alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity
3,903 Commits 1 Branch 1 Tag
9ef416b25854e8f80e78e15827927ea21a54fb1b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tonis Tiigi 9ef416b258 build: ref-count policy FS lifecycle 
Make memoized policy FS ref-counted so repeated get()/close() pairs don't
prematurely close shared handles.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-26 18:48:38 -08:00
Tõnis TiigiandGitHub f35e45c307 Merge pull request #3667 from tonistiigi/20260224-update-buildkit 
vendor: update buildkit to v0.28.0-rc1
 2026-02-24 14:36:03 -08:00
Tonis Tiigi dd2a620465 vendor: update buildkit to v0.28.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-24 14:19:34 -08:00
Tõnis TiigiandGitHub 2809ca78d7 Merge pull request #3661 from tonistiigi/policy-remote-fs 
build: resolve policy files for builds from remote context
 2026-02-24 09:21:24 -08:00
Tõnis TiigiandGitHub 9607bbab9a Merge pull request #3451 from AkhilManoj03/3121-improve-file-flag-docs 
Docs: document remote URL support for --file flag in buildx build
 2026-02-24 07:52:20 -08:00
Tonis Tiigi b62fc30524 build: resolve policy files from context state and unified FS 
Support remote context policy files via resolved context state and cwd:// override.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-23 16:22:19 -08:00
Tõnis TiigiandGitHub 5830f90beb Merge pull request #3657 from tonistiigi/policy-artifact-verification 
policy: add artifact attestation and github attestation builtin support
 2026-02-23 09:15:43 -08:00
Tõnis TiigiandGitHub 268f1c7e4a Merge pull request #3450 from jsternberg/dap-container-fs-requests 
dap: utilize the container filesystem for the file explorer
 2026-02-22 21:50:28 -08:00
Tõnis TiigiandGitHub 5683e9f04f Merge pull request #3470 from yzewei/tests_fix 
tests: replace aaa/bbb node names with descriptive builder names
 2026-02-22 21:49:34 -08:00
Tõnis TiigiandGitHub 6476f0e7c3 Merge pull request #3660 from crazy-max/ci-bump-runner 
ci: update macos and windows runners to latest
 2026-02-20 10:29:40 -08:00
Tonis Tiigi 10c5f00efa sourcemeta: unblock concurrent resolver open waiters 
Prevent concurrent ResolveSourceMetadata calls from hanging while
waiting for resolver initialization.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:41 -08:00
Tonis Tiigi 5c3551beeb policy: add GitHub attestation verification 
Add github_attestation and github_release_attestation policy support.
Fetch GitHub attestation bundles (including bundle_url .json.sn decode)
and verify against input.http.checksum.

Wire source metadata resolver progress through resolver options and add
ResolveState support for policy HTTP attestation fetches.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:40 -08:00
Tonis Tiigi ac9e4c512c policy: add artifact attestation builtin support 
Add artifact_attestation(http, filename) and wire verifier support for
artifact bundle checks. Add docker_github_builder_bundle helper rule.

Handle runtime unknown http.checksum after eval so metadata resolve is
requested when checksum is missing.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-20 08:56:39 -08:00
Tõnis TiigiandGitHub 7d3b6988c2 Merge pull request #3656 from tonistiigi/policy-error 
policy: mark policy progress vertex on DENY build failures
 2026-02-20 08:56:28 -08:00
Tonis Tiigi 9f59d5b789 policy: add progress vertex error integration test 
Refactor policy error unit tests to table-driven subtests with slug names.
Add rawjson integration coverage to verify policy vertex captures DENY build
errors in progress output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-19 18:13:58 -08:00
Tonis Tiigi 048ebea483 policy: mark policy progress vertex on DENY build failures 
Track denied source identifiers during policy evaluation and flag the policy
progress vertex as failed when BuildKit returns a matching DENY error pattern.

This improves the progress output of policy error and shows last
policy logs with the build error.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-18 17:19:54 -08:00
Tonis Tiigi 499261eed5 build: avoid empty line when -q used with --call 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-13 17:11:35 -08:00
Tonis Tiigi dce5289722 policy: separate sourcemetaresolver utility to reusable pkg 
Turn the current utility used by policy helper commands that
allows getting gateway.Client lazily into reusable package.

This is preparation for using this utility also in the policy
verification, outside of commands.

Only expose SourceMetaResolver as other methods of gateway client
are not needed atm by any callers.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-13 13:59:33 -08:00
Tõnis TiigiandGitHub 044e152008 Merge pull request #3652 from tonistiigi/policy-provenance-0 
policy: add image.provenance input type
 2026-02-13 11:09:01 -08:00
Tonis Tiigi 8d605dcd87 policy: add image.provenance input type 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-12 11:59:06 -08:00
Tonis Tiigi a5b712b275 confutil: fix toml rewriting in new package 
Seems marshalling the typed struct causes empty fields
e.g. gcpolicy = [] that (old versions of?) BuildKit do no allow.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-11 21:47:11 -08:00
Tõnis TiigiandGitHub bcb8583078 Merge pull request #3638 from crazy-max/imagetools-create-digest 
imagetools: metadata-file flag
 2026-02-11 10:59:38 -08:00
Tõnis TiigiandGitHub 7940a9650d Merge pull request #3646 from crazy-max/urlutil 
history: don't import build package
 2026-02-11 10:59:05 -08:00
Tonis Tiigi 9d803b0d87 vendor: update buildkit to v0.28-dev-9836771d0c5b 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-10 11:59:30 -08:00
Tõnis TiigiandGitHub cd841238b8 Merge pull request #3647 from tonistiigi/policy-test-updates 
policy: update unit tests and normalize input keys
 2026-02-10 11:53:31 -08:00
Tonis Tiigi edd2461190 policy: add unit tests for AddUknowns 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:35 -08:00
Tonis Tiigi 4e16277937 policy: update unknown keys normalization 
Make the code more unified between validation and
test command. Normalize to key without the input prefix.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:35 -08:00
Tonis Tiigi df542b3f80 policy: add testcases for !hasProvenance and sha256 git 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:34 -08:00
Tonis Tiigi 6d2e4952b5 policy: add mock signature unit test 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 18:27:29 -08:00
Tonis Tiigi 22b3d36de3 policy: add unit tests for SourceToInput 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-02-09 16:30:25 -08:00
Tõnis TiigiandGitHub ab035971dc Merge pull request #3618 from tonistiigi/buildx-context-reuse 
build: send individual shared keys for local build contexts
 2026-02-09 15:40:10 -08:00
Tõnis TiigiandGitHub 06f438a4c8 Merge pull request #3631 from jsternberg/dap-better-source-names 
dap: improve file explorer source names
 2026-02-04 12:06:34 -08:00
Tõnis TiigiandGitHub 32e47355af Merge pull request #3627 from tonistiigi/imagetools-auth 
imagetools: use dockerconfig for auth
 2026-02-03 13:14:33 -05:00
Tõnis TiigiandGitHub d88bf660ce Merge pull request #3633 from jsternberg/debugger-build-metrics 
commands: adds metrics associated with the debugger
 2026-01-28 13:14:47 -08:00
Tõnis TiigiandGitHub 694bd9ad16 Merge pull request #3623 from tonistiigi/imagetools-request-fixes 
imagetools: avoid excessive HTTP requests on create
 2026-01-28 09:13:03 -08:00
Tonis Tiigi 87c77aca7b imagetools: avoid trying to load attestations inline references 
When creating resulting image index it is wasteful
to check for attestations for the descriptors in original
index what were already attestation for subject manifest.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-28 08:28:29 -08:00
Tonis Tiigi 510369170a imagetools: fix excessive copies on create command 
Currently needed manifests were filtered out and then
copied in a loop, but for each copy still the full
unfiltered descriptor was copied instead of single
manifest, resulting multiple push attempts for same
descriptor.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-28 08:27:17 -08:00
Tonis Tiigi 27dde04ab5 imagetools: use dockerconfig for auth 
Enables fallback for DHI and Scout registries and
repo/scope specific credentials like supported for builds.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-26 10:15:14 -08:00
Tonis Tiigi e254cf1985 auth: create new authorizer for imagetools 
Based on containerd Authorizer.

