diff --git a/client/client_test.go b/client/client_test.go
index 8dc0ef0cb706..7a3d6d5b4ce1 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -65,6 +65,7 @@ import (
 	"github.com/moby/buildkit/util/attestation"
 	"github.com/moby/buildkit/util/contentutil"
 	"github.com/moby/buildkit/util/entitlements"
+	"github.com/moby/buildkit/util/gitutil/gitobject"
 	"github.com/moby/buildkit/util/testutil"
 	containerdutil "github.com/moby/buildkit/util/testutil/containerd"
 	"github.com/moby/buildkit/util/testutil/echoserver"
@@ -11987,12 +11988,12 @@ func testGitResolveSourceMetadata(t *testing.T, sb integration.Sandbox) {
 	gitDir := t.TempDir()
 	gitCommands := []string{
 		"git init",
-		"git config --local user.email test",
+		"git config --local user.email test@example.com",
 		"git config --local user.name test",
 		"touch a",
 		"git add a",
-		"git commit -m a",
-		"git tag -a v0.1 -m v0.1",
+		"git commit -m msg",
+		"git tag -a v0.1 -m v0.1release",
 		"echo b > b",
 		"git add b",
 		"git commit -m b",
@@ -12040,6 +12041,8 @@ func testGitResolveSourceMetadata(t *testing.T, sb integration.Sandbox) {
 		require.Equal(t, "", md.Git.CommitChecksum) // not annotated tag
 		require.Equal(t, id, md.Op.Identifier)
 		require.Equal(t, server.URL+"/.git", md.Op.Attrs["git.fullurl"])
+		require.Nil(t, md.Git.CommitObject)
+		require.Nil(t, md.Git.TagObject)
 
 		id += "#v0.1"
 		md, err = c.ResolveSourceMetadata(ctx, &pb.SourceOp{
@@ -12058,7 +12061,60 @@ func testGitResolveSourceMetadata(t *testing.T, sb integration.Sandbox) {
 
 		require.Equal(t, id, md.Op.Identifier)
 		require.Equal(t, server.URL+"/.git", md.Op.Attrs["git.fullurl"])
+		require.Nil(t, md.Git.CommitObject)
+		require.Nil(t, md.Git.TagObject)
+
+		md, err = c.ResolveSourceMetadata(ctx, &pb.SourceOp{
+			Identifier: id,
+			Attrs: map[string]string{
+				"git.fullurl": server.URL + "/.git",
+			},
+		}, sourceresolver.Opt{
+			GitOpt: &sourceresolver.ResolveGitOpt{
+				ReturnObject: true,
+			},
+		})
+		if err != nil {
+			return nil, err
+		}
+		require.NotNil(t, md.Git)
+		require.Equal(t, "refs/tags/v0.1", md.Git.Ref)
+		require.Equal(t, commitTag, md.Git.Checksum) // annotated tag
+		require.Equal(t, commitTagCommit, md.Git.CommitChecksum)
+
+		require.Equal(t, id, md.Op.Identifier)
+		require.Equal(t, server.URL+"/.git", md.Op.Attrs["git.fullurl"])
+		require.NotNil(t, md.Git.CommitObject)
+		require.NotNil(t, md.Git.TagObject)
 
+		commitObj, err := gitobject.Parse(md.Git.CommitObject)
+		require.NoError(t, err)
+		require.NoError(t, commitObj.VerifyChecksum(md.Git.CommitChecksum))
+
+		commit, err := commitObj.ToCommit()
+		require.NoError(t, err)
+		require.Equal(t, "msg\n", commit.Message)
+		require.Equal(t, "test", commit.Author.Name)
+		require.Equal(t, "test@example.com", commit.Author.Email)
+		require.Equal(t, "test", commit.Committer.Name)
+		require.Equal(t, "test@example.com", commit.Committer.Email)
+		commitTime := commit.Committer.When
+		require.NotNil(t, commitTime)
+		require.WithinDuration(t, time.Now(), *commitTime, 2*time.Minute)
+
+		tagObj, err := gitobject.Parse(md.Git.TagObject)
+		require.NoError(t, err)
+		require.NoError(t, tagObj.VerifyChecksum(md.Git.Checksum))
+
+		tag, err := tagObj.ToTag()
+		require.NoError(t, err)
+		require.Equal(t, "v0.1release\n", tag.Message)
+		require.Equal(t, "v0.1", tag.Tag)
+		require.Equal(t, "test", tag.Tagger.Name)
+		require.Equal(t, "test@example.com", tag.Tagger.Email)
+		tagTime := tag.Tagger.When
+		require.NotNil(t, tagTime)
+		require.WithinDuration(t, time.Now(), *tagTime, 2*time.Minute)
 		return nil, nil
 	}, nil)
 	require.NoError(t, err)
@@ -12439,12 +12495,6 @@ func testGitResolveMutatedSource(t *testing.T, sb integration.Sandbox) {
 	err = runInDir(gitDir, gitCommands...)
 	require.NoError(t, err)
 
-	// cmd := exec.Command("git", "rev-parse", "HEAD")
-	// cmd.Dir = gitDir
-	// out, err := cmd.Output()
-	// require.NoError(t, err)
-	// commitHEAD := strings.TrimSpace(string(out))
-
 	cmd := exec.Command("git", "rev-parse", "v0.1")
 	cmd.Dir = gitDir
 	out, err := cmd.Output()
diff --git a/client/llb/sourceresolver/types.go b/client/llb/sourceresolver/types.go
index 9be1dd994604..bcdcf17197b7 100644
--- a/client/llb/sourceresolver/types.go
+++ b/client/llb/sourceresolver/types.go
@@ -28,6 +28,7 @@ type Opt struct {
 
 	ImageOpt     *ResolveImageOpt
 	OCILayoutOpt *ResolveOCILayoutOpt
+	GitOpt       *ResolveGitOpt
 }
 
 type MetaResponse struct {
@@ -47,10 +48,16 @@ type ResolveImageResponse struct {
 	Config []byte
 }
 
+type ResolveGitOpt struct {
+	ReturnObject bool
+}
+
 type ResolveGitResponse struct {
 	Checksum       string
 	Ref            string
 	CommitChecksum string
+	CommitObject   []byte
+	TagObject      []byte
 }
 
 type ResolveHTTPResponse struct {
diff --git a/frontend/gateway/gateway.go b/frontend/gateway/gateway.go
index 0c2157c8fefa..d58cf444c993 100644
--- a/frontend/gateway/gateway.go
+++ b/frontend/gateway/gateway.go
@@ -636,6 +636,12 @@ func (lbf *llbBridgeForwarder) ResolveSourceMeta(ctx context.Context, req *pb.Re
 	resolveopt.ImageOpt = &sourceresolver.ResolveImageOpt{
 		ResolveMode: req.ResolveMode,
 	}
+	if req.Git != nil {
+		resolveopt.GitOpt = &sourceresolver.ResolveGitOpt{
+			ReturnObject: req.Git.ReturnObject,
+		}
+	}
+
 	resp, err := lbf.llbBridge.ResolveSourceMetadata(ctx, req.Source, resolveopt)
 	if err != nil {
 		return nil, err
@@ -656,6 +662,8 @@ func (lbf *llbBridgeForwarder) ResolveSourceMeta(ctx context.Context, req *pb.Re
 			Checksum:       resp.Git.Checksum,
 			Ref:            resp.Git.Ref,
 			CommitChecksum: resp.Git.CommitChecksum,
+			CommitObject:   resp.Git.CommitObject,
+			TagObject:      resp.Git.TagObject,
 		}
 	}
 	if resp.HTTP != nil {
diff --git a/frontend/gateway/grpcclient/client.go b/frontend/gateway/grpcclient/client.go
index d4bdd88650f4..bd77b7929b6e 100644
--- a/frontend/gateway/grpcclient/client.go
+++ b/frontend/gateway/grpcclient/client.go
@@ -514,6 +514,12 @@ func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.Source
 		LogName:        opt.LogName,
 		SourcePolicies: opt.SourcePolicies,
 	}
+	if opt.GitOpt != nil {
+		req.Git = &pb.ResolveSourceGitRequest{
+			ReturnObject: opt.GitOpt.ReturnObject,
+		}
+	}
+
 	resp, err := c.client.ResolveSourceMeta(ctx, req)
 	if err != nil {
 		return nil, err
@@ -533,6 +539,8 @@ func (c *grpcClient) ResolveSourceMetadata(ctx context.Context, op *opspb.Source
 			Checksum:       resp.Git.Checksum,
 			Ref:            resp.Git.Ref,
 			CommitChecksum: resp.Git.CommitChecksum,
+			CommitObject:   resp.Git.CommitObject,
+			TagObject:      resp.Git.TagObject,
 		}
 	}
 	if resp.HTTP != nil {
diff --git a/frontend/gateway/pb/gateway.pb.go b/frontend/gateway/pb/gateway.pb.go
index 710aca2d569f..87fb9133bb40 100644
--- a/frontend/gateway/pb/gateway.pb.go
+++ b/frontend/gateway/pb/gateway.pb.go
@@ -909,12 +909,13 @@ func (x *ResolveImageConfigResponse) GetRef() string {
 }
 
 type ResolveSourceMetaRequest struct {
-	state          protoimpl.MessageState `protogen:"open.v1"`
-	Source         *pb.SourceOp           `protobuf:"bytes,1,opt,name=Source,proto3" json:"Source,omitempty"`
-	Platform       *pb.Platform           `protobuf:"bytes,2,opt,name=Platform,proto3" json:"Platform,omitempty"`
-	LogName        string                 `protobuf:"bytes,3,opt,name=LogName,proto3" json:"LogName,omitempty"`
-	ResolveMode    string                 `protobuf:"bytes,4,opt,name=ResolveMode,proto3" json:"ResolveMode,omitempty"`
-	SourcePolicies []*pb1.Policy          `protobuf:"bytes,8,rep,name=SourcePolicies,proto3" json:"SourcePolicies,omitempty"`
+	state          protoimpl.MessageState   `protogen:"open.v1"`
+	Source         *pb.SourceOp             `protobuf:"bytes,1,opt,name=Source,proto3" json:"Source,omitempty"`
+	Platform       *pb.Platform             `protobuf:"bytes,2,opt,name=Platform,proto3" json:"Platform,omitempty"`
+	LogName        string                   `protobuf:"bytes,3,opt,name=LogName,proto3" json:"LogName,omitempty"`
+	ResolveMode    string                   `protobuf:"bytes,4,opt,name=ResolveMode,proto3" json:"ResolveMode,omitempty"`
+	SourcePolicies []*pb1.Policy            `protobuf:"bytes,8,rep,name=SourcePolicies,proto3" json:"SourcePolicies,omitempty"`
+	Git            *ResolveSourceGitRequest `protobuf:"bytes,5,opt,name=Git,proto3" json:"Git,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -984,6 +985,13 @@ func (x *ResolveSourceMetaRequest) GetSourcePolicies() []*pb1.Policy {
 	return nil
 }
 
+func (x *ResolveSourceMetaRequest) GetGit() *ResolveSourceGitRequest {
+	if x != nil {
+		return x.Git
+	}
+	return nil
+}
+
 type ResolveSourceMetaResponse struct {
 	state         protoimpl.MessageState      `protogen:"open.v1"`
 	Source        *pb.SourceOp                `protobuf:"bytes,1,opt,name=Source,proto3" json:"Source,omitempty"`
@@ -1104,18 +1112,65 @@ func (x *ResolveSourceImageResponse) GetConfig() []byte {
 	return nil
 }
 
+type ResolveSourceGitRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Return full commit and tag object bytes.
+	ReturnObject  bool `protobuf:"varint,1,opt,name=ReturnObject,proto3" json:"ReturnObject,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResolveSourceGitRequest) Reset() {
+	*x = ResolveSourceGitRequest{}
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResolveSourceGitRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveSourceGitRequest) ProtoMessage() {}
+
+func (x *ResolveSourceGitRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveSourceGitRequest.ProtoReflect.Descriptor instead.
+func (*ResolveSourceGitRequest) Descriptor() ([]byte, []int) {
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *ResolveSourceGitRequest) GetReturnObject() bool {
+	if x != nil {
+		return x.ReturnObject
+	}
+	return false
+}
+
 type ResolveSourceGitResponse struct {
 	state          protoimpl.MessageState `protogen:"open.v1"`
 	Checksum       string                 `protobuf:"bytes,1,opt,name=Checksum,proto3" json:"Checksum,omitempty"`
 	Ref            string                 `protobuf:"bytes,2,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	CommitChecksum string                 `protobuf:"bytes,3,opt,name=CommitChecksum,proto3" json:"CommitChecksum,omitempty"`
+	CommitObject   []byte                 `protobuf:"bytes,4,opt,name=CommitObject,proto3" json:"CommitObject,omitempty"`
+	TagObject      []byte                 `protobuf:"bytes,5,opt,name=TagObject,proto3" json:"TagObject,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
 
 func (x *ResolveSourceGitResponse) Reset() {
 	*x = ResolveSourceGitResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[16]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1127,7 +1182,7 @@ func (x *ResolveSourceGitResponse) String() string {
 func (*ResolveSourceGitResponse) ProtoMessage() {}
 
 func (x *ResolveSourceGitResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[16]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1140,7 +1195,7 @@ func (x *ResolveSourceGitResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResolveSourceGitResponse.ProtoReflect.Descriptor instead.
 func (*ResolveSourceGitResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{16}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{17}
 }
 
 func (x *ResolveSourceGitResponse) GetChecksum() string {
@@ -1164,6 +1219,20 @@ func (x *ResolveSourceGitResponse) GetCommitChecksum() string {
 	return ""
 }
 
+func (x *ResolveSourceGitResponse) GetCommitObject() []byte {
+	if x != nil {
+		return x.CommitObject
+	}
+	return nil
+}
+
+func (x *ResolveSourceGitResponse) GetTagObject() []byte {
+	if x != nil {
+		return x.TagObject
+	}
+	return nil
+}
+
 type ResolveSourceHTTPResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Checksum      string                 `protobuf:"bytes,1,opt,name=Checksum,proto3" json:"Checksum,omitempty"`
@@ -1175,7 +1244,7 @@ type ResolveSourceHTTPResponse struct {
 
 func (x *ResolveSourceHTTPResponse) Reset() {
 	*x = ResolveSourceHTTPResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[17]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1187,7 +1256,7 @@ func (x *ResolveSourceHTTPResponse) String() string {
 func (*ResolveSourceHTTPResponse) ProtoMessage() {}
 
 func (x *ResolveSourceHTTPResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[17]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1200,7 +1269,7 @@ func (x *ResolveSourceHTTPResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResolveSourceHTTPResponse.ProtoReflect.Descriptor instead.
 func (*ResolveSourceHTTPResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{17}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *ResolveSourceHTTPResponse) GetChecksum() string {
@@ -1248,7 +1317,7 @@ type SolveRequest struct {
 
 func (x *SolveRequest) Reset() {
 	*x = SolveRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[18]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1260,7 +1329,7 @@ func (x *SolveRequest) String() string {
 func (*SolveRequest) ProtoMessage() {}
 
 func (x *SolveRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[18]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1273,7 +1342,7 @@ func (x *SolveRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SolveRequest.ProtoReflect.Descriptor instead.
 func (*SolveRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{18}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *SolveRequest) GetDefinition() *pb.Definition {
@@ -1364,7 +1433,7 @@ type CacheOptionsEntry struct {
 
 func (x *CacheOptionsEntry) Reset() {
 	*x = CacheOptionsEntry{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[19]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1376,7 +1445,7 @@ func (x *CacheOptionsEntry) String() string {
 func (*CacheOptionsEntry) ProtoMessage() {}
 
 func (x *CacheOptionsEntry) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[19]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1389,7 +1458,7 @@ func (x *CacheOptionsEntry) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CacheOptionsEntry.ProtoReflect.Descriptor instead.
 func (*CacheOptionsEntry) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{19}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *CacheOptionsEntry) GetType() string {
@@ -1418,7 +1487,7 @@ type SolveResponse struct {
 
 func (x *SolveResponse) Reset() {
 	*x = SolveResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[20]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1430,7 +1499,7 @@ func (x *SolveResponse) String() string {
 func (*SolveResponse) ProtoMessage() {}
 
 func (x *SolveResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[20]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1443,7 +1512,7 @@ func (x *SolveResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SolveResponse.ProtoReflect.Descriptor instead.
 func (*SolveResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{20}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *SolveResponse) GetRef() string {
@@ -1471,7 +1540,7 @@ type ReadFileRequest struct {
 
 func (x *ReadFileRequest) Reset() {
 	*x = ReadFileRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[21]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1483,7 +1552,7 @@ func (x *ReadFileRequest) String() string {
 func (*ReadFileRequest) ProtoMessage() {}
 
 func (x *ReadFileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[21]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1496,7 +1565,7 @@ func (x *ReadFileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadFileRequest.ProtoReflect.Descriptor instead.
 func (*ReadFileRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{21}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *ReadFileRequest) GetRef() string {
@@ -1530,7 +1599,7 @@ type FileRange struct {
 
 func (x *FileRange) Reset() {
 	*x = FileRange{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[22]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1542,7 +1611,7 @@ func (x *FileRange) String() string {
 func (*FileRange) ProtoMessage() {}
 
 func (x *FileRange) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[22]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1555,7 +1624,7 @@ func (x *FileRange) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FileRange.ProtoReflect.Descriptor instead.
 func (*FileRange) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{22}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *FileRange) GetOffset() int64 {
@@ -1581,7 +1650,7 @@ type ReadFileResponse struct {
 
 func (x *ReadFileResponse) Reset() {
 	*x = ReadFileResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[23]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1593,7 +1662,7 @@ func (x *ReadFileResponse) String() string {
 func (*ReadFileResponse) ProtoMessage() {}
 
 func (x *ReadFileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[23]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1606,7 +1675,7 @@ func (x *ReadFileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadFileResponse.ProtoReflect.Descriptor instead.
 func (*ReadFileResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{23}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *ReadFileResponse) GetData() []byte {
@@ -1627,7 +1696,7 @@ type ReadDirRequest struct {
 
 func (x *ReadDirRequest) Reset() {
 	*x = ReadDirRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[24]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1639,7 +1708,7 @@ func (x *ReadDirRequest) String() string {
 func (*ReadDirRequest) ProtoMessage() {}
 
 func (x *ReadDirRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[24]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1652,7 +1721,7 @@ func (x *ReadDirRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDirRequest.ProtoReflect.Descriptor instead.
 func (*ReadDirRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{24}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *ReadDirRequest) GetRef() string {
@@ -1685,7 +1754,7 @@ type ReadDirResponse struct {
 
 func (x *ReadDirResponse) Reset() {
 	*x = ReadDirResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[25]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1697,7 +1766,7 @@ func (x *ReadDirResponse) String() string {
 func (*ReadDirResponse) ProtoMessage() {}
 
 func (x *ReadDirResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[25]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1710,7 +1779,7 @@ func (x *ReadDirResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReadDirResponse.ProtoReflect.Descriptor instead.
 func (*ReadDirResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{25}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *ReadDirResponse) GetEntries() []*types.Stat {
@@ -1730,7 +1799,7 @@ type StatFileRequest struct {
 
 func (x *StatFileRequest) Reset() {
 	*x = StatFileRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[26]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1742,7 +1811,7 @@ func (x *StatFileRequest) String() string {
 func (*StatFileRequest) ProtoMessage() {}
 
 func (x *StatFileRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[26]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1755,7 +1824,7 @@ func (x *StatFileRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatFileRequest.ProtoReflect.Descriptor instead.
 func (*StatFileRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{26}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *StatFileRequest) GetRef() string {
@@ -1781,7 +1850,7 @@ type StatFileResponse struct {
 
 func (x *StatFileResponse) Reset() {
 	*x = StatFileResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[27]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1793,7 +1862,7 @@ func (x *StatFileResponse) String() string {
 func (*StatFileResponse) ProtoMessage() {}
 
 func (x *StatFileResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[27]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1806,7 +1875,7 @@ func (x *StatFileResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StatFileResponse.ProtoReflect.Descriptor instead.
 func (*StatFileResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{27}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *StatFileResponse) GetStat() *types.Stat {
@@ -1825,7 +1894,7 @@ type EvaluateRequest struct {
 
