Allow passing policy content through stdin by specifying
"--file -" in the eval command. This enables piping policy
data without requiring a file on disk.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow buildx policy eval to accept an explicit target platform and skip
worker platform discovery when the flag is provided.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Reuse a single ingester per target repository when imagetools create
copies multiple manifests in parallel.
This lets the pushing ingester serialize same-digest pushes and avoids
racing duplicate blob uploads against registries to work around bug in
Registry v3.0.0 (and possibly others).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
FetchReferrers accepted FetchReferrersOpt but dropped them
when resolving OCI layout referrers. Forward the options and
apply ArtifactTypes filtering so callers can narrow results
consistently for both registry and local layout sources.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When pushing to an OCI layout where the top-level descriptor
blob already existed, pushOCILayout returned early without
updating index.json or writing pending referrers. Restructure
the control flow so the blob-exists case skips only the write
but still updates the index and flushes referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Handle OCI layout referrers via subject-annotated index entries and add
integration coverage for copying signed attestations through oci-layout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify imagetools copies signatures only for attestation manifests and
does not copy image-manifest signatures or unsupported referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --file and verify a
descriptor read from disk resolves to the expected copied manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --append and verify the
target is rewritten as a two-platform manifest list.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --platform on an attested
multi-platform image and verify only the matching attestation remains.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify copied index content keeps the same digest and descriptor metadata.
Add function comments to clarify each imagetools integration test case.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use sync.OnceValue to initialize the kubeclient scheme, codec factory,
and parameter codec as a single lazy-loaded bundle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace the full generated clientset and global Kubernetes scheme
with a small local REST client layer and minimal scheme registration.
This keeps the existing kubeconfig/auth and remote exec behavior while
significantly reducing the linked and vendored Kubernetes dependency set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use an errgroup helper to evaluate result refs concurrently during forced
evaluation, and fail fast on the first evaluation error.
This mitigates current case in bake where chained targets with
a multi-platform build could miss secrets and other session properties.
The outline for the issue case:
- Base target is solved but only lazily and not really loaded/tracked
in build graph yet.
- Child targets are loaded, base target waits.
- Evaluate is called for base stage (because it might be missing result
condition), child stage is processed as build result. This happens in
parallel.
- Because `Evaluate()` was called synchronously, it may have not been
called yet for the second platform while the child target already
needs to run `RUN --mount=type=secret`.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix using CopyDirContentsOnly when projecting remote named contexts so
subdir contexts keep the same root semantics as local bake runs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use cleaned DockerfilePath basename for policy env filename and fall back
to Dockerfile when the path resolves to dot or root.
Previously filename could be reported as "." on default cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow child refs from partial evaluation to match allowed parent keys on
path boundaries and return canonical unknowns for metadata resolution.
Add tests for parent-child matching and boundary safety cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track fields reloaded during eval --print resolution loops and filter
final invalid-field warnings against that set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Prevent concurrent ResolveSourceMetadata calls from hanging while
waiting for resolver initialization.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.
Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.
This improves the progress output of policy error and shows last
policy logs with the build error.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Turn the current utility used by policy helper commands that
allows getting gateway.Client lazily into reusable package.
This is preparation for using this utility also in the policy
verification, outside of commands.
Only expose SourceMetaResolver as other methods of gateway client
are not needed atm by any callers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Seems marshalling the typed struct causes empty fields
e.g. gcpolicy = [] that (old versions of?) BuildKit do no allow.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Make the code more unified between validation and
test command. Normalize to key without the input prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Currently needed manifests were filtered out and then
copied in a loop, but for each copy still the full
unfiltered descriptor was copied instead of single
manifest, resulting multiple push attempts for same
descriptor.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Enables fallback for DHI and Scout registries and
repo/scope specific credentials like supported for builds.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.
Requires updated frontend to handle these new keys.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi