vendor: update buildkit to v0.29.0-rc1

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2026-03-25 15:47:08 -07:00
parent a7d3578248
commit eba72a35e4
518 changed files with 29223 additions and 24305 deletions
@@ -5,6 +5,7 @@ import (
 	"sync"

 	"github.com/moby/buildkit/solver/pb"
+	"github.com/moby/buildkit/util/bkmaps"
 	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
@@ -24,7 +25,7 @@ type DefinitionOp struct {
 	platforms  map[digest.Digest]*ocispecs.Platform
 	dgst       digest.Digest
 	index      pb.OutputIndex
-	inputCache *sync.Map // shared and written among DefinitionOps so avoid race on this map using sync.Map
+	inputCache *bkmaps.SyncMap[string, []*DefinitionOp] // shared and written among DefinitionOps so avoid race on this map using sync.Map
 }

 // NewDefinitionOp returns a new operation from a marshalled definition.
@@ -106,7 +107,7 @@ func NewDefinitionOp(def *pb.Definition) (*DefinitionOp, error) {
 		platforms:  platforms,
 		dgst:       dgst,
 		index:      index,
-		inputCache: new(sync.Map),
+		inputCache: new(bkmaps.SyncMap[string, []*DefinitionOp]),
 	}, nil
 }

@@ -186,11 +187,7 @@ func (d *DefinitionOp) Output() Output {
 }

 func (d *DefinitionOp) loadInputCache(dgst digest.Digest) ([]*DefinitionOp, bool) {
-	a, ok := d.inputCache.Load(dgst.String())
-	if ok {
-		return a.([]*DefinitionOp), true
-	}
-	return nil, false
+	return d.inputCache.Load(dgst.String())
 }

 func (d *DefinitionOp) storeInputCache(dgst digest.Digest, c []*DefinitionOp) {
@@ -398,6 +398,8 @@ func Git(url, fragment string, opts ...GitOption) State {
 		AuthTokenSecret:  GitAuthTokenKey,
 	}
 	ref, subdir, ok := strings.Cut(fragment, ":")
+	subdir = path.Join("/", subdir)
+	subdir = strings.TrimPrefix(subdir, "/")
 	if ref != "" {
 		GitRef(ref).SetGitOption(gi)
 	}
@@ -476,6 +478,11 @@ func Git(url, fragment string, opts ...GitOption) State {
 		addCap(&gi.Constraints, pb.CapSourceGitSkipSubmodules)
 	}

+	if gi.MTime != "" {
+		attrs[pb.AttrGitMTime] = gi.MTime
+		addCap(&gi.Constraints, pb.CapSourceGitMTime)
+	}
+
 	addCap(&gi.Constraints, pb.CapSourceGit)

 	source := NewSource("git://"+id, attrs, gi.Constraints)
@@ -503,6 +510,7 @@ type GitInfo struct {
 	Ref              string
 	SubDir           string
 	SkipSubmodules   bool
+	MTime            string
 }

 func GitRef(v string) GitOption {
@@ -523,6 +531,20 @@ func GitSkipSubmodules() GitOption {
 	})
 }

+// GitMTimeCommit sets file modification times to the commit timestamp
+// of the resolved commit, rather than the checkout time.
+func GitMTimeCommit() GitOption {
+	return GitMTime("commit")
+}
+
+// GitMTime sets the file modification time policy for git sources.
+// Valid values are "checkout" (default) and "commit".
+func GitMTime(v string) GitOption {
+	return gitOptionFunc(func(gi *GitInfo) {
+		gi.MTime = v
+	})
+}
+
 func KeepGitDir() GitOption {
 	return gitOptionFunc(func(gi *GitInfo) {
 		gi.KeepGitDir = true
@@ -25,6 +25,7 @@ import (
 	"github.com/moby/buildkit/solver/pb"
 	spb "github.com/moby/buildkit/sourcepolicy/pb"
 	"github.com/moby/buildkit/util/bklog"
+	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/tonistiigi/fsutil"
@@ -525,25 +526,32 @@ func parseCacheOptions(ctx context.Context, isGateway bool, opt SolveOpt) (*cach
 				bklog.G(ctx).Warning("local cache import at " + csDir + " not found due to err: " + err.Error())
 				continue
 			}
+			dgst := im.Attrs["digest"]
 			// if digest is not specified, attempt to load from tag
-			if im.Attrs["digest"] == "" {
+			if dgst == "" {
 				tag := "latest"
 				if t, ok := im.Attrs["tag"]; ok {
 					tag = t
 				}
+				if tag == "" {
+					return nil, errors.New("local cache importer requires either explicit digest, \"latest\" tag or custom tag on index.json")
+				}

