buildinfo: mark as deprecated

Signed-off-by: CrazyMax <[email protected]>

Author: crazy-max

.golangci.yml

@@ -65,3 +65,6 @@ issues:
     - linters:
         - revive
       text: "stutters"
+    - linters:
+        - staticcheck
+      text: "SA1019: .*Build information format has been deprecated. Status and alternative recommendation can be found at: https://github.com/moby/buildkit/blob/master/docs/deprecated.md"

README.md

@@ -259,8 +259,8 @@ Keys supported by image output:
 * `compression=<uncompressed|gzip|estargz|zstd>`: choose compression type for layers newly created and cached, gzip is default value. estargz should be used with `oci-mediatypes=true`.
 * `compression-level=<value>`: compression level for gzip, estargz (0-9) and zstd (0-22)
 * `force-compression=true`: forcefully apply `compression` option to all layers (including already existing layers)
-* `buildinfo=true`: attach inline build info in [image config](docs/build-repro.md#image-config) (default `true`)
-* `buildinfo-attrs=true`: attach inline build info attributes in [image config](docs/build-repro.md#image-config) (default `false`)
+* `buildinfo=true`: attach inline build info in [image config](docs/buildinfo.md#image-config) (default `true`)
+* `buildinfo-attrs=true`: attach inline build info attributes in [image config](docs/buildinfo.md#image-config) (default `false`)
 * `store=true`: store the result images to the worker's (e.g. containerd) image store as well as ensures that the image has all blobs in the content store (default `true`). Ignored if the worker doesn't have image store (e.g. OCI worker).
 * `annotation.<key>=<value>`: attach an annotation with the respective `key` and `value` to the built image
   * Using the extended syntaxes, `annotation-<type>.<key>=<value>`, `annotation[<platform>].<key>=<value>` and both combined with `annotation-<type>[<platform>].<key>=<value>`, allows configuring exactly where to attach the annotation.
@@ -271,6 +271,12 @@ Keys supported by image output:
 If credentials are required, `buildctl` will attempt to read Docker configuration file `$DOCKER_CONFIG/config.json`.
 `$DOCKER_CONFIG` defaults to `~/.docker`.
 
+> **Warning**
+>
+> Build information along `buildinfo` and `buildinfo-attrs` attributes are
+> deprecated and will be removed in the next release. See the [Deprecated features page](./docs/deprecated.md)
+> for status and alternative recommendation about this feature.
+
 #### Local directory
 
 The local client will copy the files directly to the client. This is useful if BuildKit is being used for building something else than container images.
@@ -582,26 +588,6 @@ jq '.' metadata.json
 ```
 ```json
 {
-  "containerimage.buildinfo": {
-    "frontend": "dockerfile.v0",
-    "attrs": {
-      "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
-      "filename": "Dockerfile",
-      "source": "docker/dockerfile:master"
-    },
-    "sources": [
-      {
-        "type": "docker-image",
-        "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
-        "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
-      },
-      {
-        "type": "docker-image",
-        "ref": "docker.io/library/alpine:3.13",
-        "pin": "sha256:026f721af4cf2843e07bba648e158fb35ecc876d822130633cc49f707f0fc88c"
-      }
-    ]
-  },
   "containerimage.config.digest": "sha256:2937f66a9722f7f4a2df583de2f8cb97fc9196059a410e7f00072fc918930e66",
   "containerimage.descriptor": {
     "annotations": {

