Prevent concurrent ResolveSourceMetadata calls from hanging while
waiting for resolver initialization.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.
Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Turn the current utility used by policy helper commands that
allows getting gateway.Client lazily into reusable package.
This is preparation for using this utility also in the policy
verification, outside of commands.
Only expose SourceMetaResolver as other methods of gateway client
are not needed atm by any callers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Seems marshalling the typed struct causes empty fields
e.g. gcpolicy = [] that (old versions of?) BuildKit do no allow.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Make the code more unified between validation and
test command. Normalize to key without the input prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add metrics associated with the debugger that are reported through the
metrics writer. This adds a few attributes that are only added when a
debugger is used with either the `debug` command or `dap` command.
At the moment, these metrics show up the exact same as a build and we
can't identify if something is using `dap` or `debug` since they use the
same code path.
This also adds a new available metric that can be utilized by plugins to
report additional information. The metrics will check if an environment
variable `BUILDX_DAP_USER_AGENT` is sent and that will get included in
the metrics if they are enabled.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Currently needed manifests were filtered out and then
copied in a loop, but for each copy still the full
unfiltered descriptor was copied instead of single
manifest, resulting multiple push attempts for same
descriptor.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Improves the naming for file explorer names when the input relates
directly to a source. This is most common when the input is the context
(which is just usually a simple source like `local://context`).
This should help in most circumstances in determining which input is
which.
Signed-off-by: Jonathan A. Sternberg <jonathan.sternberg@docker.com>
Tonis Tiigi