Emit a final policy progress completion with the solve error even when the
inactivity window already completed the vertex.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Extends the builtin default policy to verify docker-github-builder
signatures on docker/buildkit-syft-scanner images. Tags `latest` and
1.10+ require a signature from the docker/buildkit-syft-scanner source
repository; older tags pass through unchanged. Factors the shared ref
matching logic into sig_ref_matches for dockerfile and introduces a
syft-scanner variant that uses the plain refs/tags/ prefix.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.
Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.
In a future release these should become opt-out.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Ensure the negative checksum case always mutates the digest instead of
sometimes reproducing the original value when it already starts with 0.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow passing policy content through stdin by specifying
"--file -" in the eval command. This enables piping policy
data without requiring a file on disk.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow buildx policy eval to accept an explicit target platform and skip
worker platform discovery when the flag is provided.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Reuse a single ingester per target repository when imagetools create
copies multiple manifests in parallel.
This lets the pushing ingester serialize same-digest pushes and avoids
racing duplicate blob uploads against registries to work around bug in
Registry v3.0.0 (and possibly others).
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
FetchReferrers accepted FetchReferrersOpt but dropped them
when resolving OCI layout referrers. Forward the options and
apply ArtifactTypes filtering so callers can narrow results
consistently for both registry and local layout sources.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
When pushing to an OCI layout where the top-level descriptor
blob already existed, pushOCILayout returned early without
updating index.json or writing pending referrers. Restructure
the control flow so the blob-exists case skips only the write
but still updates the index and flushes referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Handle OCI layout referrers via subject-annotated index entries and add
integration coverage for copying signed attestations through oci-layout.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add oci-layout:// source and target support to imagetools create and
inspect while keeping merge, filter, and referrer logic shared.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify imagetools copies signatures only for attestation manifests and
does not copy image-manifest signatures or unsupported referrers.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --file and verify a
descriptor read from disk resolves to the expected copied manifest.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --append and verify the
target is rewritten as a two-platform manifest list.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add integration coverage for imagetools create --platform on an attested
multi-platform image and verify only the matching attestation remains.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Verify copied index content keeps the same digest and descriptor metadata.
Add function comments to clarify each imagetools integration test case.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use sync.OnceValue to initialize the kubeclient scheme, codec factory,
and parameter codec as a single lazy-loaded bundle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Replace the full generated clientset and global Kubernetes scheme
with a small local REST client layer and minimal scheme registration.
This keeps the existing kubeconfig/auth and remote exec behavior while
significantly reducing the linked and vendored Kubernetes dependency set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use an errgroup helper to evaluate result refs concurrently during forced
evaluation, and fail fast on the first evaluation error.
This mitigates current case in bake where chained targets with
a multi-platform build could miss secrets and other session properties.
The outline for the issue case:
- Base target is solved but only lazily and not really loaded/tracked
in build graph yet.
- Child targets are loaded, base target waits.
- Evaluate is called for base stage (because it might be missing result
condition), child stage is processed as build result. This happens in
parallel.
- Because `Evaluate()` was called synchronously, it may have not been
called yet for the second platform while the child target already
needs to run `RUN --mount=type=secret`.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Fix using CopyDirContentsOnly when projecting remote named contexts so
subdir contexts keep the same root semantics as local bake runs.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Use cleaned DockerfilePath basename for policy env filename and fall back
to Dockerfile when the path resolves to dot or root.
Previously filename could be reported as "." on default cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Allow child refs from partial evaluation to match allowed parent keys on
path boundaries and return canonical unknowns for metadata resolution.
Add tests for parent-child matching and boundary safety cases.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Track fields reloaded during eval --print resolution loops and filter
final invalid-field warnings against that set.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi