buildflags: merge attest flags if disabled is set

This ensures that `--sbom=<bool>` and `--attest type=sbom`
can be appropriately merged for build, and `--sbom=<bool>` and
`target.attest=["type=sbom"]` can be appropriately merged for bake.

Signed-off-by: Justin Chadwell <me@jedevc.com>

util/buildflags/attests.go

@@ -30,9 +30,16 @@ func ParseAttests(in []string) (map[string]*string, error) {
 
 		k := "attest:" + attestType
 		if _, ok := out[k]; ok {
-			return nil, errors.Errorf("duplicate attestation field %s", attestType)
+			if disabled == nil {
+				return nil, errors.Errorf("duplicate attestation field %s", attestType)
+			}
+			if *disabled {
+				out[k] = nil
+			}
+			continue
 		}
-		if disabled {
+
+		if disabled != nil && *disabled {
 			out[k] = nil
 		} else {
 			out[k] = &in
@@ -41,23 +48,23 @@ func ParseAttests(in []string) (map[string]*string, error) {
 	return out, nil
 }
 
-func parseAttest(in string) (string, bool, error) {
+func parseAttest(in string) (string, *bool, error) {
 	if in == "" {
-		return "", false, nil
+		return "", nil, nil
 	}
 
 	csvReader := csv.NewReader(strings.NewReader(in))
 	fields, err := csvReader.Read()
 	if err != nil {
-		return "", false, err
+		return "", nil, err
 	}
 
 	attestType := ""
-	disabled := true
+	var disabled *bool
 	for _, field := range fields {
 		key, value, ok := strings.Cut(field, "=")
 		if !ok {
-			return "", false, errors.Errorf("invalid value %s", field)
+			return "", nil, errors.Errorf("invalid value %s", field)
 		}
 		key = strings.TrimSpace(strings.ToLower(key))
 
@@ -65,14 +72,15 @@ func parseAttest(in string) (string, bool, error) {
 		case "type":
 			attestType = value
 		case "disabled":
-			disabled, err = strconv.ParseBool(value)
+			b, err := strconv.ParseBool(value)
 			if err != nil {
-				return "", false, err
+				return "", nil, err
 			}
+			disabled = &b
 		}
 	}
 	if attestType == "" {
-		return "", false, errors.Errorf("attestation type not specified")
+		return "", nil, errors.Errorf("attestation type not specified")
 	}
 
 	return attestType, disabled, nil