 				idx := ociindex.NewStoreIndex(csDir)
 				desc, err := idx.Get(tag)
 				if err != nil {
-					bklog.G(ctx).Warning("local cache import at " + csDir + " not found due to err: " + err.Error())
+					bklog.G(ctx).Warning("local cache import at " + csDir + " skipped due to err: " + err.Error())
 					continue
 				}
-				if desc != nil {
-					im.Attrs["digest"] = desc.Digest.String()
+				if desc == nil {
+					bklog.G(ctx).Warning("local cache import at " + csDir + " skipped: no digest found for tag " + tag)
+					continue
 				}
+				im.Attrs["digest"] = desc.Digest.String()
 			}
-			if im.Attrs["digest"] == "" {
-				return nil, errors.New("local cache importer requires either explicit digest, \"latest\" tag or custom tag on index.json")
+			if _, err := cs.Info(ctx, digest.Digest(im.Attrs["digest"])); err != nil {
+				bklog.G(ctx).Warning("local cache import at " + csDir + " skipped: digest " + im.Attrs["digest"] + " unavailable: " + err.Error())
+				continue
 			}
 			contentStores["local:"+csDir] = cs
 		}
@@ -56,6 +56,9 @@ type GitRef struct {

 	// Submodules is true for URL that controls whether to fetch git submodules.
 	Submodules *bool
+
+	// MTime controls file modification time policy: "checkout" (default) or "commit".
+	MTime string
 }

 // ParseGitRef parses a git ref.
@@ -182,6 +185,13 @@ func (gf *GitRef) loadQuery(query url.Values) error {
 				}
 			}
 			gf.Submodules = &vv
+		case "mtime":
+			switch v[0] {
+			case "checkout", "commit":
+				gf.MTime = v[0]
+			default:
+				return errors.Errorf("invalid mtime value: %q (must be \"checkout\" or \"commit\")", v[0])
+			}
 		default:
 			return errors.Errorf("unexpected query %q", k)
 		}
@@ -5,9 +5,12 @@ import (
 	"encoding/json"
 	"fmt"
 	"slices"
+	"strconv"
+	"time"

 	"github.com/containerd/platforms"
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
+	commonexptypes "github.com/moby/buildkit/exporter/exptypes"
 	"github.com/moby/buildkit/frontend/gateway/client"
 	dockerspec "github.com/moby/docker-image-spec/specs-go/v1"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
@@ -15,7 +18,14 @@ import (
 	"golang.org/x/sync/errgroup"
 )

-type BuildFunc func(ctx context.Context, platform *ocispecs.Platform, idx int) (r client.Reference, img, baseImg *dockerspec.DockerOCIImage, err error)
+type BuildResult struct {
+	Reference client.Reference
+	Image     *dockerspec.DockerOCIImage
+	BaseImage *dockerspec.DockerOCIImage
+	Epoch     *time.Time
+}
+
+type BuildFunc func(ctx context.Context, platform *ocispecs.Platform, idx int) (*BuildResult, error)

 func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, error) {
 	res := client.NewResult()
@@ -35,10 +45,11 @@ func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, erro

 	for i, tp := range targets {
 		eg.Go(func() error {
-			ref, img, baseImg, err := fn(ctx, tp, i)
+			buildRes, err := fn(ctx, tp, i)
 			if err != nil {
 				return err
 			}
+			ref, img, baseImg := buildRes.Reference, buildRes.Image, buildRes.BaseImage