docs/build-repro.md

@@ -1,134 +1,6 @@
 # Build reproducibility
 
-## Build dependencies
-
-Build dependencies are generated when your image has been built. These
-dependencies include versions of used images, git repositories and HTTP URLs
-used by LLB `Source` operation as well as build request attributes.
-
-The structure is base64 encoded and has the following format when decoded:
-
-```json
-{
-  "frontend": "dockerfile.v0",
-  "attrs": {
-    "build-arg:foo": "bar",
-    "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
-    "filename": "Dockerfile",
-    "platform": "linux/amd64,linux/arm64",
-    "source": "crazymax/dockerfile:master"
-  },
-  "sources": [
-    {
-      "type": "docker-image",
-      "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
-      "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
-    },
-    {
-      "type": "docker-image",
-      "ref": "docker.io/library/alpine:3.13",
-      "pin": "sha256:1d30d1ba3cb90962067e9b29491fbd56997979d54376f23f01448b5c5cd8b462"
-    },
-    {
-      "type": "git",
-      "ref": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
-      "pin": "259a5aa5aa5bb3562d12cc631fe399f4788642c1"
-    },
-    {
-      "type": "http",
-      "ref": "https://raw.githubusercontent.com/moby/moby/v20.10.21/README.md",
-      "pin": "sha256:419455202b0ef97e480d7f8199b26a721a417818bc0e2d106975f74323f25e6c"
-    }
-  ]
-}
-```
-
-* `frontend` defines the frontend used to build.
-* `attrs` defines build request attributes.
-* `sources` defines build sources.
-  * `type` defines the source type (`docker-image`, `git` or `http`).
-  * `ref` is the reference of the source.
-  * `pin` is the source digest.
-* `deps` defines build dependencies of input contexts.
-
-### Image config
-
-A new field similar to the one for inline cache has been added to the image
-configuration to embed build dependencies:
-
-```json
-{
-  "moby.buildkit.buildinfo.v0": "<base64>"
-}
-```
-
-By default, the build dependencies are inlined in the image configuration. You
-can disable this behavior with the [`buildinfo` attribute](../README.md#imageregistry).
-
-### Exporter response (metadata)
-
-The solver response (`ExporterResponse`) also contains a new key
-`containerimage.buildinfo` with the same structure as image config encoded in
-base64:
-
-```json
-{
-  "ExporterResponse": {
-    "containerimage.buildinfo": "<base64>",
-    "containerimage.digest": "sha256:..."
-  }
-}
-```
-
-If multi-platforms are specified, they will be suffixed with the corresponding
-platform:
-
-```json
-{
-  "ExporterResponse": {
-    "containerimage.buildinfo/linux/amd64": "<base64>",
-    "containerimage.buildinfo/linux/arm64": "<base64>",
-    "containerimage.digest": "sha256:..."
-  }
-}
-```
-
-### Metadata JSON output
-
-If you're using the `--metadata-file` flag with [`buildctl`](../README.md#metadata),
-[`buildx build`](https://github.com/docker/buildx/blob/master/docs/reference/buildx_build.md)
-or [`buildx bake`](https://github.com/docker/buildx/blob/master/docs/reference/buildx_bake.md):
-
-```shell
-jq '.' metadata.json
-```
-```json
-{
-  "containerimage.buildinfo": {
-    "frontend": "dockerfile.v0",
-    "attrs": {
-      "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
-      "filename": "Dockerfile",
-      "source": "docker/dockerfile:master"
-    },
-    "sources": [
-      {
-        "type": "docker-image",
-        "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
-        "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
-      },
-      {
-        "type": "docker-image",
-        "ref": "docker.io/library/alpine:3.13",
-        "pin": "sha256:026f721af4cf2843e07bba648e158fb35ecc876d822130633cc49f707f0fc88c"
-      }
-    ]
-  },
-  "containerimage.digest": "sha256:..."
-}
-```
-
-### Reproducing the pinned dependencies
+## Reproducing the pinned dependencies
 
 Reproducing the pinned dependencies is supported since BuildKit v0.11.
 

docs/buildinfo.md

@@ -0,0 +1,141 @@
+# Build information
+
+> **Warning**
+>
+> Build information is deprecated and will be removed in the next release. See
+> the [Deprecated features page](https://github.com/moby/buildkit/blob/master/docs/deprecated.md)
+> for status and alternative recommendation about this feature.
+
+Build information structures are generated with build metadata that allows you
+to see all the sources (images, git repositories) that were used by the build
+with their exact versions and also the configuration that was passed to the
+build. This information is also embedded into the image configuration if one
+is generated.
+
+## Build dependencies
+
+Build dependencies are generated when your image has been built. These
+dependencies include versions of used images, git repositories and HTTP URLs
+used by LLB `Source` operation as well as build request attributes.
+
+The structure is base64 encoded and has the following format when decoded:
+
+```json
+{
+  "frontend": "dockerfile.v0",
+  "attrs": {
+    "build-arg:foo": "bar",
+    "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
+    "filename": "Dockerfile",
+    "platform": "linux/amd64,linux/arm64",
+    "source": "crazymax/dockerfile:master"
+  },
+  "sources": [
+    {
+      "type": "docker-image",
+      "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
+      "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
+    },
+    {
+      "type": "docker-image",
+      "ref": "docker.io/library/alpine:3.13",
+      "pin": "sha256:1d30d1ba3cb90962067e9b29491fbd56997979d54376f23f01448b5c5cd8b462"
+    },
+    {
+      "type": "git",
+      "ref": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
+      "pin": "259a5aa5aa5bb3562d12cc631fe399f4788642c1"
+    },
+    {
+      "type": "http",
+      "ref": "https://raw.githubusercontent.com/moby/moby/v20.10.21/README.md",
+      "pin": "sha256:419455202b0ef97e480d7f8199b26a721a417818bc0e2d106975f74323f25e6c"
+    }
+  ]
+}
+```
+
+* `frontend` defines the frontend used to build.
+* `attrs` defines build request attributes.
+* `sources` defines build sources.
+  * `type` defines the source type (`docker-image`, `git` or `http`).
+  * `ref` is the reference of the source.
+  * `pin` is the source digest.
+* `deps` defines build dependencies of input contexts.
+
+### Image config
+
+A new field similar to the one for inline cache has been added to the image
+configuration to embed build dependencies:
+
+```json
+{
+  "moby.buildkit.buildinfo.v0": "<base64>"
+}
+```
+
+By default, the build dependencies are inlined in the image configuration. You
+can disable this behavior with the [`buildinfo` attribute](../README.md#imageregistry).
+
+### Exporter response (metadata)
+
+The solver response (`ExporterResponse`) also contains a new key
+`containerimage.buildinfo` with the same structure as image config encoded in
+base64:
+
+```json
+{
+  "ExporterResponse": {
+    "containerimage.buildinfo": "<base64>",
+    "containerimage.digest": "sha256:..."
+  }
+}
+```
+
+If multi-platforms are specified, they will be suffixed with the corresponding
+platform:
+
+```json
+{
+  "ExporterResponse": {
+    "containerimage.buildinfo/linux/amd64": "<base64>",
+    "containerimage.buildinfo/linux/arm64": "<base64>",
+    "containerimage.digest": "sha256:..."
+  }
+}
+```
+
+### Metadata JSON output
+
+If you're using the `--metadata-file` flag with [`buildctl`](../README.md#metadata),
+[`buildx build`](https://github.com/docker/buildx/blob/master/docs/reference/buildx_build.md)
+or [`buildx bake`](https://github.com/docker/buildx/blob/master/docs/reference/buildx_bake.md):
+
+```shell
+jq '.' metadata.json
+```
+```json
+{
+  "containerimage.buildinfo": {
+    "frontend": "dockerfile.v0",
+    "attrs": {
+      "context": "https://github.com/crazy-max/buildkit-buildsources-test.git#master",
+      "filename": "Dockerfile",
+      "source": "docker/dockerfile:master"
+    },
+    "sources": [
+      {
+        "type": "docker-image",
+        "ref": "docker.io/docker/buildx-bin:0.6.1@sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0",
+        "pin": "sha256:a652ced4a4141977c7daaed0a074dcd9844a78d7d2615465b12f433ae6dd29f0"
+      },
+      {
+        "type": "docker-image",
+        "ref": "docker.io/library/alpine:3.13",
+        "pin": "sha256:026f721af4cf2843e07bba648e158fb35ecc876d822130633cc49f707f0fc88c"
+      }
+    ]
+  },
+  "containerimage.digest": "sha256:..."
+}
+```