 func (x *EvaluateRequest) Reset() {
 	*x = EvaluateRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[28]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1837,7 +1906,7 @@ func (x *EvaluateRequest) String() string {
 func (*EvaluateRequest) ProtoMessage() {}
 
 func (x *EvaluateRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[28]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1850,7 +1919,7 @@ func (x *EvaluateRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EvaluateRequest.ProtoReflect.Descriptor instead.
 func (*EvaluateRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{28}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *EvaluateRequest) GetRef() string {
@@ -1868,7 +1937,7 @@ type EvaluateResponse struct {
 
 func (x *EvaluateResponse) Reset() {
 	*x = EvaluateResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[29]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1880,7 +1949,7 @@ func (x *EvaluateResponse) String() string {
 func (*EvaluateResponse) ProtoMessage() {}
 
 func (x *EvaluateResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[29]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1893,7 +1962,7 @@ func (x *EvaluateResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use EvaluateResponse.ProtoReflect.Descriptor instead.
 func (*EvaluateResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{29}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{30}
 }
 
 type PingRequest struct {
@@ -1904,7 +1973,7 @@ type PingRequest struct {
 
 func (x *PingRequest) Reset() {
 	*x = PingRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[30]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[31]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1916,7 +1985,7 @@ func (x *PingRequest) String() string {
 func (*PingRequest) ProtoMessage() {}
 
 func (x *PingRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[30]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[31]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1929,7 +1998,7 @@ func (x *PingRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PingRequest.ProtoReflect.Descriptor instead.
 func (*PingRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{30}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{31}
 }
 
 type PongResponse struct {
@@ -1943,7 +2012,7 @@ type PongResponse struct {
 
 func (x *PongResponse) Reset() {
 	*x = PongResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[31]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[32]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1955,7 +2024,7 @@ func (x *PongResponse) String() string {
 func (*PongResponse) ProtoMessage() {}
 
 func (x *PongResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[31]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[32]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1968,7 +2037,7 @@ func (x *PongResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PongResponse.ProtoReflect.Descriptor instead.
 func (*PongResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{31}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{32}
 }
 
 func (x *PongResponse) GetFrontendAPICaps() []*pb2.APICap {
@@ -2007,7 +2076,7 @@ type WarnRequest struct {
 
 func (x *WarnRequest) Reset() {
 	*x = WarnRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[32]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[33]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2019,7 +2088,7 @@ func (x *WarnRequest) String() string {
 func (*WarnRequest) ProtoMessage() {}
 
 func (x *WarnRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[32]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[33]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2032,7 +2101,7 @@ func (x *WarnRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WarnRequest.ProtoReflect.Descriptor instead.
 func (*WarnRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{32}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{33}
 }
 
 func (x *WarnRequest) GetDigest() string {
@@ -2092,7 +2161,7 @@ type WarnResponse struct {
 
 func (x *WarnResponse) Reset() {
 	*x = WarnResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[33]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[34]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2104,7 +2173,7 @@ func (x *WarnResponse) String() string {
 func (*WarnResponse) ProtoMessage() {}
 
 func (x *WarnResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[33]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[34]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2117,7 +2186,7 @@ func (x *WarnResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WarnResponse.ProtoReflect.Descriptor instead.
 func (*WarnResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{33}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{34}
 }
 
 type NewContainerRequest struct {
@@ -2136,7 +2205,7 @@ type NewContainerRequest struct {
 
 func (x *NewContainerRequest) Reset() {
 	*x = NewContainerRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[34]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2148,7 +2217,7 @@ func (x *NewContainerRequest) String() string {
 func (*NewContainerRequest) ProtoMessage() {}
 
 func (x *NewContainerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[34]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2161,7 +2230,7 @@ func (x *NewContainerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NewContainerRequest.ProtoReflect.Descriptor instead.
 func (*NewContainerRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{34}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{35}
 }
 
 func (x *NewContainerRequest) GetContainerID() string {
@@ -2221,7 +2290,7 @@ type NewContainerResponse struct {
 
 func (x *NewContainerResponse) Reset() {
 	*x = NewContainerResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[35]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2233,7 +2302,7 @@ func (x *NewContainerResponse) String() string {
 func (*NewContainerResponse) ProtoMessage() {}
 
 func (x *NewContainerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[35]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2246,7 +2315,7 @@ func (x *NewContainerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use NewContainerResponse.ProtoReflect.Descriptor instead.
 func (*NewContainerResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{35}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{36}
 }
 
 type ReleaseContainerRequest struct {
@@ -2258,7 +2327,7 @@ type ReleaseContainerRequest struct {
 
 func (x *ReleaseContainerRequest) Reset() {
 	*x = ReleaseContainerRequest{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[36]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[37]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2270,7 +2339,7 @@ func (x *ReleaseContainerRequest) String() string {
 func (*ReleaseContainerRequest) ProtoMessage() {}
 
 func (x *ReleaseContainerRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[36]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[37]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2283,7 +2352,7 @@ func (x *ReleaseContainerRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseContainerRequest.ProtoReflect.Descriptor instead.
 func (*ReleaseContainerRequest) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{36}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{37}
 }
 
 func (x *ReleaseContainerRequest) GetContainerID() string {
@@ -2301,7 +2370,7 @@ type ReleaseContainerResponse struct {
 
 func (x *ReleaseContainerResponse) Reset() {
 	*x = ReleaseContainerResponse{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[37]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[38]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2313,7 +2382,7 @@ func (x *ReleaseContainerResponse) String() string {
 func (*ReleaseContainerResponse) ProtoMessage() {}
 
 func (x *ReleaseContainerResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[37]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[38]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2326,7 +2395,7 @@ func (x *ReleaseContainerResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReleaseContainerResponse.ProtoReflect.Descriptor instead.
 func (*ReleaseContainerResponse) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{37}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{38}
 }
 
 type ExecMessage struct {
@@ -2348,7 +2417,7 @@ type ExecMessage struct {
 
 func (x *ExecMessage) Reset() {
 	*x = ExecMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[38]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[39]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2360,7 +2429,7 @@ func (x *ExecMessage) String() string {
 func (*ExecMessage) ProtoMessage() {}
 
 func (x *ExecMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[38]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[39]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2373,7 +2442,7 @@ func (x *ExecMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExecMessage.ProtoReflect.Descriptor instead.
 func (*ExecMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{38}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{39}
 }
 
 func (x *ExecMessage) GetProcessID() string {
@@ -2525,7 +2594,7 @@ type InitMessage struct {
 
 func (x *InitMessage) Reset() {
 	*x = InitMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[39]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[40]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2537,7 +2606,7 @@ func (x *InitMessage) String() string {
 func (*InitMessage) ProtoMessage() {}
 
 func (x *InitMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[39]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[40]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2550,7 +2619,7 @@ func (x *InitMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use InitMessage.ProtoReflect.Descriptor instead.
 func (*InitMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{39}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{40}
 }
 
 func (x *InitMessage) GetContainerID() string {
@@ -2605,7 +2674,7 @@ type ExitMessage struct {
 
 func (x *ExitMessage) Reset() {
 	*x = ExitMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[40]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[41]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2617,7 +2686,7 @@ func (x *ExitMessage) String() string {
 func (*ExitMessage) ProtoMessage() {}
 
 func (x *ExitMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[40]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[41]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2630,7 +2699,7 @@ func (x *ExitMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ExitMessage.ProtoReflect.Descriptor instead.
 func (*ExitMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{40}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{41}
 }
 
 func (x *ExitMessage) GetCode() uint32 {
@@ -2655,7 +2724,7 @@ type StartedMessage struct {
 
 func (x *StartedMessage) Reset() {
 	*x = StartedMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[41]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[42]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2667,7 +2736,7 @@ func (x *StartedMessage) String() string {
 func (*StartedMessage) ProtoMessage() {}
 
 func (x *StartedMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[41]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[42]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2680,7 +2749,7 @@ func (x *StartedMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StartedMessage.ProtoReflect.Descriptor instead.
 func (*StartedMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{41}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{42}
 }
 
 type DoneMessage struct {
@@ -2691,7 +2760,7 @@ type DoneMessage struct {
 
 func (x *DoneMessage) Reset() {
 	*x = DoneMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[42]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[43]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2703,7 +2772,7 @@ func (x *DoneMessage) String() string {
 func (*DoneMessage) ProtoMessage() {}
 
 func (x *DoneMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[42]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[43]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2716,7 +2785,7 @@ func (x *DoneMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use DoneMessage.ProtoReflect.Descriptor instead.
 func (*DoneMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{42}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{43}
 }
 
 type FdMessage struct {
@@ -2730,7 +2799,7 @@ type FdMessage struct {
 
 func (x *FdMessage) Reset() {
 	*x = FdMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[43]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[44]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2742,7 +2811,7 @@ func (x *FdMessage) String() string {
 func (*FdMessage) ProtoMessage() {}
 
 func (x *FdMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[43]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[44]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2755,7 +2824,7 @@ func (x *FdMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use FdMessage.ProtoReflect.Descriptor instead.
 func (*FdMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{43}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{44}
 }
 
 func (x *FdMessage) GetFd() uint32 {
@@ -2789,7 +2858,7 @@ type ResizeMessage struct {
 
 func (x *ResizeMessage) Reset() {
 	*x = ResizeMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[44]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[45]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2801,7 +2870,7 @@ func (x *ResizeMessage) String() string {
 func (*ResizeMessage) ProtoMessage() {}
 
 func (x *ResizeMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[44]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[45]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2814,7 +2883,7 @@ func (x *ResizeMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ResizeMessage.ProtoReflect.Descriptor instead.
 func (*ResizeMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{44}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{45}
 }
 
 func (x *ResizeMessage) GetRows() uint32 {
@@ -2842,7 +2911,7 @@ type SignalMessage struct {
 
 func (x *SignalMessage) Reset() {
 	*x = SignalMessage{}
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[45]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[46]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2854,7 +2923,7 @@ func (x *SignalMessage) String() string {
 func (*SignalMessage) ProtoMessage() {}
 
 func (x *SignalMessage) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[45]
+	mi := &file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[46]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2867,7 +2936,7 @@ func (x *SignalMessage) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use SignalMessage.ProtoReflect.Descriptor instead.
 func (*SignalMessage) Descriptor() ([]byte, []int) {
-	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{45}
+	return file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP(), []int{46}
 }
 
 func (x *SignalMessage) GetName() string {
@@ -2948,13 +3017,14 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x1aResolveImageConfigResponse\x12\x16\n" +
 	"\x06Digest\x18\x01 \x01(\tR\x06Digest\x12\x16\n" +
 	"\x06Config\x18\x02 \x01(\fR\x06Config\x12\x10\n" +
-	"\x03Ref\x18\x03 \x01(\tR\x03Ref\"\xf5\x01\n" +
+	"\x03Ref\x18\x03 \x01(\tR\x03Ref\"\xbb\x02\n" +
 	"\x18ResolveSourceMetaRequest\x12$\n" +
 	"\x06Source\x18\x01 \x01(\v2\f.pb.SourceOpR\x06Source\x12(\n" +
 	"\bPlatform\x18\x02 \x01(\v2\f.pb.PlatformR\bPlatform\x12\x18\n" +
 	"\aLogName\x18\x03 \x01(\tR\aLogName\x12 \n" +
 	"\vResolveMode\x18\x04 \x01(\tR\vResolveMode\x12M\n" +
-	"\x0eSourcePolicies\x18\b \x03(\v2%.moby.buildkit.v1.sourcepolicy.PolicyR\x0eSourcePolicies\"\x9f\x02\n" +
+	"\x0eSourcePolicies\x18\b \x03(\v2%.moby.buildkit.v1.sourcepolicy.PolicyR\x0eSourcePolicies\x12D\n" +
+	"\x03Git\x18\x05 \x01(\v22.moby.buildkit.v1.frontend.ResolveSourceGitRequestR\x03Git\"\x9f\x02\n" +
 	"\x19ResolveSourceMetaResponse\x12$\n" +
 	"\x06Source\x18\x01 \x01(\v2\f.pb.SourceOpR\x06Source\x12K\n" +
 	"\x05Image\x18\x02 \x01(\v25.moby.buildkit.v1.frontend.ResolveSourceImageResponseR\x05Image\x12E\n" +
@@ -2962,11 +3032,15 @@ const file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc =
 	"\x04HTTP\x18\x04 \x01(\v24.moby.buildkit.v1.frontend.ResolveSourceHTTPResponseR\x04HTTP\"L\n" +
 	"\x1aResolveSourceImageResponse\x12\x16\n" +
 	"\x06Digest\x18\x01 \x01(\tR\x06Digest\x12\x16\n" +
-	"\x06Config\x18\x02 \x01(\fR\x06Config\"p\n" +
+	"\x06Config\x18\x02 \x01(\fR\x06Config\"=\n" +
+	"\x17ResolveSourceGitRequest\x12\"\n" +
+	"\fReturnObject\x18\x01 \x01(\bR\fReturnObject\"\xb2\x01\n" +
 	"\x18ResolveSourceGitResponse\x12\x1a\n" +
 	"\bChecksum\x18\x01 \x01(\tR\bChecksum\x12\x10\n" +
 	"\x03Ref\x18\x02 \x01(\tR\x03Ref\x12&\n" +
-	"\x0eCommitChecksum\x18\x03 \x01(\tR\x0eCommitChecksum\"\x93\x01\n" +
+	"\x0eCommitChecksum\x18\x03 \x01(\tR\x0eCommitChecksum\x12\"\n" +
+	"\fCommitObject\x18\x04 \x01(\fR\fCommitObject\x12\x1c\n" +
+	"\tTagObject\x18\x05 \x01(\fR\tTagObject\"\x93\x01\n" +
 	"\x19ResolveSourceHTTPResponse\x12\x1a\n" +
 	"\bChecksum\x18\x01 \x01(\tR\bChecksum\x12\x1a\n" +
 	"\bFilename\x18\x02 \x01(\tR\bFilename\x12>\n" +
@@ -3122,7 +3196,7 @@ func file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDescGZIP
 }
 
 var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes = make([]protoimpl.MessageInfo, 55)
+var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes = make([]protoimpl.MessageInfo, 56)
 var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_goTypes = []any{
 	(AttestationKind)(0),               // 0: moby.buildkit.v1.frontend.AttestationKind
 	(InTotoSubjectKind)(0),             // 1: moby.buildkit.v1.frontend.InTotoSubjectKind
@@ -3142,160 +3216,162 @@ var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_goTypes = []
 	(*ResolveSourceMetaRequest)(nil),   // 15: moby.buildkit.v1.frontend.ResolveSourceMetaRequest
 	(*ResolveSourceMetaResponse)(nil),  // 16: moby.buildkit.v1.frontend.ResolveSourceMetaResponse
 	(*ResolveSourceImageResponse)(nil), // 17: moby.buildkit.v1.frontend.ResolveSourceImageResponse
-	(*ResolveSourceGitResponse)(nil),   // 18: moby.buildkit.v1.frontend.ResolveSourceGitResponse
-	(*ResolveSourceHTTPResponse)(nil),  // 19: moby.buildkit.v1.frontend.ResolveSourceHTTPResponse
-	(*SolveRequest)(nil),               // 20: moby.buildkit.v1.frontend.SolveRequest
-	(*CacheOptionsEntry)(nil),          // 21: moby.buildkit.v1.frontend.CacheOptionsEntry
-	(*SolveResponse)(nil),              // 22: moby.buildkit.v1.frontend.SolveResponse
-	(*ReadFileRequest)(nil),            // 23: moby.buildkit.v1.frontend.ReadFileRequest
-	(*FileRange)(nil),                  // 24: moby.buildkit.v1.frontend.FileRange
-	(*ReadFileResponse)(nil),           // 25: moby.buildkit.v1.frontend.ReadFileResponse
-	(*ReadDirRequest)(nil),             // 26: moby.buildkit.v1.frontend.ReadDirRequest
-	(*ReadDirResponse)(nil),            // 27: moby.buildkit.v1.frontend.ReadDirResponse
-	(*StatFileRequest)(nil),            // 28: moby.buildkit.v1.frontend.StatFileRequest
-	(*StatFileResponse)(nil),           // 29: moby.buildkit.v1.frontend.StatFileResponse
-	(*EvaluateRequest)(nil),            // 30: moby.buildkit.v1.frontend.EvaluateRequest
-	(*EvaluateResponse)(nil),           // 31: moby.buildkit.v1.frontend.EvaluateResponse
-	(*PingRequest)(nil),                // 32: moby.buildkit.v1.frontend.PingRequest
-	(*PongResponse)(nil),               // 33: moby.buildkit.v1.frontend.PongResponse
-	(*WarnRequest)(nil),                // 34: moby.buildkit.v1.frontend.WarnRequest
-	(*WarnResponse)(nil),               // 35: moby.buildkit.v1.frontend.WarnResponse
-	(*NewContainerRequest)(nil),        // 36: moby.buildkit.v1.frontend.NewContainerRequest
-	(*NewContainerResponse)(nil),       // 37: moby.buildkit.v1.frontend.NewContainerResponse
-	(*ReleaseContainerRequest)(nil),    // 38: moby.buildkit.v1.frontend.ReleaseContainerRequest
-	(*ReleaseContainerResponse)(nil),   // 39: moby.buildkit.v1.frontend.ReleaseContainerResponse
-	(*ExecMessage)(nil),                // 40: moby.buildkit.v1.frontend.ExecMessage
-	(*InitMessage)(nil),                // 41: moby.buildkit.v1.frontend.InitMessage
-	(*ExitMessage)(nil),                // 42: moby.buildkit.v1.frontend.ExitMessage
-	(*StartedMessage)(nil),             // 43: moby.buildkit.v1.frontend.StartedMessage
-	(*DoneMessage)(nil),                // 44: moby.buildkit.v1.frontend.DoneMessage
-	(*FdMessage)(nil),                  // 45: moby.buildkit.v1.frontend.FdMessage
-	(*ResizeMessage)(nil),              // 46: moby.buildkit.v1.frontend.ResizeMessage
-	(*SignalMessage)(nil),              // 47: moby.buildkit.v1.frontend.SignalMessage
-	nil,                                // 48: moby.buildkit.v1.frontend.Result.MetadataEntry
-	nil,                                // 49: moby.buildkit.v1.frontend.Result.AttestationsEntry
-	nil,                                // 50: moby.buildkit.v1.frontend.RefMapDeprecated.RefsEntry
-	nil,                                // 51: moby.buildkit.v1.frontend.RefMap.RefsEntry
-	nil,                                // 52: moby.buildkit.v1.frontend.Attestation.MetadataEntry
-	nil,                                // 53: moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry
-	nil,                                // 54: moby.buildkit.v1.frontend.SolveRequest.FrontendOptEntry
-	nil,                                // 55: moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry
-	nil,                                // 56: moby.buildkit.v1.frontend.CacheOptionsEntry.AttrsEntry
-	(*pb.Definition)(nil),              // 57: pb.Definition
-	(*status.Status)(nil),              // 58: google.rpc.Status
-	(*pb.Platform)(nil),                // 59: pb.Platform
-	(*pb1.Policy)(nil),                 // 60: moby.buildkit.v1.sourcepolicy.Policy
-	(*pb.SourceOp)(nil),                // 61: pb.SourceOp
-	(*timestamp.Timestamp)(nil),        // 62: google.protobuf.Timestamp
-	(*types.Stat)(nil),                 // 63: fsutil.types.Stat
-	(*pb2.APICap)(nil),                 // 64: moby.buildkit.v1.apicaps.APICap
-	(*types1.WorkerRecord)(nil),        // 65: moby.buildkit.v1.types.WorkerRecord
-	(*pb.SourceInfo)(nil),              // 66: pb.SourceInfo
-	(*pb.Range)(nil),                   // 67: pb.Range
-	(*pb.Mount)(nil),                   // 68: pb.Mount
-	(pb.NetMode)(0),                    // 69: pb.NetMode
-	(*pb.WorkerConstraints)(nil),       // 70: pb.WorkerConstraints
-	(*pb.HostIP)(nil),                  // 71: pb.HostIP
-	(*pb.Meta)(nil),                    // 72: pb.Meta
-	(pb.SecurityMode)(0),               // 73: pb.SecurityMode
-	(*pb.SecretEnv)(nil),               // 74: pb.SecretEnv
+	(*ResolveSourceGitRequest)(nil),    // 18: moby.buildkit.v1.frontend.ResolveSourceGitRequest
+	(*ResolveSourceGitResponse)(nil),   // 19: moby.buildkit.v1.frontend.ResolveSourceGitResponse
+	(*ResolveSourceHTTPResponse)(nil),  // 20: moby.buildkit.v1.frontend.ResolveSourceHTTPResponse
+	(*SolveRequest)(nil),               // 21: moby.buildkit.v1.frontend.SolveRequest
+	(*CacheOptionsEntry)(nil),          // 22: moby.buildkit.v1.frontend.CacheOptionsEntry
+	(*SolveResponse)(nil),              // 23: moby.buildkit.v1.frontend.SolveResponse
+	(*ReadFileRequest)(nil),            // 24: moby.buildkit.v1.frontend.ReadFileRequest
+	(*FileRange)(nil),                  // 25: moby.buildkit.v1.frontend.FileRange
+	(*ReadFileResponse)(nil),           // 26: moby.buildkit.v1.frontend.ReadFileResponse
+	(*ReadDirRequest)(nil),             // 27: moby.buildkit.v1.frontend.ReadDirRequest
+	(*ReadDirResponse)(nil),            // 28: moby.buildkit.v1.frontend.ReadDirResponse
+	(*StatFileRequest)(nil),            // 29: moby.buildkit.v1.frontend.StatFileRequest
+	(*StatFileResponse)(nil),           // 30: moby.buildkit.v1.frontend.StatFileResponse
+	(*EvaluateRequest)(nil),            // 31: moby.buildkit.v1.frontend.EvaluateRequest
+	(*EvaluateResponse)(nil),           // 32: moby.buildkit.v1.frontend.EvaluateResponse
+	(*PingRequest)(nil),                // 33: moby.buildkit.v1.frontend.PingRequest
+	(*PongResponse)(nil),               // 34: moby.buildkit.v1.frontend.PongResponse
+	(*WarnRequest)(nil),                // 35: moby.buildkit.v1.frontend.WarnRequest
+	(*WarnResponse)(nil),               // 36: moby.buildkit.v1.frontend.WarnResponse
+	(*NewContainerRequest)(nil),        // 37: moby.buildkit.v1.frontend.NewContainerRequest
+	(*NewContainerResponse)(nil),       // 38: moby.buildkit.v1.frontend.NewContainerResponse
+	(*ReleaseContainerRequest)(nil),    // 39: moby.buildkit.v1.frontend.ReleaseContainerRequest
+	(*ReleaseContainerResponse)(nil),   // 40: moby.buildkit.v1.frontend.ReleaseContainerResponse
+	(*ExecMessage)(nil),                // 41: moby.buildkit.v1.frontend.ExecMessage
+	(*InitMessage)(nil),                // 42: moby.buildkit.v1.frontend.InitMessage
+	(*ExitMessage)(nil),                // 43: moby.buildkit.v1.frontend.ExitMessage
+	(*StartedMessage)(nil),             // 44: moby.buildkit.v1.frontend.StartedMessage
+	(*DoneMessage)(nil),                // 45: moby.buildkit.v1.frontend.DoneMessage
+	(*FdMessage)(nil),                  // 46: moby.buildkit.v1.frontend.FdMessage
+	(*ResizeMessage)(nil),              // 47: moby.buildkit.v1.frontend.ResizeMessage
+	(*SignalMessage)(nil),              // 48: moby.buildkit.v1.frontend.SignalMessage
+	nil,                                // 49: moby.buildkit.v1.frontend.Result.MetadataEntry
+	nil,                                // 50: moby.buildkit.v1.frontend.Result.AttestationsEntry
+	nil,                                // 51: moby.buildkit.v1.frontend.RefMapDeprecated.RefsEntry
+	nil,                                // 52: moby.buildkit.v1.frontend.RefMap.RefsEntry
+	nil,                                // 53: moby.buildkit.v1.frontend.Attestation.MetadataEntry
+	nil,                                // 54: moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry
+	nil,                                // 55: moby.buildkit.v1.frontend.SolveRequest.FrontendOptEntry
+	nil,                                // 56: moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry
+	nil,                                // 57: moby.buildkit.v1.frontend.CacheOptionsEntry.AttrsEntry
+	(*pb.Definition)(nil),              // 58: pb.Definition
+	(*status.Status)(nil),              // 59: google.rpc.Status
+	(*pb.Platform)(nil),                // 60: pb.Platform
+	(*pb1.Policy)(nil),                 // 61: moby.buildkit.v1.sourcepolicy.Policy
+	(*pb.SourceOp)(nil),                // 62: pb.SourceOp
+	(*timestamp.Timestamp)(nil),        // 63: google.protobuf.Timestamp
+	(*types.Stat)(nil),                 // 64: fsutil.types.Stat
+	(*pb2.APICap)(nil),                 // 65: moby.buildkit.v1.apicaps.APICap
+	(*types1.WorkerRecord)(nil),        // 66: moby.buildkit.v1.types.WorkerRecord
+	(*pb.SourceInfo)(nil),              // 67: pb.SourceInfo
+	(*pb.Range)(nil),                   // 68: pb.Range
+	(*pb.Mount)(nil),                   // 69: pb.Mount
+	(pb.NetMode)(0),                    // 70: pb.NetMode
+	(*pb.WorkerConstraints)(nil),       // 71: pb.WorkerConstraints
+	(*pb.HostIP)(nil),                  // 72: pb.HostIP
+	(*pb.Meta)(nil),                    // 73: pb.Meta
+	(pb.SecurityMode)(0),               // 74: pb.SecurityMode
+	(*pb.SecretEnv)(nil),               // 75: pb.SecretEnv
 }
 var file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_depIdxs = []int32{
 	3,  // 0: moby.buildkit.v1.frontend.Result.refsDeprecated:type_name -> moby.buildkit.v1.frontend.RefMapDeprecated
 	4,  // 1: moby.buildkit.v1.frontend.Result.ref:type_name -> moby.buildkit.v1.frontend.Ref
 	5,  // 2: moby.buildkit.v1.frontend.Result.refs:type_name -> moby.buildkit.v1.frontend.RefMap
-	48, // 3: moby.buildkit.v1.frontend.Result.metadata:type_name -> moby.buildkit.v1.frontend.Result.MetadataEntry
-	49, // 4: moby.buildkit.v1.frontend.Result.attestations:type_name -> moby.buildkit.v1.frontend.Result.AttestationsEntry
-	50, // 5: moby.buildkit.v1.frontend.RefMapDeprecated.refs:type_name -> moby.buildkit.v1.frontend.RefMapDeprecated.RefsEntry
-	57, // 6: moby.buildkit.v1.frontend.Ref.def:type_name -> pb.Definition
-	51, // 7: moby.buildkit.v1.frontend.RefMap.refs:type_name -> moby.buildkit.v1.frontend.RefMap.RefsEntry
+	49, // 3: moby.buildkit.v1.frontend.Result.metadata:type_name -> moby.buildkit.v1.frontend.Result.MetadataEntry
+	50, // 4: moby.buildkit.v1.frontend.Result.attestations:type_name -> moby.buildkit.v1.frontend.Result.AttestationsEntry
+	51, // 5: moby.buildkit.v1.frontend.RefMapDeprecated.refs:type_name -> moby.buildkit.v1.frontend.RefMapDeprecated.RefsEntry
+	58, // 6: moby.buildkit.v1.frontend.Ref.def:type_name -> pb.Definition
+	52, // 7: moby.buildkit.v1.frontend.RefMap.refs:type_name -> moby.buildkit.v1.frontend.RefMap.RefsEntry
 	7,  // 8: moby.buildkit.v1.frontend.Attestations.attestation:type_name -> moby.buildkit.v1.frontend.Attestation
 	0,  // 9: moby.buildkit.v1.frontend.Attestation.kind:type_name -> moby.buildkit.v1.frontend.AttestationKind
-	52, // 10: moby.buildkit.v1.frontend.Attestation.metadata:type_name -> moby.buildkit.v1.frontend.Attestation.MetadataEntry
+	53, // 10: moby.buildkit.v1.frontend.Attestation.metadata:type_name -> moby.buildkit.v1.frontend.Attestation.MetadataEntry
 	4,  // 11: moby.buildkit.v1.frontend.Attestation.ref:type_name -> moby.buildkit.v1.frontend.Ref
 	8,  // 12: moby.buildkit.v1.frontend.Attestation.inTotoSubjects:type_name -> moby.buildkit.v1.frontend.InTotoSubject
 	1,  // 13: moby.buildkit.v1.frontend.InTotoSubject.kind:type_name -> moby.buildkit.v1.frontend.InTotoSubjectKind
 	2,  // 14: moby.buildkit.v1.frontend.ReturnRequest.result:type_name -> moby.buildkit.v1.frontend.Result
-	58, // 15: moby.buildkit.v1.frontend.ReturnRequest.error:type_name -> google.rpc.Status
-	53, // 16: moby.buildkit.v1.frontend.InputsResponse.Definitions:type_name -> moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry
-	59, // 17: moby.buildkit.v1.frontend.ResolveImageConfigRequest.Platform:type_name -> pb.Platform
-	60, // 18: moby.buildkit.v1.frontend.ResolveImageConfigRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
-	61, // 19: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.Source:type_name -> pb.SourceOp
-	59, // 20: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.Platform:type_name -> pb.Platform
-	60, // 21: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
-	61, // 22: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Source:type_name -> pb.SourceOp
-	17, // 23: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Image:type_name -> moby.buildkit.v1.frontend.ResolveSourceImageResponse
-	18, // 24: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Git:type_name -> moby.buildkit.v1.frontend.ResolveSourceGitResponse
-	19, // 25: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.HTTP:type_name -> moby.buildkit.v1.frontend.ResolveSourceHTTPResponse
-	62, // 26: moby.buildkit.v1.frontend.ResolveSourceHTTPResponse.LastModified:type_name -> google.protobuf.Timestamp
-	57, // 27: moby.buildkit.v1.frontend.SolveRequest.Definition:type_name -> pb.Definition
-	54, // 28: moby.buildkit.v1.frontend.SolveRequest.FrontendOpt:type_name -> moby.buildkit.v1.frontend.SolveRequest.FrontendOptEntry
-	21, // 29: moby.buildkit.v1.frontend.SolveRequest.CacheImports:type_name -> moby.buildkit.v1.frontend.CacheOptionsEntry
-	55, // 30: moby.buildkit.v1.frontend.SolveRequest.FrontendInputs:type_name -> moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry
-	60, // 31: moby.buildkit.v1.frontend.SolveRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
