ci: opt-in sbom and provenance

.github/workflows/build.yml

@@ -24,15 +24,15 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  REPO_SLUG_ORIGIN: "moby/buildkit:latest"
+  REPO_SLUG_ORIGIN: "moby/buildkit:master@sha256:565b144b1b98012407ec0a9b1ac7bc85cc35a12d4381b7f9acf7f211d142e98e"  # https://github.com/moby/buildkit/commit/862b22d7e7cf7b289621de20c8c09e6fe93452d8
   REPO_SLUG_TARGET: "moby/buildkit"
   DF_REPO_SLUG_TARGET: "docker/dockerfile-upstream"
   PLATFORMS: "linux/amd64,linux/arm/v7,linux/arm64,linux/s390x,linux/ppc64le,linux/riscv64"
   CACHE_GHA_SCOPE_IT: "integration-tests"
   CACHE_GHA_SCOPE_BINARIES: "binaries"
   CACHE_GHA_SCOPE_CROSS: "cross"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
-  BUILDX_VERSION: "v0.9.1"  # leave empty to use the one available on GitHub virtual environment
+  BUILDX_VERSION: "https://github.com/docker/buildx.git#96aca741a2ddb00aca7d744a94b3f37252be52ce"  # leave empty to use the one available on GitHub virtual environment
   GO_VERSION: "1.19"
 
 jobs:

Dockerfile

@@ -1,4 +1,4 @@
-# syntax=docker/dockerfile-upstream:1.4
+# syntax=docker/dockerfile-upstream:master
 
 ARG RUNC_VERSION=v1.1.4
 ARG CONTAINERD_VERSION=v1.6.11

frontend/dockerfile/cmd/dockerfile-frontend/hack/release

@@ -84,7 +84,7 @@ case $TYP in
     pushTag=${pushTag}-$TAG
   fi
 
-  buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \
+  buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \
     --build-arg "CHANNEL=$TAG" \
     --build-arg "BUILDTAGS=$buildTags" \
     --output "type=image,name=$REPO:$pushTag,buildinfo-attrs=true,$pushFlag" \
@@ -101,7 +101,7 @@ case $TYP in
   fi
   buildTags=$(cat $tagf)
 
-  buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \
+  buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \
     --build-arg "CHANNEL=$TAG" \
     --build-arg "BUILDTAGS=$buildTags" \
     --output "type=image,\"name=$publishedNames\",buildinfo-attrs=true,$pushFlag" \
@@ -141,7 +141,7 @@ case $TYP in
       buildid=$(cat $tmp/buildid)
       echo "buildid: $buildid"
 
-      buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags \
+      buildxCmd build $platformFlag $cacheFromFlags $cacheToFlags $(buildAttestFlags) \
         --build-arg "CHANNEL=$TAG" \
         --build-arg "BUILDTAGS=$buildTags" \
         --output "type=image,name=$REPO:$dt-$TAG,buildinfo-attrs=true,$pushFlag" \

hack/images

@@ -88,5 +88,5 @@ for tagName in $tagNames; do
   tagFlags="$tagFlags--tag=$tagName "
 done
 
-buildxCmd build $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag \
+buildxCmd build $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag $(buildAttestFlags) \
   $currentcontext

hack/util

@@ -1,45 +1,43 @@
 #!/usr/bin/env sh
-export BUILDX_NO_DEFAULT_LOAD=true
 
-: ${PREFER_BUILDCTL=}
-: ${PREFER_LEGACY=}
-: ${CI=}
-: ${GITHUB_ACTIONS=}
+: "${CI=}"
+: "${GITHUB_ACTIONS=}"
+: "${BUILDX_BUILDER=}"
 
-: ${CONTEXT=}
-: ${CACHE_FROM=}
-: ${CACHE_TO=}
-
-if [ "$PREFER_BUILDCTL" = "1" ]; then
-  echo >&2 "WARNING: PREFER_BUILDCTL is no longer supported. Ignoring."
-fi
-
-if [ "$PREFER_LEGACY" = "1" ]; then
-  echo >&2 "WARNING: PREFER_LEGACY is no longer supported. Ignoring."
-fi
+: "${CONTEXT=}"
+: "${CACHE_FROM=}"
+: "${CACHE_TO=}"
 
 progressFlag=""
 if [ "$CI" = "true" ]; then
   progressFlag="--progress=plain"
 fi
 
-buildxCmd() {
-  if docker buildx version >/dev/null 2>&1; then
-    set -x
-    docker buildx "$@" $progressFlag
-  elif buildx version >/dev/null 2>&1; then
-    set -x
-    buildx "$@" $progressFlag
-  else
-    topdir="$(realpath $(dirname "$0")/..)"
-    if [ ! -x "${topdir}/bin/buildx" ]; then
-      set -x
-      "${topdir}/hack/install-buildx"
-    fi
+buildxBin=""
+builderName=""
+if docker buildx version >/dev/null 2>&1; then
+  buildxBin="docker buildx"
+elif buildx version >/dev/null 2>&1; then
+  buildxBin="buildx"
+else
+  topdir="$(realpath $(dirname "$0")/..)"
+  if [ ! -x "${topdir}/bin/buildx" ]; then
     set -x
-    bootstrapName="moby-buildkit"
-    "${topdir}/hack/bootstrap-buildx" "${bootstrapName}"
-    BUILDX_BUILDER="${bootstrapName}" "${topdir}/bin/buildx" "$@" $progressFlag
+    "${topdir}/hack/install-buildx"
+  fi
+  buildxBin="${topdir}/bin/buildx"
+  builderName="moby-buildkit"
+  "${topdir}/hack/bootstrap-buildx" "${builderName}"
+fi
+
+buildxCmd() {
+  set -x
+  BUILDX_NO_DEFAULT_LOAD=true BUILDX_BUILDER="${builderName:-${BUILDX_BUILDER}}" $buildxBin "$@" $progressFlag
+}
+
+buildAttestFlags() {
+  if $buildxBin build --help 2>&1 | grep -- '--attest' >/dev/null; then
+    echo "--attest=type=sbom --attest=type=provenance,mode=max"
   fi
 }