docs/deprecated.md

@@ -27,6 +27,20 @@ features:
   migrate to alternatives. In such cases, a warning may be printed, and users
   should not rely on this feature.
 
-| Status | Feature | Deprecated | Remove | Recommendation |
-|--------|---------|------------|--------|----------------|
-|        |         | -          | -      |                |
+| Status     | Feature                                 | Deprecated | Remove | Recommendation                                                   |
+|------------|-----------------------------------------|------------|--------|------------------------------------------------------------------|
+| Deprecated | [Build information](#build-information) | v0.11      | v0.12  | Use [provenance attestations](./attestations/slsa-provenance.md) |
+
+## Build information
+
+[Build information](https://github.com/moby/buildkit/blob/v0.11/docs/buildinfo.md)
+structures have been introduced in [BuildKit v0.10.0](https://github.com/moby/buildkit/releases/tag/v0.10.0)
+and are generated with build metadata that allows you to see all the sources
+(images, git repositories) that were used by the build with their exact
+versions and also the configuration that was passed to the build. This
+information is also embedded into the image configuration if one is generated.
+
+With the introduction of [provenance attestations](./attestations/slsa-provenance.md)
+in [BuildKit v0.11.0](https://github.com/moby/buildkit/releases/tag/v0.11.0),
+the build information feature has been deprecated and will be removed in the
+next release.

exporter/containerimage/exptypes/types.go

@@ -11,7 +11,7 @@ const (
 	ExporterImageConfigDigestKey = "containerimage.config.digest"
 	ExporterImageDescriptorKey   = "containerimage.descriptor"
 	ExporterInlineCache          = "containerimage.inlinecache"
-	ExporterBuildInfo            = "containerimage.buildinfo"
+	ExporterBuildInfo            = "containerimage.buildinfo" // Deprecated: Build information format has been deprecated. Status and alternative recommendation can be found at: https://github.com/moby/buildkit/blob/master/docs/deprecated.md
 	ExporterPlatformsKey         = "refs.platforms"
 	ExporterEpochKey             = "source.date.epoch"
 )

exporter/containerimage/opts.go

@@ -25,15 +25,16 @@ const (
 )
 
 type ImageCommitOpts struct {
-	ImageName      string
-	RefCfg         cacheconfig.RefConfig
-	OCITypes       bool
-	BuildInfo      bool
-	BuildInfoAttrs bool
-	Annotations    AnnotationsGroup
-	Epoch          *time.Time
+	ImageName   string
+	RefCfg      cacheconfig.RefConfig
+	OCITypes    bool
+	Annotations AnnotationsGroup
+	Epoch       *time.Time
 
 	ForceInlineAttestations bool // force inline attestations to be attached
+
+	BuildInfo      bool // Deprecated: Build information format has been deprecated. Status and alternative recommendation can be found at: https://github.com/moby/buildkit/blob/master/docs/deprecated.md
+	BuildInfoAttrs bool // Deprecated: Build information format has been deprecated. Status and alternative recommendation can be found at: https://github.com/moby/buildkit/blob/master/docs/deprecated.md
 }
 
 func (c *ImageCommitOpts) Load(opt map[string]string) (map[string]string, error) {