-	56, // 32: moby.buildkit.v1.frontend.CacheOptionsEntry.Attrs:type_name -> moby.buildkit.v1.frontend.CacheOptionsEntry.AttrsEntry
-	2,  // 33: moby.buildkit.v1.frontend.SolveResponse.result:type_name -> moby.buildkit.v1.frontend.Result
-	24, // 34: moby.buildkit.v1.frontend.ReadFileRequest.Range:type_name -> moby.buildkit.v1.frontend.FileRange
-	63, // 35: moby.buildkit.v1.frontend.ReadDirResponse.entries:type_name -> fsutil.types.Stat
-	63, // 36: moby.buildkit.v1.frontend.StatFileResponse.stat:type_name -> fsutil.types.Stat
-	64, // 37: moby.buildkit.v1.frontend.PongResponse.FrontendAPICaps:type_name -> moby.buildkit.v1.apicaps.APICap
-	64, // 38: moby.buildkit.v1.frontend.PongResponse.LLBCaps:type_name -> moby.buildkit.v1.apicaps.APICap
-	65, // 39: moby.buildkit.v1.frontend.PongResponse.Workers:type_name -> moby.buildkit.v1.types.WorkerRecord
-	66, // 40: moby.buildkit.v1.frontend.WarnRequest.info:type_name -> pb.SourceInfo
-	67, // 41: moby.buildkit.v1.frontend.WarnRequest.ranges:type_name -> pb.Range
-	68, // 42: moby.buildkit.v1.frontend.NewContainerRequest.Mounts:type_name -> pb.Mount
-	69, // 43: moby.buildkit.v1.frontend.NewContainerRequest.Network:type_name -> pb.NetMode
-	59, // 44: moby.buildkit.v1.frontend.NewContainerRequest.platform:type_name -> pb.Platform
-	70, // 45: moby.buildkit.v1.frontend.NewContainerRequest.constraints:type_name -> pb.WorkerConstraints
-	71, // 46: moby.buildkit.v1.frontend.NewContainerRequest.extraHosts:type_name -> pb.HostIP
-	41, // 47: moby.buildkit.v1.frontend.ExecMessage.Init:type_name -> moby.buildkit.v1.frontend.InitMessage
-	45, // 48: moby.buildkit.v1.frontend.ExecMessage.File:type_name -> moby.buildkit.v1.frontend.FdMessage
-	46, // 49: moby.buildkit.v1.frontend.ExecMessage.Resize:type_name -> moby.buildkit.v1.frontend.ResizeMessage
-	43, // 50: moby.buildkit.v1.frontend.ExecMessage.Started:type_name -> moby.buildkit.v1.frontend.StartedMessage
-	42, // 51: moby.buildkit.v1.frontend.ExecMessage.Exit:type_name -> moby.buildkit.v1.frontend.ExitMessage
-	44, // 52: moby.buildkit.v1.frontend.ExecMessage.Done:type_name -> moby.buildkit.v1.frontend.DoneMessage
-	47, // 53: moby.buildkit.v1.frontend.ExecMessage.Signal:type_name -> moby.buildkit.v1.frontend.SignalMessage
-	72, // 54: moby.buildkit.v1.frontend.InitMessage.Meta:type_name -> pb.Meta
-	73, // 55: moby.buildkit.v1.frontend.InitMessage.Security:type_name -> pb.SecurityMode
-	74, // 56: moby.buildkit.v1.frontend.InitMessage.secretenv:type_name -> pb.SecretEnv
-	58, // 57: moby.buildkit.v1.frontend.ExitMessage.Error:type_name -> google.rpc.Status
-	6,  // 58: moby.buildkit.v1.frontend.Result.AttestationsEntry.value:type_name -> moby.buildkit.v1.frontend.Attestations
-	4,  // 59: moby.buildkit.v1.frontend.RefMap.RefsEntry.value:type_name -> moby.buildkit.v1.frontend.Ref
-	57, // 60: moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry.value:type_name -> pb.Definition
-	57, // 61: moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry.value:type_name -> pb.Definition
-	13, // 62: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:input_type -> moby.buildkit.v1.frontend.ResolveImageConfigRequest
-	15, // 63: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:input_type -> moby.buildkit.v1.frontend.ResolveSourceMetaRequest
-	20, // 64: moby.buildkit.v1.frontend.LLBBridge.Solve:input_type -> moby.buildkit.v1.frontend.SolveRequest
-	23, // 65: moby.buildkit.v1.frontend.LLBBridge.ReadFile:input_type -> moby.buildkit.v1.frontend.ReadFileRequest
-	26, // 66: moby.buildkit.v1.frontend.LLBBridge.ReadDir:input_type -> moby.buildkit.v1.frontend.ReadDirRequest
-	28, // 67: moby.buildkit.v1.frontend.LLBBridge.StatFile:input_type -> moby.buildkit.v1.frontend.StatFileRequest
-	30, // 68: moby.buildkit.v1.frontend.LLBBridge.Evaluate:input_type -> moby.buildkit.v1.frontend.EvaluateRequest
-	32, // 69: moby.buildkit.v1.frontend.LLBBridge.Ping:input_type -> moby.buildkit.v1.frontend.PingRequest
-	9,  // 70: moby.buildkit.v1.frontend.LLBBridge.Return:input_type -> moby.buildkit.v1.frontend.ReturnRequest
-	11, // 71: moby.buildkit.v1.frontend.LLBBridge.Inputs:input_type -> moby.buildkit.v1.frontend.InputsRequest
-	36, // 72: moby.buildkit.v1.frontend.LLBBridge.NewContainer:input_type -> moby.buildkit.v1.frontend.NewContainerRequest
-	38, // 73: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:input_type -> moby.buildkit.v1.frontend.ReleaseContainerRequest
-	40, // 74: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:input_type -> moby.buildkit.v1.frontend.ExecMessage
-	34, // 75: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
-	14, // 76: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
-	16, // 77: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
-	22, // 78: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
-	25, // 79: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
-	27, // 80: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
-	29, // 81: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
-	31, // 82: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
-	33, // 83: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
-	10, // 84: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
-	12, // 85: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
-	37, // 86: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
-	39, // 87: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
-	40, // 88: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
-	35, // 89: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
-	76, // [76:90] is the sub-list for method output_type
-	62, // [62:76] is the sub-list for method input_type
-	62, // [62:62] is the sub-list for extension type_name
-	62, // [62:62] is the sub-list for extension extendee
-	0,  // [0:62] is the sub-list for field type_name
+	59, // 15: moby.buildkit.v1.frontend.ReturnRequest.error:type_name -> google.rpc.Status
+	54, // 16: moby.buildkit.v1.frontend.InputsResponse.Definitions:type_name -> moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry
+	60, // 17: moby.buildkit.v1.frontend.ResolveImageConfigRequest.Platform:type_name -> pb.Platform
+	61, // 18: moby.buildkit.v1.frontend.ResolveImageConfigRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
+	62, // 19: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.Source:type_name -> pb.SourceOp
+	60, // 20: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.Platform:type_name -> pb.Platform
+	61, // 21: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
+	18, // 22: moby.buildkit.v1.frontend.ResolveSourceMetaRequest.Git:type_name -> moby.buildkit.v1.frontend.ResolveSourceGitRequest
+	62, // 23: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Source:type_name -> pb.SourceOp
+	17, // 24: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Image:type_name -> moby.buildkit.v1.frontend.ResolveSourceImageResponse
+	19, // 25: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.Git:type_name -> moby.buildkit.v1.frontend.ResolveSourceGitResponse
+	20, // 26: moby.buildkit.v1.frontend.ResolveSourceMetaResponse.HTTP:type_name -> moby.buildkit.v1.frontend.ResolveSourceHTTPResponse
+	63, // 27: moby.buildkit.v1.frontend.ResolveSourceHTTPResponse.LastModified:type_name -> google.protobuf.Timestamp
+	58, // 28: moby.buildkit.v1.frontend.SolveRequest.Definition:type_name -> pb.Definition
+	55, // 29: moby.buildkit.v1.frontend.SolveRequest.FrontendOpt:type_name -> moby.buildkit.v1.frontend.SolveRequest.FrontendOptEntry
+	22, // 30: moby.buildkit.v1.frontend.SolveRequest.CacheImports:type_name -> moby.buildkit.v1.frontend.CacheOptionsEntry
+	56, // 31: moby.buildkit.v1.frontend.SolveRequest.FrontendInputs:type_name -> moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry
+	61, // 32: moby.buildkit.v1.frontend.SolveRequest.SourcePolicies:type_name -> moby.buildkit.v1.sourcepolicy.Policy
+	57, // 33: moby.buildkit.v1.frontend.CacheOptionsEntry.Attrs:type_name -> moby.buildkit.v1.frontend.CacheOptionsEntry.AttrsEntry
+	2,  // 34: moby.buildkit.v1.frontend.SolveResponse.result:type_name -> moby.buildkit.v1.frontend.Result
+	25, // 35: moby.buildkit.v1.frontend.ReadFileRequest.Range:type_name -> moby.buildkit.v1.frontend.FileRange
+	64, // 36: moby.buildkit.v1.frontend.ReadDirResponse.entries:type_name -> fsutil.types.Stat
+	64, // 37: moby.buildkit.v1.frontend.StatFileResponse.stat:type_name -> fsutil.types.Stat
+	65, // 38: moby.buildkit.v1.frontend.PongResponse.FrontendAPICaps:type_name -> moby.buildkit.v1.apicaps.APICap
+	65, // 39: moby.buildkit.v1.frontend.PongResponse.LLBCaps:type_name -> moby.buildkit.v1.apicaps.APICap
+	66, // 40: moby.buildkit.v1.frontend.PongResponse.Workers:type_name -> moby.buildkit.v1.types.WorkerRecord
+	67, // 41: moby.buildkit.v1.frontend.WarnRequest.info:type_name -> pb.SourceInfo
+	68, // 42: moby.buildkit.v1.frontend.WarnRequest.ranges:type_name -> pb.Range
+	69, // 43: moby.buildkit.v1.frontend.NewContainerRequest.Mounts:type_name -> pb.Mount
+	70, // 44: moby.buildkit.v1.frontend.NewContainerRequest.Network:type_name -> pb.NetMode
+	60, // 45: moby.buildkit.v1.frontend.NewContainerRequest.platform:type_name -> pb.Platform
+	71, // 46: moby.buildkit.v1.frontend.NewContainerRequest.constraints:type_name -> pb.WorkerConstraints
+	72, // 47: moby.buildkit.v1.frontend.NewContainerRequest.extraHosts:type_name -> pb.HostIP
+	42, // 48: moby.buildkit.v1.frontend.ExecMessage.Init:type_name -> moby.buildkit.v1.frontend.InitMessage
+	46, // 49: moby.buildkit.v1.frontend.ExecMessage.File:type_name -> moby.buildkit.v1.frontend.FdMessage
+	47, // 50: moby.buildkit.v1.frontend.ExecMessage.Resize:type_name -> moby.buildkit.v1.frontend.ResizeMessage
+	44, // 51: moby.buildkit.v1.frontend.ExecMessage.Started:type_name -> moby.buildkit.v1.frontend.StartedMessage
+	43, // 52: moby.buildkit.v1.frontend.ExecMessage.Exit:type_name -> moby.buildkit.v1.frontend.ExitMessage
+	45, // 53: moby.buildkit.v1.frontend.ExecMessage.Done:type_name -> moby.buildkit.v1.frontend.DoneMessage
+	48, // 54: moby.buildkit.v1.frontend.ExecMessage.Signal:type_name -> moby.buildkit.v1.frontend.SignalMessage
+	73, // 55: moby.buildkit.v1.frontend.InitMessage.Meta:type_name -> pb.Meta
+	74, // 56: moby.buildkit.v1.frontend.InitMessage.Security:type_name -> pb.SecurityMode
+	75, // 57: moby.buildkit.v1.frontend.InitMessage.secretenv:type_name -> pb.SecretEnv
+	59, // 58: moby.buildkit.v1.frontend.ExitMessage.Error:type_name -> google.rpc.Status
+	6,  // 59: moby.buildkit.v1.frontend.Result.AttestationsEntry.value:type_name -> moby.buildkit.v1.frontend.Attestations
+	4,  // 60: moby.buildkit.v1.frontend.RefMap.RefsEntry.value:type_name -> moby.buildkit.v1.frontend.Ref
+	58, // 61: moby.buildkit.v1.frontend.InputsResponse.DefinitionsEntry.value:type_name -> pb.Definition
+	58, // 62: moby.buildkit.v1.frontend.SolveRequest.FrontendInputsEntry.value:type_name -> pb.Definition
+	13, // 63: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:input_type -> moby.buildkit.v1.frontend.ResolveImageConfigRequest
+	15, // 64: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:input_type -> moby.buildkit.v1.frontend.ResolveSourceMetaRequest
+	21, // 65: moby.buildkit.v1.frontend.LLBBridge.Solve:input_type -> moby.buildkit.v1.frontend.SolveRequest
+	24, // 66: moby.buildkit.v1.frontend.LLBBridge.ReadFile:input_type -> moby.buildkit.v1.frontend.ReadFileRequest
+	27, // 67: moby.buildkit.v1.frontend.LLBBridge.ReadDir:input_type -> moby.buildkit.v1.frontend.ReadDirRequest
+	29, // 68: moby.buildkit.v1.frontend.LLBBridge.StatFile:input_type -> moby.buildkit.v1.frontend.StatFileRequest
+	31, // 69: moby.buildkit.v1.frontend.LLBBridge.Evaluate:input_type -> moby.buildkit.v1.frontend.EvaluateRequest
+	33, // 70: moby.buildkit.v1.frontend.LLBBridge.Ping:input_type -> moby.buildkit.v1.frontend.PingRequest
+	9,  // 71: moby.buildkit.v1.frontend.LLBBridge.Return:input_type -> moby.buildkit.v1.frontend.ReturnRequest
+	11, // 72: moby.buildkit.v1.frontend.LLBBridge.Inputs:input_type -> moby.buildkit.v1.frontend.InputsRequest
+	37, // 73: moby.buildkit.v1.frontend.LLBBridge.NewContainer:input_type -> moby.buildkit.v1.frontend.NewContainerRequest
+	39, // 74: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:input_type -> moby.buildkit.v1.frontend.ReleaseContainerRequest
+	41, // 75: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:input_type -> moby.buildkit.v1.frontend.ExecMessage
+	35, // 76: moby.buildkit.v1.frontend.LLBBridge.Warn:input_type -> moby.buildkit.v1.frontend.WarnRequest
+	14, // 77: moby.buildkit.v1.frontend.LLBBridge.ResolveImageConfig:output_type -> moby.buildkit.v1.frontend.ResolveImageConfigResponse
+	16, // 78: moby.buildkit.v1.frontend.LLBBridge.ResolveSourceMeta:output_type -> moby.buildkit.v1.frontend.ResolveSourceMetaResponse
+	23, // 79: moby.buildkit.v1.frontend.LLBBridge.Solve:output_type -> moby.buildkit.v1.frontend.SolveResponse
+	26, // 80: moby.buildkit.v1.frontend.LLBBridge.ReadFile:output_type -> moby.buildkit.v1.frontend.ReadFileResponse
+	28, // 81: moby.buildkit.v1.frontend.LLBBridge.ReadDir:output_type -> moby.buildkit.v1.frontend.ReadDirResponse
+	30, // 82: moby.buildkit.v1.frontend.LLBBridge.StatFile:output_type -> moby.buildkit.v1.frontend.StatFileResponse
+	32, // 83: moby.buildkit.v1.frontend.LLBBridge.Evaluate:output_type -> moby.buildkit.v1.frontend.EvaluateResponse
+	34, // 84: moby.buildkit.v1.frontend.LLBBridge.Ping:output_type -> moby.buildkit.v1.frontend.PongResponse
+	10, // 85: moby.buildkit.v1.frontend.LLBBridge.Return:output_type -> moby.buildkit.v1.frontend.ReturnResponse
+	12, // 86: moby.buildkit.v1.frontend.LLBBridge.Inputs:output_type -> moby.buildkit.v1.frontend.InputsResponse
+	38, // 87: moby.buildkit.v1.frontend.LLBBridge.NewContainer:output_type -> moby.buildkit.v1.frontend.NewContainerResponse
+	40, // 88: moby.buildkit.v1.frontend.LLBBridge.ReleaseContainer:output_type -> moby.buildkit.v1.frontend.ReleaseContainerResponse
+	41, // 89: moby.buildkit.v1.frontend.LLBBridge.ExecProcess:output_type -> moby.buildkit.v1.frontend.ExecMessage
+	36, // 90: moby.buildkit.v1.frontend.LLBBridge.Warn:output_type -> moby.buildkit.v1.frontend.WarnResponse
+	77, // [77:91] is the sub-list for method output_type
+	63, // [63:77] is the sub-list for method input_type
+	63, // [63:63] is the sub-list for extension type_name
+	63, // [63:63] is the sub-list for extension extendee
+	0,  // [0:63] is the sub-list for field type_name
 }
 
