Merge pull request #6255 from jsternberg/v0.25-picks-0.25.0

Author: jsternberg

Dockerfile

@@ -203,7 +203,7 @@ FROM scratch AS release
 COPY --link --from=releaser /out/ /
 
 FROM alpine:${ALPINE_VERSION} AS buildkit-export-alpine
-RUN apk add --no-cache fuse3 git openssh pigz xz iptables ip6tables \
+RUN apk add --no-cache fuse3 git openssh openssl pigz xz iptables ip6tables \
   && ln -s fusermount3 /usr/bin/fusermount
 COPY --link examples/buildctl-daemonless/buildctl-daemonless.sh /usr/bin/
 VOLUME /var/lib/buildkit
@@ -214,6 +214,7 @@ RUN apt-get update \
     fuse3 \
     git \
     openssh-client \
+    openssl \
     pigz \
     xz-utils \
     iptables \
@@ -411,7 +412,7 @@ COPY --link --from=binaries / /
 
 FROM buildkit-base AS integration-tests-base
 ENV BUILDKIT_INTEGRATION_ROOTLESS_IDPAIR="1000:1000"
-RUN apk add --no-cache shadow shadow-uidmap sudo vim iptables ip6tables dnsmasq fuse curl git-daemon openssh-client slirp4netns iproute2 \
+RUN apk add --no-cache shadow shadow-uidmap sudo vim iptables ip6tables dnsmasq fuse curl git-daemon openssh-client openssl slirp4netns iproute2 \
   && useradd --create-home --home-dir /home/user --uid 1000 -s /bin/sh user \
   && echo "XDG_RUNTIME_DIR=/run/user/1000; export XDG_RUNTIME_DIR" >> /home/user/.profile \
   && mkdir -m 0700 -p /run/user/1000 \
@@ -460,7 +461,7 @@ VOLUME /var/lib/buildkit
 
 # rootless builds a rootless variant of buildkitd image
 FROM alpine:${ALPINE_VERSION} AS rootless
-RUN apk add --no-cache fuse3 fuse-overlayfs git openssh pigz shadow-uidmap xz
+RUN apk add --no-cache fuse3 fuse-overlayfs git openssh openssl pigz shadow-uidmap xz
 RUN adduser -D -u 1000 user \
   && mkdir -p /run/user/1000 /home/user/.local/tmp /home/user/.local/share/buildkit \
   && chown -R user /run/user/1000 /home/user \

frontend/dockerfile/dockerfile_provenance_test.go

@@ -71,6 +71,8 @@ func testProvenanceAttestation(t *testing.T, sb integration.Sandbox) {
 	workers.CheckFeatureCompat(t, sb, workers.FeatureDirectPush, workers.FeatureProvenance)
 	ctx := sb.Context()
 
+	isDockerd := strings.HasPrefix(sb.Name(), "dockerd")
+
 	c, err := client.New(ctx, sb.Address())
 	require.NoError(t, err)
 	defer c.Close()
@@ -183,6 +185,9 @@ RUN echo ok> /foo
 					"foo":     "bar",
 					"numbers": []any{1.0, 2.0, 3.0},
 				}
+				if isDockerd {
+					expCustom = nil
+				}
 
 				if slsaVersion == "v1" {
 					type stmtT struct {

source/git/source.go

@@ -531,7 +531,11 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out
 			// local refs are needed so they would be advertised on next fetches. Force is used
 			// in case the ref is a branch and it now points to a different commit sha
 			// TODO: is there a better way to do this?
-			args = append(args, "--force", ref+":tags/"+ref)
+			targetRef := ref
+			if !strings.HasPrefix(ref, "refs/tags/") {
+				targetRef = "tags/" + ref
+			}
+			args = append(args, "--force", ref+":"+targetRef)
 		}
 		if _, err := git.Run(ctx, args...); err != nil {
 			return nil, errors.Wrapf(err, "failed to fetch remote %s", urlutil.RedactCredentials(gs.src.Remote))
@@ -615,7 +619,11 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out
 
 		pullref := ref
 		if isAnnotatedTag {
-			pullref += ":refs/tags/" + pullref
+			targetRef := pullref
+			if !strings.HasPrefix(pullref, "refs/tags/") {
+				targetRef = "refs/tags/" + pullref
+			}
+			pullref += ":" + targetRef
 		} else if gitutil.IsCommitSHA(ref) {
 			pullref = "refs/buildkit/" + identity.NewID()
 			_, err = git.Run(ctx, "update-ref", pullref, ref)