 			config, err := json.Marshal(img)
 			if err != nil {
@@ -66,12 +77,18 @@ func (bc *Client) Build(ctx context.Context, fn BuildFunc) (*ResultBuilder, erro
 				if len(baseConfig) > 0 {
 					res.AddMeta(fmt.Sprintf("%s/%s", exptypes.ExporterImageBaseConfigKey, expPlat.ID), baseConfig)
 				}
+				if buildRes.Epoch != nil {
+					res.AddMeta(fmt.Sprintf("%s/%s", commonexptypes.ExporterEpochKey, expPlat.ID), []byte(strconv.FormatInt(buildRes.Epoch.Unix(), 10)))
+				}
 			} else {
 				res.SetRef(ref)
 				res.AddMeta(exptypes.ExporterImageConfigKey, config)
 				if len(baseConfig) > 0 {
 					res.AddMeta(exptypes.ExporterImageBaseConfigKey, baseConfig)
 				}
+				if buildRes.Epoch != nil {
+					res.AddMeta(commonexptypes.ExporterEpochKey, []byte(strconv.FormatInt(buildRes.Epoch.Unix(), 10)))
+				}
 			}
 			expPlatforms.Platforms[i] = expPlat
 			return nil
@@ -6,6 +6,7 @@ import (
 	"context"
 	"path/filepath"
 	"regexp"
+	"slices"
 	"strconv"

 	"github.com/moby/buildkit/client/llb"
@@ -73,7 +74,11 @@ func (bc *Client) initContext(ctx context.Context) (*buildContext, error) {
 	if v, err := strconv.ParseBool(opts[keyContextKeepGitDirArg]); err == nil {
 		keepGit = &v
 	}
-	if st, ok, err := DetectGitContext(opts[localNameContext], keepGit); ok {
+	var extraGitOpts []llb.GitOption
+	if opts[keySourceDateEpoch] != "" {
+		extraGitOpts = append(extraGitOpts, llb.GitMTimeCommit())
+	}
+	if st, ok, err := DetectGitContext(opts[localNameContext], keepGit, extraGitOpts...); ok {
 		if err != nil {
 			return nil, err
 		}
@@ -143,15 +148,15 @@ func (bc *Client) initContext(ctx context.Context) (*buildContext, error) {
 	return bctx, nil
 }

-func DetectGitContext(ref string, keepGit *bool) (*llb.State, bool, error) {
+func DetectGitContext(ref string, keepGit *bool, opts ...llb.GitOption) (*llb.State, bool, error) {
 	g, isGit, err := dfgitutil.ParseGitRef(ref)
 	if err != nil {
 		return nil, isGit, err
 	}
-	gitOpts := []llb.GitOption{
+	gitOpts := slices.Concat(opts, []llb.GitOption{
 		llb.GitRef(g.Ref),
 		WithInternalName("load git source " + ref),
-	}
+	})
 	if g.KeepGitDir != nil && *g.KeepGitDir {
 		gitOpts = append(gitOpts, llb.KeepGitDir())
 	}
@@ -167,6 +172,9 @@ func DetectGitContext(ref string, keepGit *bool) (*llb.State, bool, error) {
 	if g.Submodules != nil && !*g.Submodules {
 		gitOpts = append(gitOpts, llb.GitSkipSubmodules())
 	}
+	if g.MTime != "" {
+		gitOpts = append(gitOpts, llb.GitMTime(g.MTime))
+	}

 	st := llb.Git(g.Remote, "", gitOpts...)
 	return &st, true, nil
@@ -820,9 +820,8 @@ func (c *grpcClient) Inputs(ctx context.Context) (map[string]llb.State, error) {
 // communication channel between the process and the ExecProcess message
 // stream.
 type procMessageForwarder struct {
-	done      chan struct{}
-	closeOnce sync.Once
-	msgs      chan *pb.ExecMessage
+	done chan struct{}
+	msgs chan *pb.ExecMessage
 }

 func newProcMessageForwarder() *procMessageForwarder {
@@ -836,9 +835,6 @@ func (b *procMessageForwarder) Send(ctx context.Context, m *pb.ExecMessage) {
 	select {
 	case <-ctx.Done():
 	case <-b.done:
-		b.closeOnce.Do(func() {
-			close(b.msgs)
-		})
 	case b.msgs <- m:
 	}
 }
@@ -856,8 +852,6 @@ func (b *procMessageForwarder) Recv(ctx context.Context) (m *pb.ExecMessage, ok

 func (b *procMessageForwarder) Close() {
 	close(b.done)
-	b.Recv(context.Background())      // flush any messages in queue
-	b.Send(context.Background(), nil) // ensure channel is closed
 }