 func init() { file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_init() }
@@ -3309,7 +3385,7 @@ func file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_init() {
 		(*Result_Ref)(nil),
 		(*Result_Refs)(nil),
 	}
-	file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[38].OneofWrappers = []any{
+	file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_msgTypes[39].OneofWrappers = []any{
 		(*ExecMessage_Init)(nil),
 		(*ExecMessage_File)(nil),
 		(*ExecMessage_Resize)(nil),
@@ -3324,7 +3400,7 @@ func file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc), len(file_github_com_moby_buildkit_frontend_gateway_pb_gateway_proto_rawDesc)),
 			NumEnums:      2,
-			NumMessages:   55,
+			NumMessages:   56,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/frontend/gateway/pb/gateway.proto b/frontend/gateway/pb/gateway.proto
index 087e3efa6e23..f9744f2b72ea 100644
--- a/frontend/gateway/pb/gateway.proto
+++ b/frontend/gateway/pb/gateway.proto
@@ -136,6 +136,7 @@ message ResolveSourceMetaRequest {
 	string LogName = 3;
 	string ResolveMode = 4;
 	repeated moby.buildkit.v1.sourcepolicy.Policy SourcePolicies = 8;
+	ResolveSourceGitRequest Git = 5;
 }
 
 message ResolveSourceMetaResponse {
@@ -150,10 +151,17 @@ message ResolveSourceImageResponse {
 	bytes Config = 2;
 }
 
+message ResolveSourceGitRequest {
+	// Return full commit and tag object bytes.
+	bool ReturnObject = 1;
+}
+
 message ResolveSourceGitResponse {
 	string Checksum = 1;
 	string Ref = 2;
 	string CommitChecksum = 3;
+	bytes CommitObject = 4;
+	bytes TagObject = 5;
 }
 
 message ResolveSourceHTTPResponse {
diff --git a/frontend/gateway/pb/gateway_vtproto.pb.go b/frontend/gateway/pb/gateway_vtproto.pb.go
index 15c3a93fd56f..f8430fa51c59 100644
--- a/frontend/gateway/pb/gateway_vtproto.pb.go
+++ b/frontend/gateway/pb/gateway_vtproto.pb.go
@@ -385,6 +385,7 @@ func (m *ResolveSourceMetaRequest) CloneVT() *ResolveSourceMetaRequest {
 	r.Platform = m.Platform.CloneVT()
 	r.LogName = m.LogName
 	r.ResolveMode = m.ResolveMode
+	r.Git = m.Git.CloneVT()
 	if rhs := m.SourcePolicies; rhs != nil {
 		tmpContainer := make([]*pb1.Policy, len(rhs))
 		for k, v := range rhs {
@@ -445,6 +446,23 @@ func (m *ResolveSourceImageResponse) CloneMessageVT() proto.Message {
 	return m.CloneVT()
 }
 
