Skip to content

Commit e9b6a01

Browse files
crazy-maxcrazy-max
authored
Merge pull request #3259 from crazy-max/build-metadata-provenance-02
build: fix buildx.build.provenance metadata
2 parents c48ccde + 2588b66 commit e9b6a01

File tree

8 files changed

+110
-70
lines changed

8 files changed

+110
-70
lines changed

‎build/provenance.go‎

Lines changed: 20 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"github.com/containerd/containerd/v2/core/content/proxy"
1414
"github.com/docker/buildx/util/confutil"
1515
"github.com/docker/buildx/util/progress"
16+
slsa1 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1"
1617
controlapi "github.com/moby/buildkit/api/services/control"
1718
"github.com/moby/buildkit/client"
1819
provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
@@ -22,15 +23,6 @@ import (
2223
"golang.org/x/sync/errgroup"
2324
)
2425

25-
type provenancePredicate struct {
26-
Builder *provenanceBuilder `json:"builder,omitempty"`
27-
provenancetypes.ProvenancePredicateSLSA02
28-
}
29-
30-
type provenanceBuilder struct {
31-
ID string `json:"id,omitempty"`
32-
}
33-
3426
func setRecordProvenance(ctx context.Context, c *client.Client, sr *client.SolveResponse, ref string, mode confutil.MetadataProvenanceMode, pw progress.Writer) error {
3527
if mode == confutil.MetadataProvenanceModeDisabled {
3628
return nil
@@ -69,7 +61,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con
6961
continue
7062
}
7163
if ev.Record.Result != nil {
72-
desc := lookupProvenance(ev.Record.Result)
64+
desc, predicateType := lookupProvenance(ev.Record.Result)
7365
if desc == nil {
7466
continue
7567
}
@@ -78,7 +70,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con
7870
if err != nil {
7971
return errors.Wrapf(err, "failed to load provenance blob from build record")
8072
}
81-
prv, err := encodeProvenance(dt, mode)
73+
prv, err := encodeProvenance(dt, predicateType, mode)
8274
if err != nil {
8375
return err
8476
}
@@ -92,7 +84,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con
9284
})
9385
} else if ev.Record.Results != nil {
9486
for platform, res := range ev.Record.Results {
95-
desc := lookupProvenance(res)
87+
desc, predicateType := lookupProvenance(res)
9688
if desc == nil {
9789
continue
9890
}
@@ -101,7 +93,7 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con
10193
if err != nil {
10294
return errors.Wrapf(err, "failed to load provenance blob from build record")
10395
}
104-
prv, err := encodeProvenance(dt, mode)
96+
prv, err := encodeProvenance(dt, predicateType, mode)
10597
if err != nil {
10698
return err
10799
}
@@ -119,35 +111,37 @@ func fetchProvenance(ctx context.Context, c *client.Client, ref string, mode con
119111
return out, eg.Wait()
120112
}
121113

122-
func lookupProvenance(res *controlapi.BuildResultInfo) *ocispecs.Descriptor {
114+
func lookupProvenance(res *controlapi.BuildResultInfo) (*ocispecs.Descriptor, string) {
123115
for _, a := range res.Attestations {
124116
if a.MediaType == "application/vnd.in-toto+json" && strings.HasPrefix(a.Annotations["in-toto.io/predicate-type"], "https://slsa.dev/provenance/") {
125117
return &ocispecs.Descriptor{
126118
Digest: digest.Digest(a.Digest),
127119
Size: a.Size,
128120
MediaType: a.MediaType,
129121
Annotations: a.Annotations,
130-
}
122+
}, a.Annotations["in-toto.io/predicate-type"]
131123
}
132124
}
133-
return nil
125+
return nil, ""
134126
}
135127