Removed unused RefreshToken, fixed error handling.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-26 10:14:21 -08:00
Tonis Tiigi 8f71a4805e imagetools: remove temp workaround for fixed containerd bug 
The issue has been fixed in containerd/containerd#12508

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-23 09:50:20 -08:00
Tonis Tiigi df56af4e0c Dockerfile: update buildkit to v0.27.0 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-21 17:05:40 -08:00
Tõnis TiigiandGitHub 44945d71ff Merge pull request #3621 from tonistiigi/vendor-buildkit-v0.27 
vendor: update buildkit to v0.27.0
 2026-01-21 14:48:45 -08:00
Tonis Tiigi 08e5e8ebf2 vendor: update buildkit to v0.27.0 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-21 14:32:32 -08:00
Tonis Tiigi c01e50342b build: send individual shared keys for local build contexts 
Allows avoiding the case where two separate builds using
same context name would use the same destination directory
for upload.

Requires updated frontend to handle these new keys.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-20 19:08:05 -08:00
Tõnis TiigiandGitHub 79763c61b3 Merge pull request #3616 from thaJeztah/bump_cli 
vendor: github.com/docker/cli v29.1.5
 2026-01-20 10:22:06 -08:00
Tõnis TiigiandGitHub 9c33ef3ed3 Merge pull request #3612 from tonistiigi/dhi-auth 
dockerconfig: add fallback for loading DHI and Scout credentials
 2026-01-16 14:27:54 -08:00
Tõnis TiigiandGitHub 9567f7f4d2 Merge pull request #3614 from tonistiigi/policy-json-stub 
commands: remove policy json-schema stub
 2026-01-16 14:27:33 -08:00
Tõnis TiigiandGitHub 3dabbc568b Merge pull request #3615 from tonistiigi/vendor-buildkit-v0.27.0-rc2 
vendor: update buildkit to v0.27.0-rc2
 2026-01-16 14:13:10 -08:00
Tonis Tiigi 3fd58dff71 vendor: update buildkit to v0.27.0-rc2 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 13:56:16 -08:00
Tõnis TiigiandGitHub 819ae5d3e1 Merge pull request #3611 from tonistiigi/policy-update-v0.31-rc2 
Updates and fixes to policy support
 2026-01-16 12:52:06 -08:00
Tonis Tiigi d0e4db27e0 commands: remove policy json-schema stub 
Remove stub for now so we don't ship it in a release.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 12:48:46 -08:00
Tonis Tiigi f764c6f025 dockerconfig: add fallback for loading DHI and Scout credentials 
These are also Docker managed registries with same users.

Fall back to main hostname if not logged in to exact domain.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 12:45:05 -08:00
Tonis Tiigi 89fdef17e6 policy: fixes for image source handling 
- Make sure tag is added to image reference as
containerd reference parser refuses to parse otherwise.

- When attestation is asked from non-index, return
nil instead of error. This is for consistency as likely
to fail in BuildKit before that is fixed separately.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 12:12:41 -08:00
Tonis Tiigi 535da79d62 policy: build policy deny messages with error 
Supported from Buildkit v0.27.0-rc1

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:56 -08:00
Tonis Tiigi db9c0c2532 policy: update unknown collection 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:56 -08:00
Tonis Tiigi 86885cd8a2 policy: add docker_github_builder_tag builtin helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 1d19f3e2dd policy: add docker_github_builder builtin helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 30260ec935 policy: improve policy logging 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 73f5b1f9c7 policy: update policy progress logic 
Fix the policy logger being open for the whole build.

In new logic logger is opened on-demand if there are logs,
remains open until timeout and is restarted if new logs
come after.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi 20405112c2 policy: allow image source without set platform 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:55 -08:00
Tonis Tiigi eaee6675fb policy: fix exposing signature kind and type 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-16 11:48:53 -08:00
Tõnis TiigiandGitHub bc5d652738 Merge pull request #3610 from tonistiigi/bake-var-flag 
bake: add --var flag for setting variable values
 2026-01-16 08:25:12 -08:00
Tõnis TiigiandGitHub 4682edf8bd Merge pull request #3609 from tonistiigi/dockerfile-worktree-fix 
Dockerfile: allow dev builds from git worktree
 2026-01-16 08:24:38 -08:00
Tonis Tiigi c5322ca727 bake: add --var flag for setting variable values 
This provides alternative way to set values for Bake
variables without adding them the global environment variables.
This can also be used then environment variable access
is disabled with BUILDX_BAKE_DISABLE_VARS_ENV_LOOKUP.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-15 23:17:28 -08:00
Tonis Tiigi 88359c58a0 tests: add TestBakeDisableEnvLookup 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-15 22:46:30 -08:00
Tonis Tiigi 38750e5958 Dockerfile: allow dev builds from git worktree 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit f24db9495537a9658b0defba34c10acd2ad61118)
 2026-01-15 17:24:44 -08:00
Tõnis TiigiandGitHub 8b1f6fd8c0 Merge pull request #3600 from crazy-max/ci-sigstore-darwin 
ci: don't upload signature bundle for darwin
 2026-01-15 16:49:25 -08:00
Tõnis TiigiandGitHub b9b24359ba Merge pull request #3595 from tonistiigi/bake-var-disable 
bake: allow disabling env lookup for bake
 2026-01-14 14:54:17 -08:00
Tonis Tiigi d27c7f8e9f bake: allow disabling env lookup for bake 
Allow bake to be run in a mode where the local environment
variable values can't be captured by bake definition.

In future we will likely also add --var k=v for alternative
way to pass values to variables.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 14:18:26 -08:00
Tõnis TiigiandGitHub efaf9daa21 Merge pull request #3594 from tonistiigi/vendor-buildkit-v0.27.0-rc1 
vendor: update buildkit to v0.27.0-rc1
 2026-01-14 13:58:10 -08:00
Tonis Tiigi d54f398c5d vendor: update buildkit to v0.27.0-rc1 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 13:36:15 -08:00
Tonis Tiigi c6ecdc08cf commands: implement policy test command 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 10:31:12 -08:00
Tõnis TiigiandGitHub 32b6b75478 Merge pull request #3593 from tonistiigi/opa-bake-tests 
policy: add policy to bake and improve test coverage
 2026-01-14 10:07:08 -08:00
Tonis Tiigi 9f1daffb32 policy: implement policy support for bake 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:34:23 -08:00
Tonis Tiigi 6f9a1cfb17 tests: add git based policy tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:34:15 -08:00
Tonis Tiigi 6d80e701f6 tests: add tests checking combinations of --policy flag 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:34:09 -08:00
Tonis Tiigi 071ce556a5 tests: add http based policy eval tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:34:01 -08:00
Tonis Tiigi 4b4f2aa682 tests: add http policy integration tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:33:49 -08:00
Tõnis TiigiandGitHub 5a5d59f503 Merge pull request #3539 from tonistiigi/opa-source-policy 
add rego integration to source policies
 2026-01-14 09:32:39 -08:00
Tonis Tiigi e5116c1555 tests: update policy tests matrix to require modern buildkit 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:35 -08:00
Tonis Tiigi 30b63522d1 tests: add policy eval integration tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:35 -08:00
Tonis Tiigi 02719d045c tests: add image and env based policy build tests 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:35 -08:00
Tonis Tiigi ae86c584b4 tests: add policy flag integration test 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:35 -08:00
Tonis Tiigi be42b48462 policy: implement policy logging via progress printer 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:34 -08:00
Tonis Tiigi 5ad09ce3eb commands: implement policy eval command 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:10:33 -08:00
Tonis Tiigi d232d4c392 commands: add stubs for policy commands 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:09:10 -08:00
Tonis Tiigi 61843e0031 policy: add strict policy config support 
Strict policy will fail if remote daemon doesn't support policy
verification.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:09:10 -08:00
Tonis Tiigi 0e1036bef5 policy: add multiple policy support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:09:10 -08:00
Tonis Tiigi 4af8cdb6af build: add --policy flag for controlling policy configuration 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:09:08 -08:00
Tonis Tiigi d0e9e8cab5 policy: add pin_image helper 
This helper can be used to pin images to specific digest to opt-out
out upgrades or replay old builds.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi df5d9eb8c2 policy: update verify_git_signature to take git object as parameter 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 8906b254d3 policy: move custom functions to separate file 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 87d4189039 policy: image signature verification support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi b2697ae933 policy: add git signature verification support 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 1b7a5f2fa9 policy: add custom builtin load_json 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 70da643c58 policy: add helper modules loading 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 7247c1e38e policy: print debug helper 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:42 -08:00
Tonis Tiigi 547f1ab36b policy: add custom builtins list and remove v0 compat 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:41 -08:00
Tonis Tiigi adb9386282 policy: remove http perm/uid/gid 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:41 -08:00
Tonis Tiigi 93341aaeee add rego integration to source policies 
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
 2026-01-14 09:03:40 -08:00