From 931e7149193d3a5f18569d3b86a540e2080c861d Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Thu, 19 Jun 2025 18:47:23 +0200 Subject: [PATCH 1/2] vendor: github.com/moby/buildkit 9b91d20 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 +- .../llbsolver/provenance/types/types.go | 120 ++++++++++++------ vendor/modules.txt | 2 +- 4 files changed, 87 insertions(+), 41 deletions(-) diff --git a/go.mod b/go.mod index 5d6d887ff..bdf1554ba 100644 --- a/go.mod +++ b/go.mod @@ -28,7 +28,7 @@ require ( github.com/hashicorp/hcl/v2 v2.23.0 github.com/in-toto/in-toto-golang v0.9.0 github.com/mitchellh/hashstructure/v2 v2.0.2 - github.com/moby/buildkit v0.23.0 + github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db // master github.com/moby/go-archive v0.1.0 github.com/moby/sys/atomicwriter v0.1.0 github.com/moby/sys/mountinfo v0.7.2 diff --git a/go.sum b/go.sum index 10be082cf..fe530559b 100644 --- a/go.sum +++ b/go.sum @@ -250,8 +250,8 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZX github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4= github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE= github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= -github.com/moby/buildkit v0.23.0 h1:HV+u7xM2IZhAjVautFR2l5FNhkxFR0jhF5ILXyc3398= -github.com/moby/buildkit v0.23.0/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ= +github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db h1:ZzrDuG9G1A/RwJvuogNplxCEKsIUQh1CqEnqbOGFgKE= +github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ= github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ= diff --git a/vendor/github.com/moby/buildkit/solver/llbsolver/provenance/types/types.go b/vendor/github.com/moby/buildkit/solver/llbsolver/provenance/types/types.go index 869ad0b5b..952c9720d 100644 --- a/vendor/github.com/moby/buildkit/solver/llbsolver/provenance/types/types.go +++ b/vendor/github.com/moby/buildkit/solver/llbsolver/provenance/types/types.go @@ -14,9 +14,20 @@ import ( ) const ( - BuildKitBuildType = "https://mobyproject.org/buildkit@v1" + BuildKitBuildType1 = "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md" + BuildKitBuildType02 = "https://mobyproject.org/buildkit@v1" + + ProvenanceSLSA1 = ProvenanceSLSA("v1") + ProvenanceSLSA02 = ProvenanceSLSA("v0.2") ) +type ProvenanceSLSA string + +var provenanceSLSAs = []ProvenanceSLSA{ + ProvenanceSLSA1, + ProvenanceSLSA02, +} + type BuildConfig struct { Definition []BuildStep `json:"llbDefinition,omitempty"` DigestMapping map[digest.Digest]string `json:"digestMapping,omitempty"` @@ -80,18 +91,6 @@ type Sources struct { Local []LocalSource } -const ( - ProvenanceSLSA1 = ProvenanceSLSA("v1") - ProvenanceSLSA02 = ProvenanceSLSA("v0.2") -) - -type ProvenanceSLSA string - -var provenanceSLSAs = []ProvenanceSLSA{ - ProvenanceSLSA1, - ProvenanceSLSA02, -} - func (ps *ProvenanceSLSA) Validate() error { if *ps == "" { return errors.New("provenance SLSA version cannot be empty") @@ -188,16 +187,63 @@ type BuildKitComplete struct { ResolvedDependencies bool `json:"resolvedDependencies"` } -// ConvertSLSA02ToSLSA1 converts a SLSA 0.2 provenance predicate to a SLSA 1.0 -// provenance predicate. -// FIXME: It should be the other way around when v1 is the default. -func ConvertSLSA02ToSLSA1(p02 *ProvenancePredicateSLSA02) *ProvenancePredicateSLSA1 { - if p02 == nil { - return nil +// ConvertToSLSA02 converts to a SLSA v0.2 provenance predicate. +func (p *ProvenancePredicateSLSA1) ConvertToSLSA02() *ProvenancePredicateSLSA02 { + var materials []slsa02.ProvenanceMaterial + for _, m := range p.BuildDefinition.ResolvedDependencies { + materials = append(materials, slsa02.ProvenanceMaterial{ + URI: m.URI, + Digest: m.Digest, + }) } + var meta *ProvenanceMetadataSLSA02 + if p.RunDetails.Metadata != nil { + meta = &ProvenanceMetadataSLSA02{ + ProvenanceMetadata: slsa02.ProvenanceMetadata{ + BuildInvocationID: p.RunDetails.Metadata.InvocationID, + BuildStartedOn: p.RunDetails.Metadata.StartedOn, + BuildFinishedOn: p.RunDetails.Metadata.FinishedOn, + Completeness: slsa02.ProvenanceComplete{ + Parameters: p.RunDetails.Metadata.Completeness.Request, + Environment: true, + Materials: p.RunDetails.Metadata.Completeness.ResolvedDependencies, + }, + Reproducible: p.RunDetails.Metadata.Reproducible, + }, + BuildKitMetadata: p.RunDetails.Metadata.BuildKitMetadata, + Hermetic: p.RunDetails.Metadata.Hermetic, + } + } + + return &ProvenancePredicateSLSA02{ + ProvenancePredicate: slsa02.ProvenancePredicate{ + Builder: slsa02.ProvenanceBuilder{ + ID: p.RunDetails.Builder.ID, + }, + BuildType: BuildKitBuildType02, + Materials: materials, + }, + Invocation: ProvenanceInvocationSLSA02{ + ConfigSource: slsa02.ConfigSource{ + URI: p.BuildDefinition.ExternalParameters.ConfigSource.URI, + Digest: p.BuildDefinition.ExternalParameters.ConfigSource.Digest, + EntryPoint: p.BuildDefinition.ExternalParameters.ConfigSource.Path, + }, + Parameters: p.BuildDefinition.ExternalParameters.Request, + Environment: Environment{ + Platform: p.BuildDefinition.InternalParameters.BuilderPlatform, + }, + }, + BuildConfig: p.BuildDefinition.InternalParameters.BuildConfig, + Metadata: meta, + } +} + +// ConvertToSLSA1 converts to a SLSA v1 provenance predicate. +func (p *ProvenancePredicateSLSA02) ConvertToSLSA1() *ProvenancePredicateSLSA1 { var resolvedDeps []slsa1.ResourceDescriptor - for _, m := range p02.Materials { + for _, m := range p.Materials { resolvedDeps = append(resolvedDeps, slsa1.ResourceDescriptor{ URI: m.URI, Digest: m.Digest, @@ -206,45 +252,45 @@ func ConvertSLSA02ToSLSA1(p02 *ProvenancePredicateSLSA02) *ProvenancePredicateSL buildDef := ProvenanceBuildDefinitionSLSA1{ ProvenanceBuildDefinition: slsa1.ProvenanceBuildDefinition{ - BuildType: "https://github.com/moby/buildkit/blob/master/docs/attestations/slsa-definitions.md", + BuildType: BuildKitBuildType1, ResolvedDependencies: resolvedDeps, }, ExternalParameters: ProvenanceExternalParametersSLSA1{ ConfigSource: ProvenanceConfigSourceSLSA1{ - URI: p02.Invocation.ConfigSource.URI, - Digest: p02.Invocation.ConfigSource.Digest, - Path: p02.Invocation.ConfigSource.EntryPoint, + URI: p.Invocation.ConfigSource.URI, + Digest: p.Invocation.ConfigSource.Digest, + Path: p.Invocation.ConfigSource.EntryPoint, }, - Request: p02.Invocation.Parameters, + Request: p.Invocation.Parameters, }, InternalParameters: ProvenanceInternalParametersSLSA1{ - BuildConfig: p02.BuildConfig, - BuilderPlatform: p02.Invocation.Environment.Platform, + BuildConfig: p.BuildConfig, + BuilderPlatform: p.Invocation.Environment.Platform, }, } var meta *ProvenanceMetadataSLSA1 - if p02.Metadata != nil { + if p.Metadata != nil { meta = &ProvenanceMetadataSLSA1{ BuildMetadata: slsa1.BuildMetadata{ - InvocationID: p02.Metadata.BuildInvocationID, - StartedOn: p02.Metadata.BuildStartedOn, - FinishedOn: p02.Metadata.BuildFinishedOn, + InvocationID: p.Metadata.BuildInvocationID, + StartedOn: p.Metadata.BuildStartedOn, + FinishedOn: p.Metadata.BuildFinishedOn, }, - BuildKitMetadata: p02.Metadata.BuildKitMetadata, - Hermetic: p02.Metadata.Hermetic, + BuildKitMetadata: p.Metadata.BuildKitMetadata, + Hermetic: p.Metadata.Hermetic, Completeness: BuildKitComplete{ - Request: p02.Metadata.Completeness.Parameters, - ResolvedDependencies: p02.Metadata.Completeness.Materials, + Request: p.Metadata.Completeness.Parameters, + ResolvedDependencies: p.Metadata.Completeness.Materials, }, - Reproducible: p02.Metadata.Reproducible, + Reproducible: p.Metadata.Reproducible, } } runDetails := ProvenanceRunDetailsSLSA1{ ProvenanceRunDetails: slsa1.ProvenanceRunDetails{ Builder: slsa1.Builder{ - ID: p02.Builder.ID, + ID: p.Builder.ID, // TODO: handle builder components versions // Version: map[string]string{ // "buildkit": version.Version, diff --git a/vendor/modules.txt b/vendor/modules.txt index 450c376ed..af545baea 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -447,7 +447,7 @@ github.com/mitchellh/go-wordwrap # github.com/mitchellh/hashstructure/v2 v2.0.2 ## explicit; go 1.14 github.com/mitchellh/hashstructure/v2 -# github.com/moby/buildkit v0.23.0 +# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db ## explicit; go 1.23.0 github.com/moby/buildkit/api/services/control github.com/moby/buildkit/api/types From 2588b66fd9544d6f009a6c086da9694b158ef408 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Wed, 18 Jun 2025 13:36:26 +0200 Subject: [PATCH 2/2] build: fix buildx.build.provenance metadata Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- build/provenance.go | 46 ++++++++++++++++--------------------- commands/history/inspect.go | 2 +- tests/bake.go | 2 +- tests/build.go | 2 +- 4 files changed, 23 insertions(+), 29 deletions(-) diff --git a/build/provenance.go b/build/provenance.go index 4a9b2d188..b15109051 100644 --- a/build/provenance.go +++ b/build/provenance.go @@ -13,6 +13,7 @@ import ( "github.com/containerd/containerd/v2/core/content/proxy" "github.com/docker/buildx/util/confutil" "github.com/docker/buildx/util/progress" + slsa1 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1" controlapi "github.com/moby/buildkit/api/services/control" "github.com/moby/buildkit/client" provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types" @@ -22,15 +23,6 @@ import ( "golang.org/x/sync/errgroup" ) -type provenancePredicate struct { - Builder *provenanceBuilder `json:"builder,omitempty"` - provenancetypes.ProvenancePredicateSLSA02 -} - -type provenanceBuilder struct { - ID string `json:"id,omitempty"` -} - func setRecordProvenance(ctx context.Context, c *client.Client, sr *client.SolveResponse, ref string, mode confutil.MetadataProvenanceMode, pw progress.Writer) error { if mode == confutil.MetadataProvenanceModeDisabled { return nil @@ -69,7 +61,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con continue } if ev.Record.Result != nil { - desc := lookupProvenance(ev.Record.Result) + desc, predicateType := lookupProvenance(ev.Record.Result) if desc == nil { continue } @@ -78,7 +70,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con if err != nil { return errors.Wrapf(err, "failed to load provenance blob from build record") } - prv, err := encodeProvenance(dt, mode) + prv, err := encodeProvenance(dt, predicateType, mode) if err != nil { return err } @@ -92,7 +84,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con }) } else if ev.Record.Results != nil { for platform, res := range ev.Record.Results { - desc := lookupProvenance(res) + desc, predicateType := lookupProvenance(res) if desc == nil { continue } @@ -101,7 +93,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con if err != nil { return errors.Wrapf(err, "failed to load provenance blob from build record") } - prv, err := encodeProvenance(dt, mode) + prv, err := encodeProvenance(dt, predicateType, mode) if err != nil { return err } @@ -119,7 +111,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con return out, eg.Wait() } -func lookupProvenance(res *controlapi.BuildResultInfo) *ocispecs.Descriptor { +func lookupProvenance(res *controlapi.BuildResultInfo) (*ocispecs.Descriptor, string) { for _, a := range res.Attestations { if a.MediaType == "application/vnd.in-toto+json" && strings.HasPrefix(a.Annotations["in-toto.io/predicate-type"], "https://slsa.dev/provenance/") { return &ocispecs.Descriptor{ @@ -127,27 +119,29 @@ func lookupProvenance(res *controlapi.BuildResultInfo) *ocispecs.Descriptor { Size: a.Size, MediaType: a.MediaType, Annotations: a.Annotations, - } + }, a.Annotations["in-toto.io/predicate-type"] } } - return nil + return nil, "" } -func encodeProvenance(dt []byte, mode confutil.MetadataProvenanceMode) (string, error) { - var prv provenancePredicate - if err := json.Unmarshal(dt, &prv); err != nil { +func encodeProvenance(dt []byte, predicateType string, mode confutil.MetadataProvenanceMode) (string, error) { + var pred *provenancetypes.ProvenancePredicateSLSA02 + if predicateType == slsa1.PredicateSLSAProvenance { + var pred1 *provenancetypes.ProvenancePredicateSLSA1 + if err := json.Unmarshal(dt, &pred1); err != nil { + return "", errors.Wrapf(err, "failed to unmarshal provenance") + } + pred = pred1.ConvertToSLSA02() + } else if err := json.Unmarshal(dt, &pred); err != nil { return "", errors.Wrapf(err, "failed to unmarshal provenance") } - if prv.Builder != nil && prv.Builder.ID == "" { - // reset builder if id is empty - prv.Builder = nil - } if mode == confutil.MetadataProvenanceModeMin { // reset fields for minimal provenance - prv.BuildConfig = nil - prv.Metadata = nil + pred.BuildConfig = nil + pred.Metadata = nil } - dtprv, err := json.Marshal(prv) + dtprv, err := json.Marshal(pred) if err != nil { return "", errors.Wrapf(err, "failed to marshal provenance") } diff --git a/commands/history/inspect.go b/commands/history/inspect.go index 920143fb9..545558d01 100644 --- a/commands/history/inspect.go +++ b/commands/history/inspect.go @@ -441,7 +441,7 @@ workers0: if err := json.Unmarshal(dt, &pred02); err != nil { return errors.Errorf("failed to unmarshal provenance %s: %v", prov.descr.Digest, err) } - pred = provenancetypes.ConvertSLSA02ToSLSA1(pred02) + pred = pred02.ConvertToSLSA1() } else if err := json.Unmarshal(dt, &pred); err != nil { return errors.Errorf("failed to unmarshal provenance %s: %v", prov.descr.Digest, err) } diff --git a/tests/bake.go b/tests/bake.go index 0ce6d216c..b6fd15858 100644 --- a/tests/bake.go +++ b/tests/bake.go @@ -1398,7 +1398,7 @@ target "default" { var prv provenancetypes.ProvenancePredicateSLSA02 require.NoError(t, json.Unmarshal(dtprv, &prv)) - require.Equal(t, provenancetypes.BuildKitBuildType, prv.BuildType) + require.Equal(t, provenancetypes.BuildKitBuildType02, prv.BuildType) } func testBakeMetadataWarnings(t *testing.T, sb integration.Sandbox) { diff --git a/tests/build.go b/tests/build.go index e179163cf..f494907a6 100644 --- a/tests/build.go +++ b/tests/build.go @@ -835,7 +835,7 @@ func buildMetadataProvenance(t *testing.T, sb integration.Sandbox, metadataMode var prv provenancetypes.ProvenancePredicateSLSA02 require.NoError(t, json.Unmarshal(dtprv, &prv)) - require.Equal(t, provenancetypes.BuildKitBuildType, prv.BuildType) + require.Equal(t, provenancetypes.BuildKitBuildType02, prv.BuildType) } func testBuildMetadataWarnings(t *testing.T, sb integration.Sandbox) {