 // messageForwarder manages a single grpc stream for ExecProcess to facilitate
@@ -8,6 +8,7 @@ const AttrKnownSSHHosts = "git.knownsshhosts"
 const AttrMountSSHSock = "git.mountsshsock"
 const AttrGitChecksum = "git.checksum"
 const AttrGitSkipSubmodules = "git.skipsubmodules"
+const AttrGitMTime = "git.mtime"

 const AttrGitSignatureVerifyPubKey = "git.sig.pubkey"
 const AttrGitSignatureVerifyRejectExpired = "git.sig.rejectexpired"
@@ -34,6 +34,7 @@ const (
 	CapSourceGitChecksum        apicaps.CapID = "source.git.checksum"
 	CapSourceGitSkipSubmodules  apicaps.CapID = "source.git.skipsubmodules"
 	CapSourceGitSignatureVerify apicaps.CapID = "source.git.signatureverify"
+	CapSourceGitMTime           apicaps.CapID = "source.git.mtime"

 	CapSourceHTTP         apicaps.CapID = "source.http"
 	CapSourceHTTPAuth     apicaps.CapID = "source.http.auth"
@@ -255,6 +256,12 @@ func init() {
 		Status:  apicaps.CapStatusExperimental,
 	})

+	Caps.Init(apicaps.Cap{
+		ID:      CapSourceGitMTime,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapSourceHTTP,
 		Enabled: true,
@@ -0,0 +1,42 @@
+package bkmaps
+
+import "sync"
+
+// SyncMap provides a typed wrapper around sync.Map.
+type SyncMap[K comparable, V any] struct {
+	m sync.Map
+}
+
+// Delete removes the value for a key.
+func (m *SyncMap[K, V]) Delete(key K) {
+	m.m.Delete(key)
+}
+
+// Load returns the value stored in the map for a key, if any.
+func (m *SyncMap[K, V]) Load(key K) (V, bool) {
+	v, ok := m.m.Load(key)
+	if !ok {
+		var zero V
+		return zero, false
+	}
+	return v.(V), true
+}
+
+// LoadOrStore returns the existing value for the key if present.
+// Otherwise it stores and returns the given value.
+func (m *SyncMap[K, V]) LoadOrStore(key K, value V) (V, bool) {
+	v, loaded := m.m.LoadOrStore(key, value)
+	return v.(V), loaded
+}
+
+// Range calls fn sequentially for each key and value present in the map.
+func (m *SyncMap[K, V]) Range(fn func(K, V) bool) {
+	m.m.Range(func(key, value any) bool {
+		return fn(key.(K), value.(V))
+	})
+}
+
+// Store sets the value for a key.
+func (m *SyncMap[K, V]) Store(key K, value V) {
+	m.m.Store(key, value)
+}
@@ -9,8 +9,10 @@ import (
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/core/images"
 	cerrdefs "github.com/containerd/errdefs"
+	"github.com/moby/buildkit/util/bkmaps"
 	"github.com/moby/buildkit/util/resolver/limited"
 	"github.com/moby/buildkit/util/resolver/retryhandler"
+	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 )
@@ -74,10 +76,10 @@ func (r *rc) Seek(offset int64, whence int) (int64, error) {
 	return r.offset, nil
 }
 func CopyChain(ctx context.Context, ingester content.Ingester, provider content.Provider, desc ocispecs.Descriptor, opts ...CopyOption) error {
-	return copyChain(ctx, ingester, provider, desc, &sync.Map{}, opts...)
+	return copyChain(ctx, ingester, provider, desc, &bkmaps.SyncMap[digest.Digest, struct{}]{}, opts...)
 }

-func copyChain(ctx context.Context, ingester content.Ingester, provider content.Provider, desc ocispecs.Descriptor, visited *sync.Map, opts ...CopyOption) error {
+func copyChain(ctx context.Context, ingester content.Ingester, provider content.Provider, desc ocispecs.Descriptor, visited *bkmaps.SyncMap[digest.Digest, struct{}], opts ...CopyOption) error {
 	ci := &CopyInfo{}
 	for _, o := range opts {
 		if err := o(ci); err != nil {
@@ -2,6 +2,7 @@ package gitutil

 import (
 	"net/url"
+	"path"
 	"regexp"
 	"strings"

