From a0055e01cdd150b2cc070e73eaa6d5ef65e35d8e Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Thu, 1 Dec 2022 12:28:33 +0100 Subject: [PATCH 1/2] ci: opt-in sbom and provenance Signed-off-by: CrazyMax --- .github/workflows/build.yml | 4 +- Dockerfile | 2 +- .../cmd/dockerfile-frontend/hack/release | 6 +-- hack/images | 2 +- hack/util | 43 ++++++++++++------- 5 files changed, 34 insertions(+), 23 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 57512e8e48fa..22e7fa5bec1d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ on: - 'frontend/dockerfile/docs/**' env: - REPO_SLUG_ORIGIN: "moby/buildkit:latest" + REPO_SLUG_ORIGIN: "moby/buildkit:master@sha256:565b144b1b98012407ec0a9b1ac7bc85cc35a12d4381b7f9acf7f211d142e98e" # https://github.com/moby/buildkit/commit/862b22d7e7cf7b289621de20c8c09e6fe93452d8 REPO_SLUG_TARGET: "moby/buildkit" DF_REPO_SLUG_TARGET: "docker/dockerfile-upstream" PLATFORMS: "linux/amd64,linux/arm/v7,linux/arm64,linux/s390x,linux/ppc64le,linux/riscv64" @@ -32,7 +32,7 @@ env: CACHE_GHA_SCOPE_BINARIES: "binaries" CACHE_GHA_SCOPE_CROSS: "cross" TESTFLAGS: "-v --parallel=6 --timeout=30m" - BUILDX_VERSION: "v0.9.1" # leave empty to use the one available on GitHub virtual environment + BUILDX_VERSION: "https://github.com/docker/buildx.git#96aca741a2ddb00aca7d744a94b3f37252be52ce" # leave empty to use the one available on GitHub virtual environment GO_VERSION: "1.19" jobs: diff --git a/Dockerfile b/Dockerfile index 6484de78f6c8..e7d67bf6e250 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile-upstream:1.4 +# syntax=docker/dockerfile-upstream:master ARG RUNC_VERSION=v1.1.4 ARG CONTAINERD_VERSION=v1.6.11 diff --git a/frontend/dockerfile/cmd/dockerfile-frontend/hack/release b/frontend/dockerfile/cmd/dockerfile-frontend/hack/release index b572bda1756b..4de0c9c6b27f 100755 --- a/frontend/dockerfile/cmd/dockerfile-frontend/hack/release +++ b/frontend/dockerfile/cmd/dockerfile-frontend/hack/release @@ -84,7 +84,7 @@ case $TYP in pushTag=${pushTag}-$TAG fi - buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \ + buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \ --build-arg "CHANNEL=$TAG" \ --build-arg "BUILDTAGS=$buildTags" \ --output "type=image,name=$REPO:$pushTag,buildinfo-attrs=true,$pushFlag" \ @@ -101,7 +101,7 @@ case $TYP in fi buildTags=$(cat $tagf) - buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \ + buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \ --build-arg "CHANNEL=$TAG" \ --build-arg "BUILDTAGS=$buildTags" \ --output "type=image,\"name=$publishedNames\",buildinfo-attrs=true,$pushFlag" \ @@ -141,7 +141,7 @@ case $TYP in buildid=$(cat $tmp/buildid) echo "buildid: $buildid" - buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \ + buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \ --build-arg "CHANNEL=$TAG" \ --build-arg "BUILDTAGS=$buildTags" \ --output "type=image,name=$REPO:$dt-$TAG,buildinfo-attrs=true,$pushFlag" \ diff --git a/hack/images b/hack/images index 1b172059eef9..8c4564caa27e 100755 --- a/hack/images +++ b/hack/images @@ -88,5 +88,5 @@ for tagName in $tagNames; do tagFlags="$tagFlags--tag=$tagName " done -buildxCmd build $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag \ +buildxCmd build $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag $(buildAttestFlags) \ $currentcontext diff --git a/hack/util b/hack/util index dc2ecfa9bdb2..802083e4e2dd 100755 --- a/hack/util +++ b/hack/util @@ -23,23 +23,34 @@ if [ "$CI" = "true" ]; then progressFlag="--progress=plain" fi -buildxCmd() { - if docker buildx version >/dev/null 2>&1; then - set -x - docker buildx "$@" $progressFlag - elif buildx version >/dev/null 2>&1; then - set -x - buildx "$@" $progressFlag - else - topdir="$(realpath $(dirname "$0")/..)" - if [ ! -x "${topdir}/bin/buildx" ]; then - set -x - "${topdir}/hack/install-buildx" - fi +buildxBin="" +builderName="" +if docker buildx version >/dev/null 2>&1; then + buildxBin="docker buildx" +elif buildx version >/dev/null 2>&1; then + buildxBin="buildx" +else + topdir="$(realpath $(dirname "$0")/..)" + if [ ! -x "${topdir}/bin/buildx" ]; then set -x - bootstrapName="moby-buildkit" - "${topdir}/hack/bootstrap-buildx" "${bootstrapName}" - BUILDX_BUILDER="${bootstrapName}" "${topdir}/bin/buildx" "$@" $progressFlag + "${topdir}/hack/install-buildx" + fi + buildxBin="${topdir}/bin/buildx" + builderName="moby-buildkit" + "${topdir}/hack/bootstrap-buildx" "${builderName}" +fi + +buildxCmd() { + if [ -n "$builderName" ]; then + export BUILDX_BUILDER="${builderName}" + fi + set -x + $buildxBin "$@" $progressFlag +} + +buildAttestFlags() { + if $buildxBin build --help 2>&1 | grep -- '--attest' >/dev/null; then + echo "--attest=type=sbom --attest=type=provenance,mode=max" fi } From 493a968ca10b940d14203265ce22e105c18f56bc Mon Sep 17 00:00:00 2001 From: CrazyMax Date: Thu, 1 Dec 2022 23:11:43 +0100 Subject: [PATCH 2/2] hack: cleanup util script Signed-off-by: CrazyMax --- hack/util | 27 +++++++-------------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/hack/util b/hack/util index 802083e4e2dd..ac32aea55559 100755 --- a/hack/util +++ b/hack/util @@ -1,22 +1,12 @@ #!/usr/bin/env sh -export BUILDX_NO_DEFAULT_LOAD=true -: ${PREFER_BUILDCTL=} -: ${PREFER_LEGACY=} -: ${CI=} -: ${GITHUB_ACTIONS=} +: "${CI=}" +: "${GITHUB_ACTIONS=}" +: "${BUILDX_BUILDER=}" -: ${CONTEXT=} -: ${CACHE_FROM=} -: ${CACHE_TO=} - -if [ "$PREFER_BUILDCTL" = "1" ]; then - echo >&2 "WARNING: PREFER_BUILDCTL is no longer supported. Ignoring." -fi - -if [ "$PREFER_LEGACY" = "1" ]; then - echo >&2 "WARNING: PREFER_LEGACY is no longer supported. Ignoring." -fi +: "${CONTEXT=}" +: "${CACHE_FROM=}" +: "${CACHE_TO=}" progressFlag="" if [ "$CI" = "true" ]; then @@ -41,11 +31,8 @@ else fi buildxCmd() { - if [ -n "$builderName" ]; then - export BUILDX_BUILDER="${builderName}" - fi set -x - $buildxBin "$@" $progressFlag + BUILDX_NO_DEFAULT_LOAD=true BUILDX_BUILDER="${builderName:-${BUILDX_BUILDER}}" $buildxBin "$@" $progressFlag } buildAttestFlags() {