From 25aa893bad0e4e62ee9e7df575b6e79cef640ebd Mon Sep 17 00:00:00 2001 From: Justin Chadwell Date: Wed, 7 Dec 2022 18:44:21 +0000 Subject: [PATCH] bake: add attests field Signed-off-by: Justin Chadwell --- bake/bake.go | 15 ++++++++++++++- commands/bake.go | 9 +++++++++ docs/reference/buildx_bake.md | 2 ++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/bake/bake.go b/bake/bake.go index 3ba80d2d..cec4aaee 100644 --- a/bake/bake.go +++ b/bake/bake.go @@ -417,7 +417,7 @@ func (c Config) newOverrides(v []string) (map[string]map[string]Override, error) o := t[kk[1]] switch keys[1] { - case "output", "cache-to", "cache-from", "tags", "platform", "secrets", "ssh": + case "output", "cache-to", "cache-from", "tags", "platform", "secrets", "ssh", "attest": if len(parts) == 2 { o.ArrValue = append(o.ArrValue, parts[1]) } @@ -558,6 +558,7 @@ type Target struct { // Inherits is the only field that cannot be overridden with --set Inherits []string `json:"inherits,omitempty" hcl:"inherits,optional"` + Attest []string `json:"attest,omitempty" hcl:"attest,optional"` Context *string `json:"context,omitempty" hcl:"context,optional"` Contexts map[string]string `json:"contexts,omitempty" hcl:"contexts,optional"` Dockerfile *string `json:"dockerfile,omitempty" hcl:"dockerfile,optional"` @@ -583,6 +584,7 @@ type Target struct { } func (t *Target) normalize() { + t.Attest = removeDupes(t.Attest) t.Tags = removeDupes(t.Tags) t.Secrets = removeDupes(t.Secrets) t.SSH = removeDupes(t.SSH) @@ -636,6 +638,9 @@ func (t *Target) Merge(t2 *Target) { if t2.Target != nil { t.Target = t2.Target } + if t2.Attest != nil { // merge + t.Attest = append(t.Attest, t2.Attest...) + } if t2.Secrets != nil { // merge t.Secrets = append(t.Secrets, t2.Secrets...) } @@ -718,6 +723,8 @@ func (t *Target) AddOverrides(overrides map[string]Override) error { t.Platforms = o.ArrValue case "output": t.Outputs = o.ArrValue + case "attest": + t.Attest = append(t.Attest, o.ArrValue...) case "no-cache": noCache, err := strconv.ParseBool(value) if err != nil { @@ -971,6 +978,12 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) { } bo.Exports = outputs + attests, err := buildflags.ParseAttests(t.Attest) + if err != nil { + return nil, err + } + bo.Attests = attests + return bo, nil } diff --git a/commands/bake.go b/commands/bake.go index a55d800e..4c7ffc4f 100644 --- a/commands/bake.go +++ b/commands/bake.go @@ -10,6 +10,7 @@ import ( "github.com/docker/buildx/bake" "github.com/docker/buildx/build" "github.com/docker/buildx/builder" + "github.com/docker/buildx/util/buildflags" "github.com/docker/buildx/util/confutil" "github.com/docker/buildx/util/dockerutil" "github.com/docker/buildx/util/progress" @@ -73,6 +74,12 @@ func runBake(dockerCli command.Cli, targets []string, in bakeOptions) (err error if in.pull != nil { overrides = append(overrides, fmt.Sprintf("*.pull=%t", *in.pull)) } + if in.sbom != "" { + overrides = append(overrides, fmt.Sprintf("*.attest=%s", buildflags.CanonicalizeAttest("sbom", in.sbom))) + } + if in.provenance != "" { + overrides = append(overrides, fmt.Sprintf("*.attest=%s", buildflags.CanonicalizeAttest("provenance", in.provenance))) + } contextPathHash, _ := os.Getwd() ctx2, cancel := context.WithCancel(context.TODO()) @@ -199,6 +206,8 @@ func bakeCmd(dockerCli command.Cli, rootOpts *rootOptions) *cobra.Command { flags.BoolVar(&options.exportLoad, "load", false, `Shorthand for "--set=*.output=type=docker"`) flags.BoolVar(&options.printOnly, "print", false, "Print the options without building") flags.BoolVar(&options.exportPush, "push", false, `Shorthand for "--set=*.output=type=registry"`) + flags.StringVar(&options.sbom, "sbom", "", `Shorthand for "--set=*.attest=type=sbom"`) + flags.StringVar(&options.provenance, "provenance", "", `Shorthand for "--set=*.attest=type=provenance"`) flags.StringArrayVar(&options.overrides, "set", nil, `Override target value (e.g., "targetpattern.key=value")`) commonBuildFlags(&options.commonOptions, flags) diff --git a/docs/reference/buildx_bake.md b/docs/reference/buildx_bake.md index 73d1799b..d74a8ca0 100644 --- a/docs/reference/buildx_bake.md +++ b/docs/reference/buildx_bake.md @@ -22,8 +22,10 @@ Build from a file | [`--no-cache`](#no-cache) | | | Do not use cache when building the image | | [`--print`](#print) | | | Print the options without building | | [`--progress`](#progress) | `string` | `auto` | Set type of progress output (`auto`, `plain`, `tty`). Use plain to show container output | +| `--provenance` | `string` | | Shorthand for `--set=*.attest=type=provenance` | | [`--pull`](#pull) | | | Always attempt to pull all referenced images | | `--push` | | | Shorthand for `--set=*.output=type=registry` | +| `--sbom` | `string` | | Shorthand for `--set=*.attest=type=sbom` | | [`--set`](#set) | `stringArray` | | Override target value (e.g., `targetpattern.key=value`) |