@@ -72,6 +73,8 @@ func parseOpts(fragment string) *GitURLOpts {
 		return nil
 	}
 	ref, subdir, _ := strings.Cut(fragment, ":")
+	subdir = path.Join("/", subdir)
+	subdir = strings.TrimPrefix(subdir, "/")
 	return &GitURLOpts{Ref: ref, Subdir: subdir}
 }

@@ -20,7 +20,9 @@ import (
 	"time"

 	"github.com/containerd/containerd/v2/core/content"
+	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/containerd/v2/core/remotes/docker"
+	"github.com/containerd/platforms"
 	"github.com/docker/cli/cli/config"
 	"github.com/gofrs/flock"
 	"github.com/moby/buildkit/util/appcontext"
@@ -314,6 +316,11 @@ func copyImagesLocal(t *testing.T, host string, images map[string]string) error
 			}
 		}

+		desc, err = resolveDefaultPlatform(context.TODO(), provider, desc)
+		if err != nil {
+			return err
+		}
+
 		ingester, err := contentutil.IngesterFromRef(host + "/" + to)
 		if err != nil {
 			return err
@@ -326,6 +333,26 @@ func copyImagesLocal(t *testing.T, host string, images map[string]string) error
 	return nil
 }

+// resolveDefaultPlatform resolves a multi-platform index descriptor to a
+// single-platform manifest descriptor matching the current platform.
+// If the descriptor is not an index, it is returned as-is.
+func resolveDefaultPlatform(ctx context.Context, provider content.Provider, desc ocispecs.Descriptor) (ocispecs.Descriptor, error) {
+	if !images.IsIndexType(desc.MediaType) {
+		return desc, nil
+	}
+	children, err := images.Children(ctx, provider, desc)
+	if err != nil {
+		return ocispecs.Descriptor{}, err
+	}
+	matcher := platforms.Default()
+	for _, c := range children {
+		if c.Platform != nil && matcher.Match(*c.Platform) {
+			return c, nil
+		}
+	}
+	return ocispecs.Descriptor{}, errors.Errorf("no manifest matching platform %s in index %s", platforms.Format(platforms.DefaultSpec()), desc.Digest)
+}
+
 func OfficialImages(names ...string) map[string]string {
 	return officialImages(names...)
 }
@@ -10,9 +10,9 @@ import (
 	"sync"

 	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/sdk"
 	"go.opentelemetry.io/otel/sdk/resource"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
 )

 var (
@@ -22,6 +22,35 @@ var (
 	detectedResourceOnce sync.Once
 )

+// schemaURL is the OpenTelemetry semantic conventions schema URL. See [OTel Schema].
+//
+// [OTel Schema]: https://opentelemetry.io/docs/specs/otel/schemas/
+const schemaURL = "https://opentelemetry.io/schemas/1.37.0"
+
+// serviceNameKey is the OpenTelemetry semantic convention key for the
+// service name. See [service.name].
+//
+// [service.name]: https://opentelemetry.io/docs/specs/semconv/registry/attributes/service/#service-name
+const serviceNameKey = "service.name"
+
+// telemetrySDKNameKey is the OpenTelemetry semantic convention key for
+// the telemetry SDK name. See [telemetry.sdk.name].
+//
+// [telemetry.sdk.name]: https://opentelemetry.io/docs/specs/semconv/registry/attributes/telemetry/#telemetry-sdk-name
+const telemetrySDKNameKey = "telemetry.sdk.name"
+
+// telemetrySDKLanguageKey is the OpenTelemetry semantic convention key for
+// the telemetry SDK language. See [telemetry.sdk.language].
+//
+// [telemetry.sdk.language]: https://opentelemetry.io/docs/specs/semconv/registry/attributes/telemetry/#telemetry-sdk-language
+const telemetrySDKLanguageKey = "telemetry.sdk.language"
+
+// telemetrySDKVersionKey is the OpenTelemetry semantic convention key for
+// the telemetry SDK version. See [telemetry.sdk.version].
+//
+// [telemetry.sdk.version]: https://opentelemetry.io/docs/specs/semconv/registry/attributes/telemetry/#telemetry-sdk-version
+const telemetrySDKVersionKey = "telemetry.sdk.version"
+
 func Resource() *resource.Resource {
 	detectedResourceOnce.Do(func() {
 		res, err := resource.New(context.Background(),
@@ -58,8 +87,8 @@ var (

 func (serviceNameDetector) Detect(ctx context.Context) (*resource.Resource, error) {
 	return resource.StringDetector(
-		semconv.SchemaURL,
-		semconv.ServiceNameKey,
+		schemaURL,
+		serviceNameKey,
 		func() (string, error) {
 			if ServiceName != "" {
 				return ServiceName, nil
@@ -69,12 +98,12 @@ func (serviceNameDetector) Detect(ctx context.Context) (*resource.Resource, erro
 	).Detect(ctx)
 }

-// Detect returns a *Resource that describes the OpenTelemetry SDK used.
+// Detect returns a [*resource.Resource] that describes the OpenTelemetry SDK used.
 func (telemetrySDK) Detect(context.Context) (*resource.Resource, error) {
 	return resource.NewWithAttributes(
-		semconv.SchemaURL,
-		semconv.TelemetrySDKName("opentelemetry"),
-		semconv.TelemetrySDKLanguageGo,
-		semconv.TelemetrySDKVersion(sdk.Version()),
+		schemaURL,
+		attribute.String(telemetrySDKNameKey, "opentelemetry"),
+		attribute.String(telemetrySDKLanguageKey, "go"),
+		attribute.String(telemetrySDKVersionKey, sdk.Version()),
 	), nil
 }
@@ -11,9 +11,9 @@ import (
 	"github.com/pkg/errors"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/propagation"
-	semconv "go.opentelemetry.io/otel/semconv/v1.37.0"
 	"go.opentelemetry.io/otel/trace"
 	"go.opentelemetry.io/otel/trace/noop"
 )
@@ -37,12 +37,18 @@ func hasStacktrace(err error) bool {
 	return errors.As(err, &stack) || errors.As(err, &pkgStack)
 }

+// exceptionStacktraceKey is the OTEL semantic convention key for an exception
+// stacktrace. See [exception.stacktrace],
+//
+// [exception.stacktrace]: https://opentelemetry.io/docs/specs/semconv/registry/attributes/exception/#exception-stacktrace
+const exceptionStacktraceKey = "exception.stacktrace"
+
 // FinishWithError finalizes the span and sets the error if one is passed
 func FinishWithError(span trace.Span, err error) {
 	if err != nil {
 		span.RecordError(err)
 		if hasStacktrace(err) {
-			span.SetAttributes(semconv.ExceptionStacktrace(fmt.Sprintf("%+v", stack.Formatter(err))))
+			span.SetAttributes(attribute.String(exceptionStacktraceKey, fmt.Sprintf("%+v", stack.Formatter(err))))
 		}
 		span.SetStatus(codes.Error, err.Error())
 	}
@@ -331,14 +331,20 @@ func (p *Pattern) match(path string) (bool, error) {
 		// **/foo matches "foo"
 		return suffix[0] == os.PathSeparator && path == suffix[1:], nil
 	case regexpMatch:
+		if p.regexp == nil {
+			return false, filepath.ErrBadPattern
+		}
 		return p.regexp.MatchString(path), nil
+	case unknownMatch:
+		return false, filepath.ErrBadPattern
+	default:
+		return false, nil
 	}
-
-	return false, nil
 }

 func (p *Pattern) compile(sl string) error {
 	regStr := "^"
+	detectedType := exactMatch // assume exact match
 	pattern := p.cleanedPattern
 	// Go through the pattern and convert it to a regexp.
 	// We use a scanner so we can support utf-8 chars.
@@ -350,7 +356,6 @@ func (p *Pattern) compile(sl string) error {
 		escSL += `\`
 	}

-	p.matchType = exactMatch
 	for i := 0; scan.Peek() != scanner.EOF; i++ {
 		ch := scan.Next()

