diff --git a/bake/bake.go b/bake/bake.go
index 474d30d6..2c2c55f8 100644
--- a/bake/bake.go
+++ b/bake/bake.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/docker/buildx/build"
+	"github.com/docker/buildx/util/buildflags"
 	"github.com/docker/buildx/util/platformutil"
 	"github.com/docker/docker/pkg/urlutil"
 	hcl "github.com/hashicorp/hcl/v2"
@@ -528,17 +529,17 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 
 	bo.Session = append(bo.Session, authprovider.NewDockerAuthProvider(os.Stderr))
 
-	secrets, err := build.ParseSecretSpecs(t.Secrets)
+	secrets, err := buildflags.ParseSecretSpecs(t.Secrets)
 	if err != nil {
 		return nil, err
 	}
 	bo.Session = append(bo.Session, secrets)
 
 	sshSpecs := t.SSH
-	if len(sshSpecs) == 0 && build.IsGitSSH(contextPath) {
+	if len(sshSpecs) == 0 && buildflags.IsGitSSH(contextPath) {
 		sshSpecs = []string{"default"}
 	}
-	ssh, err := build.ParseSSHSpecs(sshSpecs)
+	ssh, err := buildflags.ParseSSHSpecs(sshSpecs)
 	if err != nil {
 		return nil, err
 	}
@@ -548,19 +549,19 @@ func toBuildOpt(t *Target, inp *Input) (*build.Options, error) {
 		bo.Target = *t.Target
 	}
 
-	cacheImports, err := build.ParseCacheEntry(t.CacheFrom)
+	cacheImports, err := buildflags.ParseCacheEntry(t.CacheFrom)
 	if err != nil {
 		return nil, err
 	}
 	bo.CacheFrom = cacheImports
 
-	cacheExports, err := build.ParseCacheEntry(t.CacheTo)
+	cacheExports, err := buildflags.ParseCacheEntry(t.CacheTo)
 	if err != nil {
 		return nil, err
 	}
 	bo.CacheTo = cacheExports
 
-	outputs, err := build.ParseOutputs(t.Outputs)
+	outputs, err := buildflags.ParseOutputs(t.Outputs)
 	if err != nil {
 		return nil, err
 	}
diff --git a/build/build.go b/build/build.go
index 61a2c494..ba7b7780 100644
--- a/build/build.go
+++ b/build/build.go
@@ -1125,3 +1125,9 @@ func handleLowercaseDockerfile(dir, p string) string {
 	}
 	return p
 }
+
+func wrapWriteCloser(wc io.WriteCloser) func(map[string]string) (io.WriteCloser, error) {
+	return func(map[string]string) (io.WriteCloser, error) {
+		return wc, nil
+	}
+}
diff --git a/commands/build.go b/commands/build.go
index 12ef5949..324c4e3d 100644
--- a/commands/build.go
+++ b/commands/build.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/docker/buildx/build"
+	"github.com/docker/buildx/util/buildflags"
 	"github.com/docker/buildx/util/platformutil"
 	"github.com/docker/buildx/util/progress"
 	"github.com/docker/cli/cli"
@@ -118,23 +119,23 @@ func runBuild(dockerCli command.Cli, in buildOptions) error {
 
 	opts.Session = append(opts.Session, authprovider.NewDockerAuthProvider(os.Stderr))
 
-	secrets, err := build.ParseSecretSpecs(in.secrets)
+	secrets, err := buildflags.ParseSecretSpecs(in.secrets)
 	if err != nil {
 		return err
 	}
 	opts.Session = append(opts.Session, secrets)
 
 	sshSpecs := in.ssh
-	if len(sshSpecs) == 0 && build.IsGitSSH(in.contextPath) {
+	if len(sshSpecs) == 0 && buildflags.IsGitSSH(in.contextPath) {
 		sshSpecs = []string{"default"}
 	}
-	ssh, err := build.ParseSSHSpecs(sshSpecs)
+	ssh, err := buildflags.ParseSSHSpecs(sshSpecs)
 	if err != nil {
 		return err
 	}
 	opts.Session = append(opts.Session, ssh)
 
-	outputs, err := build.ParseOutputs(in.outputs)
+	outputs, err := buildflags.ParseOutputs(in.outputs)
 	if err != nil {
 		return err
 	}
@@ -175,19 +176,19 @@ func runBuild(dockerCli command.Cli, in buildOptions) error {
 
 	opts.Exports = outputs
 
-	cacheImports, err := build.ParseCacheEntry(in.cacheFrom)
+	cacheImports, err := buildflags.ParseCacheEntry(in.cacheFrom)
 	if err != nil {
 		return err
 	}
 	opts.CacheFrom = cacheImports
 
-	cacheExports, err := build.ParseCacheEntry(in.cacheTo)
+	cacheExports, err := buildflags.ParseCacheEntry(in.cacheTo)
 	if err != nil {
 		return err
 	}
 	opts.CacheTo = cacheExports
 
-	allow, err := build.ParseEntitlements(in.allow)
+	allow, err := buildflags.ParseEntitlements(in.allow)
 	if err != nil {
 		return err
 	}
diff --git a/build/cache.go b/util/buildflags/cache.go
similarity index 98%
rename from build/cache.go
rename to util/buildflags/cache.go
index 97a64b95..3e2105cd 100644
--- a/build/cache.go
+++ b/util/buildflags/cache.go
@@ -1,4 +1,4 @@
-package build
+package buildflags
 
 import (
 	"encoding/csv"
diff --git a/build/entitlements.go b/util/buildflags/entitlements.go
similarity index 96%
rename from build/entitlements.go
rename to util/buildflags/entitlements.go
index cbf24d48..a393e9a5 100644
--- a/build/entitlements.go
+++ b/util/buildflags/entitlements.go
@@ -1,4 +1,4 @@
-package build
+package buildflags
 
 import (
 	"github.com/moby/buildkit/util/entitlements"
diff --git a/build/output.go b/util/buildflags/output.go
similarity index 99%
rename from build/output.go
rename to util/buildflags/output.go
index b27db14c..b55be289 100644
--- a/build/output.go
+++ b/util/buildflags/output.go
@@ -1,4 +1,4 @@
-package build
+package buildflags
 
 import (
 	"encoding/csv"
diff --git a/build/secrets.go b/util/buildflags/secrets.go
similarity index 98%
rename from build/secrets.go
rename to util/buildflags/secrets.go
index ea4a71a1..390f1476 100644
--- a/build/secrets.go
+++ b/util/buildflags/secrets.go
@@ -1,4 +1,4 @@
-package build
+package buildflags
 
 import (
 	"encoding/csv"
diff --git a/build/ssh.go b/util/buildflags/ssh.go
similarity index 97%
rename from build/ssh.go
rename to util/buildflags/ssh.go
index 0eaeb0c1..bb9e1152 100644
--- a/build/ssh.go
+++ b/util/buildflags/ssh.go
@@ -1,4 +1,4 @@
-package build
+package buildflags
 
 import (
 	"strings"