source/git/source_test.go

@@ -639,6 +639,70 @@ func testFetchByTag(t *testing.T, tag, expectedCommitSubject string, isAnnotated
 		require.Contains(t, strings.TrimSpace(string(gitLogOutput)), expectedCommitSubject)
 	}
 }
+func TestFetchAnnotatedTagAfterCloneSHA1(t *testing.T) {
+	testFetchAnnotatedTagAfterClone(t, "sha1")
+}
+
+func TestFetchAnnotatedTagAfterCloneSHA256(t *testing.T) {
+	testFetchAnnotatedTagAfterClone(t, "sha256")
+}
+
+func testFetchAnnotatedTagAfterClone(t *testing.T, format string) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
+	}
+
+	t.Parallel()
+	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
+	ctx = logProgressStreams(ctx, t)
+
+	repo := setupGitRepo(t, format)
+	cmd := exec.Command("git", "rev-parse", "HEAD")
+	cmd.Dir = repo.mainPath
+
+	out, err := cmd.Output()
+	require.NoError(t, err)
+
+	expLen := 40
+	if format == "sha256" {
+		expLen = 64
+	}
+	sha := strings.TrimSpace(string(out))
+	require.Equal(t, expLen, len(sha))
+
+	gs := setupGitSource(t, t.TempDir())
+
+	id := &GitIdentifier{Remote: repo.mainURL, Ref: sha, KeepGitDir: true}
+
+	g, err := gs.Resolve(ctx, id, nil, nil)
+	require.NoError(t, err)
+
+	key1, pin1, _, done, err := g.CacheKey(ctx, nil, 0)
+	require.NoError(t, err)
+	require.True(t, done)
+
+	require.GreaterOrEqual(t, len(key1), expLen+4)
+	require.Equal(t, expLen, len(pin1))
+
+	ref, err := g.Snapshot(ctx, nil)
+	require.NoError(t, err)
+	ref.Release(context.TODO())
+
+	id = &GitIdentifier{Remote: repo.mainURL, Ref: "refs/tags/v1.2.3", KeepGitDir: true}
+	g, err = gs.Resolve(ctx, id, nil, nil)
+	require.NoError(t, err)
+
+	key1, pin1, _, done, err = g.CacheKey(ctx, nil, 0)
+	require.NoError(t, err)
+	require.True(t, done)
+
+	require.GreaterOrEqual(t, len(key1), expLen+4)
+	require.Equal(t, expLen, len(pin1))
+
+	ref, err = g.Snapshot(ctx, nil)
+	require.NoError(t, err)
+	ref.Release(context.TODO())
+}
 
 func TestMultipleTagAccessKeepGitDirSHA1(t *testing.T) {
 	testMultipleTagAccess(t, true, "sha1")

util/grpcerrors/grpcerrors.go

@@ -142,10 +142,20 @@ func Code(err error) codes.Code {
 	}
 
 	if wrapped, ok := err.(multiUnwrapper); ok {
+		var hasUnknown bool
+
 		for _, err := range wrapped.Unwrap() {
-			if c := Code(err); c != codes.OK && c != codes.Unknown {
+			c := Code(err)
+			if c != codes.OK && c != codes.Unknown {
 				return c
 			}
+			if c == codes.Unknown {
+				hasUnknown = true
+			}
+		}
+
+		if hasUnknown {
+			return codes.Unknown
 		}
 	}
 
@@ -159,7 +169,7 @@ func WrapCode(err error, code codes.Code) error {
 // AsGRPCStatus tries to extract a gRPC status from the error.
 // Supports  `Unwrap() error` and `Unwrap() []error` for wrapped errors.
 // When the `Unwrap() []error` returns multiple errors, the first one that
-// contains a gRPC status is returned.
+// contains a gRPC status that is not OK is returned with the full error message.
 func AsGRPCStatus(err error) (*status.Status, bool) {
 	if err == nil {
 		return nil, true
@@ -178,8 +188,17 @@ func AsGRPCStatus(err error) (*status.Status, bool) {
 
 	if wrapped, ok := err.(multiUnwrapper); ok {
 		for _, err := range wrapped.Unwrap() {
-			if st, ok := AsGRPCStatus(err); ok && st != nil {
-				return st, true
+			st, ok := AsGRPCStatus(err)
+			if !ok {
+				continue
+			}
+
+			if st != nil && st.Code() != codes.OK {
+				// Copy the full status so we can set the full error message
+				// Does the proto conversion so can keep any extra details.
+				proto := st.Proto()
+				proto.Message = err.Error()
+				return status.FromProto(proto), true
 			}
 		}
 	}