@@ -366,32 +371,32 @@ func (p *Pattern) compile(sl string) error {

 				if scan.Peek() == scanner.EOF {
 					// is "**EOF" - to align with .gitignore just accept all
-					if p.matchType == exactMatch {
-						p.matchType = prefixMatch
+					if detectedType == exactMatch {
+						detectedType = prefixMatch
 					} else {
 						regStr += ".*"
-						p.matchType = regexpMatch
+						detectedType = regexpMatch
 					}
 				} else {
 					// is "**"
 					// Note that this allows for any # of /'s (even 0) because
 					// the .* will eat everything, even /'s
 					regStr += "(.*" + escSL + ")?"
-					p.matchType = regexpMatch
+					detectedType = regexpMatch
 				}

 				if i == 0 {
-					p.matchType = suffixMatch
+					detectedType = suffixMatch
 				}
 			} else {
 				// is "*" so map it to anything but "/"
 				regStr += "[^" + escSL + "]*"
-				p.matchType = regexpMatch
+				detectedType = regexpMatch
 			}
 		} else if ch == '?' {
 			// "?" is any char except "/"
 			regStr += "[^" + escSL + "]"
-			p.matchType = regexpMatch
+			detectedType = regexpMatch
 		} else if shouldEscape(ch) {
 			// Escape some regexp special chars that have no meaning
 			// in golang's filepath.Match
@@ -408,31 +413,29 @@ func (p *Pattern) compile(sl string) error {
 			}
 			if scan.Peek() != scanner.EOF {
 				regStr += `\` + string(scan.Next())
-				p.matchType = regexpMatch
+				detectedType = regexpMatch
 			} else {
 				regStr += `\`
 			}
 		} else if ch == '[' || ch == ']' {
 			regStr += string(ch)
-			p.matchType = regexpMatch
+			detectedType = regexpMatch
 		} else {
 			regStr += string(ch)
 		}
 	}

-	if p.matchType != regexpMatch {
-		return nil
+	if detectedType == regexpMatch {
+		regStr += "$"
+
+		re, err := regexp.Compile(regStr)
+		if err != nil {
+			return err
+		}
+
+		p.regexp = re
 	}
-
-	regStr += "$"
-
-	re, err := regexp.Compile(regStr)
-	if err != nil {
-		return err
-	}
-
-	p.regexp = re
-	p.matchType = regexpMatch
+	p.matchType = detectedType
 	return nil
 }

@@ -2,14 +2,14 @@ variable "ROOT_SIGNING_VERSION" {
    type    = string
    # default = "8842feefbb65effea46ff4a0f2b6aad91e685fe9" # expired root
    # default = "9d8b5c5e3bed603c80b57fcc316b7a1af688c57e" # expired timestamp
-    default = "a72700d5c80d43a209d31325fee46facc6f0cf31"
+    default = "975f28e3597a34098a7c0c07edc16f47420b9aa3"
    description = "The git commit hash of sigstore/root-signing to use for embedded roots."
 }

 variable "DOCKER_HARDENED_IMAGES_KEYRING_VERSION" {
    type    = string
    default = "04ae44966821da8e5cdcb4c51137dee69297161a"
-    description = "The git branch or commit hash of docker/hardened-images-keyring to use for DHI verification."
+    description = "The git branch or commit hash of docker-hardened-images/keyring to use for DHI verification."
 }

 target "_common" {
@@ -2,18 +2,18 @@
 "signatures": [
  {
   "keyid": "0c87432c3bf09fd99189fdc32fa5eaedf4e4a5fac7bab73fa04a2e0fc64af6f5",
-   "sig": "3046022100d7ef32458ba07441f1d840bae2d7cf5740ec01462499439e02f8ad9b5c53777f0221009c56763e60f8311a45c148f4276163c9f2b241ce0da65202f92f5de4ce2e4445"
+   "sig": "3046022100a6e78ac794442ab5af6268bc68e66a6fbfc04944ae7feb184a35d28a3ed0a9d40221008f1201dc0924583d74321379a2a0ce709f7401ed69b1bd39ee8c0b8919a782b6"
  }
 ],
 "signed": {
  "_type": "timestamp",
-  "expires": "2026-02-12T13:42:54Z",
+  "expires": "2026-03-31T13:49:52Z",
  "meta": {
   "snapshot.json": {
    "version": 163
   }
  },
  "spec_version": "1.0",
-  "version": 587
+  "version": 628
 }
 }