 		return nil, errors.Errorf("no valid signatures found")
 	}
 
-	if !isSLSAPredicateType(result.Statement.PredicateType) {
+	if !opts.SLSANotRequired && !isSLSAPredicateType(result.Statement.PredicateType) {
 		return nil, errors.Errorf("unexpected predicate type %q, expecting SLSA provenance", result.Statement.PredicateType)
 	}
 
-	return &types.SignatureInfo{
+	si := &types.SignatureInfo{
 		TrustRootStatus: toRootStatus(st),
 		Signer:          result.Signature.Certificate,
 		Timestamps:      toTimestamps(result.VerifiedTimestamps),
-	}, nil
+		SignatureType:   types.SignatureBundleV03,
+	}
+	si.Kind = si.DetectKind()
+	return si, nil
 }
 
 func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProvider, desc ocispecs.Descriptor, platform *ocispecs.Platform) (*types.SignatureInfo, error) {
@@ -191,6 +199,7 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 	var dockerReference string
 
 	var se verify.SignedEntity
+	sigType := types.SignatureBundleV03
 	switch layer.MediaType {
 	case image.ArtifactTypeSigstoreBundle:
 		if mfst.ArtifactType != image.ArtifactTypeSigstoreBundle {
@@ -212,6 +221,7 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 		}
 		artifactPolicy = verify.WithArtifactDigest(alg, rawDgst)
 	case image.MediaTypeCosignSimpleSigning:
+		sigType = types.SignatureSimpleSigningV1
 		payloadBytes, err := image.ReadBlob(ctx, sc.Provider, layer)
 		if err != nil {
 			return nil, errors.Wrapf(err, "reading bundle layer %s from signature manifest %s", layer.Digest, sc.SignatureManifest.Digest)
@@ -297,13 +307,16 @@ func (v *Verifier) VerifyImage(ctx context.Context, provider image.ReferrersProv
 		return nil, errors.Errorf("no valid signatures found")
 	}
 
-	return &types.SignatureInfo{
+	si := &types.SignatureInfo{
 		TrustRootStatus: toRootStatus(st),
 		Signer:          result.Signature.Certificate,
 		Timestamps:      toTimestamps(result.VerifiedTimestamps),
 		DockerReference: dockerReference,
 		IsDHI:           sc.DHI,
-	}, nil
+		SignatureType:   sigType,
+	}
+	si.Kind = si.DetectKind()
+	return si, nil
 }
 
 func (v *Verifier) loadTrustProvider() (*roots.TrustProvider, error) {
@@ -342,9 +355,7 @@ func anyCerificateIdentity() (verify.PolicyOption, error) {
 		return nil, err
 	}
 
-	extensions := certificate.Extensions{
-		RunnerEnvironment: "github-hosted",
-	}
+	extensions := certificate.Extensions{}
 
 	certID, err := verify.NewCertificateIdentity(sanMatcher, issuerMatcher, extensions)
 	if err != nil {
@@ -354,6 +365,18 @@ func anyCerificateIdentity() (verify.PolicyOption, error) {
 	return verify.WithCertificateIdentity(certID), nil
 }
 
+type ArtifactVerifyOpts struct {
+	SLSANotRequired bool
+}
+
+type ArtifactVerifyOpt func(*ArtifactVerifyOpts)
+
+func WithSLSANotRequired() ArtifactVerifyOpt {
+	return func(o *ArtifactVerifyOpts) {
+		o.SLSANotRequired = true
+	}
+}
+
 func loadBundle(dt []byte) (*bundle.Bundle, error) {
 	var bundle bundle.Bundle
 	bundle.Bundle = new(protobundle.Bundle)