136-
func encodeProvenance(dt []byte, mode confutil.MetadataProvenanceMode) (string, error) {
137-
var prv provenancePredicate
138-
if err := json.Unmarshal(dt, &prv); err != nil {
128+
func encodeProvenance(dt []byte, predicateType string, mode confutil.MetadataProvenanceMode) (string, error) {
129+
var pred *provenancetypes.ProvenancePredicateSLSA02
130+
if predicateType == slsa1.PredicateSLSAProvenance {
131+
var pred1 *provenancetypes.ProvenancePredicateSLSA1
132+
if err := json.Unmarshal(dt, &pred1); err != nil {
133+
return "", errors.Wrapf(err, "failed to unmarshal provenance")
134+
}
135+
pred = pred1.ConvertToSLSA02()
136+
} else if err := json.Unmarshal(dt, &pred); err != nil {
139137
return "", errors.Wrapf(err, "failed to unmarshal provenance")
140138
}
141-
if prv.Builder != nil && prv.Builder.ID == "" {
142-
// reset builder if id is empty
143-
prv.Builder = nil
144-
}
145139
if mode == confutil.MetadataProvenanceModeMin {
146140
// reset fields for minimal provenance
147-
prv.BuildConfig = nil
148-
prv.Metadata = nil
141+
pred.BuildConfig = nil
142+
pred.Metadata = nil
149143
}
150-
dtprv, err := json.Marshal(prv)
144+
dtprv, err := json.Marshal(pred)
151145
if err != nil {
152146
return "", errors.Wrapf(err, "failed to marshal provenance")
153147
}

‎commands/history/inspect.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -441,7 +441,7 @@ workers0:
441441
if err := json.Unmarshal(dt, &pred02); err != nil {
442442
return errors.Errorf("failed to unmarshal provenance %s: %v", prov.descr.Digest, err)
443443
}
444-
pred = provenancetypes.ConvertSLSA02ToSLSA1(pred02)
444+
pred = pred02.ConvertToSLSA1()
445445
} else if err := json.Unmarshal(dt, &pred); err != nil {
446446
return errors.Errorf("failed to unmarshal provenance %s: %v", prov.descr.Digest, err)
447447
}

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ require (
2828
github.com/hashicorp/hcl/v2 v2.23.0
2929
github.com/in-toto/in-toto-golang v0.9.0
3030
github.com/mitchellh/hashstructure/v2 v2.0.2
31-
github.com/moby/buildkit v0.23.0
31+
github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db // master
3232
github.com/moby/go-archive v0.1.0
3333
github.com/moby/sys/atomicwriter v0.1.0
3434
github.com/moby/sys/mountinfo v0.7.2

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,8 +250,8 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZX
250250
github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
251251
github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
252252
github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
253-
github.com/moby/buildkit v0.23.0 h1:HV+u7xM2IZhAjVautFR2l5FNhkxFR0jhF5ILXyc3398=
254-
github.com/moby/buildkit v0.23.0/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ=
253+
github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db h1:ZzrDuG9G1A/RwJvuogNplxCEKsIUQh1CqEnqbOGFgKE=
254+
github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db/go.mod h1:v5jMDvQgUyidk3wu3NvVAAd5JJo83nfet9Gf/o0+EAQ=
255255
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
256256
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
257257
github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=

‎tests/bake.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1398,7 +1398,7 @@ target "default" {
13981398

13991399
var prv provenancetypes.ProvenancePredicateSLSA02
14001400
require.NoError(t, json.Unmarshal(dtprv, &prv))
1401-
require.Equal(t, provenancetypes.BuildKitBuildType, prv.BuildType)
1401+
require.Equal(t, provenancetypes.BuildKitBuildType02, prv.BuildType)
14021402
}
14031403

14041404
func testBakeMetadataWarnings(t *testing.T, sb integration.Sandbox) {

‎tests/build.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -835,7 +835,7 @@ func buildMetadataProvenance(t *testing.T, sb integration.Sandbox, metadataMode
835835

836836
var prv provenancetypes.ProvenancePredicateSLSA02
837837
require.NoError(t, json.Unmarshal(dtprv, &prv))
838-
require.Equal(t, provenancetypes.BuildKitBuildType, prv.BuildType)
838+
require.Equal(t, provenancetypes.BuildKitBuildType02, prv.BuildType)
839839
}
840840

841841
func testBuildMetadataWarnings(t *testing.T, sb integration.Sandbox) {

‎vendor/github.com/moby/buildkit/solver/llbsolver/provenance/types/types.go‎

Lines changed: 83 additions & 37 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/modules.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@ github.com/mitchellh/go-wordwrap
447447
# github.com/mitchellh/hashstructure/v2 v2.0.2
448448
## explicit; go 1.14
449449
github.com/mitchellh/hashstructure/v2
450-
# github.com/moby/buildkit v0.23.0
450+
# github.com/moby/buildkit v0.23.0-rc1.0.20250618182037-9b91d20367db
451451
## explicit; go 1.23.0
452452
github.com/moby/buildkit/api/services/control
453453
github.com/moby/buildkit/api/types

0 commit comments

Comments
 (0)