+func (m *ResolveSourceGitRequest) CloneVT() *ResolveSourceGitRequest {
+	if m == nil {
+		return (*ResolveSourceGitRequest)(nil)
+	}
+	r := new(ResolveSourceGitRequest)
+	r.ReturnObject = m.ReturnObject
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ResolveSourceGitRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
 func (m *ResolveSourceGitResponse) CloneVT() *ResolveSourceGitResponse {
 	if m == nil {
 		return (*ResolveSourceGitResponse)(nil)
@@ -453,6 +471,16 @@ func (m *ResolveSourceGitResponse) CloneVT() *ResolveSourceGitResponse {
 	r.Checksum = m.Checksum
 	r.Ref = m.Ref
 	r.CommitChecksum = m.CommitChecksum
+	if rhs := m.CommitObject; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.CommitObject = tmpBytes
+	}
+	if rhs := m.TagObject; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.TagObject = tmpBytes
+	}
 	if len(m.unknownFields) > 0 {
 		r.unknownFields = make([]byte, len(m.unknownFields))
 		copy(r.unknownFields, m.unknownFields)
@@ -1729,6 +1757,9 @@ func (this *ResolveSourceMetaRequest) EqualVT(that *ResolveSourceMetaRequest) bo
 	if this.ResolveMode != that.ResolveMode {
 		return false
 	}
+	if !this.Git.EqualVT(that.Git) {
+		return false
+	}
 	if len(this.SourcePolicies) != len(that.SourcePolicies) {
 		return false
 	}
@@ -1806,6 +1837,25 @@ func (this *ResolveSourceImageResponse) EqualMessageVT(thatMsg proto.Message) bo
 	}
 	return this.EqualVT(that)
 }
+func (this *ResolveSourceGitRequest) EqualVT(that *ResolveSourceGitRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ReturnObject != that.ReturnObject {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ResolveSourceGitRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ResolveSourceGitRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
 func (this *ResolveSourceGitResponse) EqualVT(that *ResolveSourceGitResponse) bool {
 	if this == that {
 		return true
@@ -1821,6 +1871,12 @@ func (this *ResolveSourceGitResponse) EqualVT(that *ResolveSourceGitResponse) bo
 	if this.CommitChecksum != that.CommitChecksum {
 		return false
 	}
+	if string(this.CommitObject) != string(that.CommitObject) {
+		return false
+	}
+	if string(this.TagObject) != string(that.TagObject) {
+		return false
+	}
 	return string(this.unknownFields) == string(that.unknownFields)
 }
 
@@ -3768,6 +3824,16 @@ func (m *ResolveSourceMetaRequest) MarshalToSizedBufferVT(dAtA []byte) (int, err
 			dAtA[i] = 0x42
 		}
 	}
+	if m.Git != nil {
+		size, err := m.Git.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
 	if len(m.ResolveMode) > 0 {
 		i -= len(m.ResolveMode)
 		copy(dAtA[i:], m.ResolveMode)
@@ -3925,6 +3991,49 @@ func (m *ResolveSourceImageResponse) MarshalToSizedBufferVT(dAtA []byte) (int, e
 	return len(dAtA) - i, nil
 }
 
+func (m *ResolveSourceGitRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ResolveSourceGitRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ResolveSourceGitRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.ReturnObject {
+		i--
+		if m.ReturnObject {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
 func (m *ResolveSourceGitResponse) MarshalVT() (dAtA []byte, err error) {
 	if m == nil {
 		return nil, nil
@@ -3955,6 +4064,20 @@ func (m *ResolveSourceGitResponse) MarshalToSizedBufferVT(dAtA []byte) (int, err
 		i -= len(m.unknownFields)
 		copy(dAtA[i:], m.unknownFields)
 	}
+	if len(m.TagObject) > 0 {
+		i -= len(m.TagObject)
+		copy(dAtA[i:], m.TagObject)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.TagObject)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.CommitObject) > 0 {
+		i -= len(m.CommitObject)
+		copy(dAtA[i:], m.CommitObject)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.CommitObject)))
+		i--
+		dAtA[i] = 0x22
+	}
 	if len(m.CommitChecksum) > 0 {
 		i -= len(m.CommitChecksum)
 		copy(dAtA[i:], m.CommitChecksum)
@@ -6110,6 +6233,10 @@ func (m *ResolveSourceMetaRequest) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	if m.Git != nil {
+		l = m.Git.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	if len(m.SourcePolicies) > 0 {
 		for _, e := range m.SourcePolicies {
 			l = e.SizeVT()
@@ -6164,6 +6291,19 @@ func (m *ResolveSourceImageResponse) SizeVT() (n int) {
 	return n
 }
 
+func (m *ResolveSourceGitRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ReturnObject {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
 func (m *ResolveSourceGitResponse) SizeVT() (n int) {
 	if m == nil {
 		return 0
@@ -6182,6 +6322,14 @@ func (m *ResolveSourceGitResponse) SizeVT() (n int) {
 	if l > 0 {
 		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
 	}
+	l = len(m.CommitObject)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.TagObject)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
 	n += len(m.unknownFields)
 	return n
 }
@@ -9400,6 +9548,42 @@ func (m *ResolveSourceMetaRequest) UnmarshalVT(dAtA []byte) error {
 			}
 			m.ResolveMode = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Git", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Git == nil {
+				m.Git = &ResolveSourceGitRequest{}
+			}
+			if err := m.Git.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		case 8:
 			if wireType != 2 {
 				return fmt.Errorf("proto: wrong wireType = %d for field SourcePolicies", wireType)
@@ -9768,6 +9952,77 @@ func (m *ResolveSourceImageResponse) UnmarshalVT(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *ResolveSourceGitRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ResolveSourceGitRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ResolveSourceGitRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ReturnObject", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ReturnObject = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func (m *ResolveSourceGitResponse) UnmarshalVT(dAtA []byte) error {
 	l := len(dAtA)
 	iNdEx := 0
@@ -9893,6 +10148,74 @@ func (m *ResolveSourceGitResponse) UnmarshalVT(dAtA []byte) error {
 			}
 			m.CommitChecksum = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CommitObject", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CommitObject = append(m.CommitObject[:0], dAtA[iNdEx:postIndex]...)
+			if m.CommitObject == nil {
+				m.CommitObject = []byte{}
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TagObject", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TagObject = append(m.TagObject[:0], dAtA[iNdEx:postIndex]...)
+			if m.TagObject == nil {
+				m.TagObject = []byte{}
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
diff --git a/source/git/source.go b/source/git/source.go
index 6bd4a662e693..1ba7cabccac9 100644
--- a/source/git/source.go
+++ b/source/git/source.go
@@ -51,6 +51,13 @@ type Metadata struct {
 	Ref            string
 	Checksum       string
 	CommitChecksum string
+
+	CommitObject []byte
+	TagObject    []byte
+}
+
+type MetadataOpts struct {
+	ReturnObject bool
 }
 
 // Supported returns nil if the system supports Git source
@@ -237,7 +244,7 @@ func (gs *gitSourceHandler) shaToCacheKey(sha, ref string) string {
 	return key
 }
 
-func (gs *Source) ResolveMetadata(ctx context.Context, id *GitIdentifier, sm *session.Manager, jobCtx solver.JobContext) (*Metadata, error) {
+func (gs *Source) ResolveMetadata(ctx context.Context, id *GitIdentifier, sm *session.Manager, jobCtx solver.JobContext, opt MetadataOpts) (*Metadata, error) {
 	gsh := &gitSourceHandler{
 		src:    *id,
 		Source: gs,
@@ -247,6 +254,56 @@ func (gs *Source) ResolveMetadata(ctx context.Context, id *GitIdentifier, sm *se
 	if err != nil {
 		return nil, err
 	}
+
+	if !opt.ReturnObject {
+		return md, nil
+	}
+
+	gsh.cacheCommit = md.Checksum
+	gsh.sha256 = len(md.Checksum) == 64
+	repo, err := gsh.remoteFetch(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer repo.Release()
+
+	// if ref was commit sha then we don't know the type of the object yet
+	buf, err := repo.Run(ctx, "cat-file", "-t", md.Checksum)
+	if err != nil {
+		return nil, err
+	}
+	objType := strings.TrimSpace(string(buf))
+
+	if objType != "commit" && objType != "tag" {
+		return nil, errors.Errorf("expected commit or tag object, got %s", objType)
+	}
+
+	if objType == "tag" && md.CommitChecksum == "" {
+		buf, err := repo.Run(ctx, "rev-parse", md.Checksum+"^{commit}")
+		if err != nil {
+			return nil, err
+		}
+		md.CommitChecksum = strings.TrimSpace(string(buf))
+	} else if objType == "commit" {
+		md.CommitChecksum = ""
+	}
+
+	commitChecksum := md.Checksum
+	if md.CommitChecksum != "" {
+		buf, err := repo.Run(ctx, "cat-file", "tag", md.Checksum)
+		if err != nil {
+			return nil, err
+		}
+		md.TagObject = buf
+		commitChecksum = md.CommitChecksum
+	}
+
+	buf, err = repo.Run(ctx, "cat-file", "commit", commitChecksum)
+	if err != nil {
+		return nil, err
+	}
+	md.CommitObject = buf
+
 	return md, nil
 }
 
@@ -557,6 +614,65 @@ func (gs *gitSourceHandler) CacheKey(ctx context.Context, jobCtx solver.JobConte
 	return cacheKey, md.Checksum, nil, true, nil
 }
 
+func (gs *gitSourceHandler) remoteFetch(ctx context.Context, g session.Group) (_ *gitRepo, retErr error) {
+	gs.locker.Lock(gs.src.Remote)
+	cleanup := func() error { return gs.locker.Unlock(gs.src.Remote) }
+
+	defer func() {
+		if retErr != nil {
+			cleanup()
+		}
+	}()
+
+	repo, err := gs.tryRemoteFetch(ctx, g, false)
+	if err != nil {
+		var wce *wouldClobberExistingTagError
+		var ulre *unableToUpdateLocalRefError
+		if errors.As(err, &wce) || errors.As(err, &ulre) {
+			repo, err = gs.tryRemoteFetch(ctx, g, true)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			return nil, err
+		}
+	}
+	repo.releasers = append(repo.releasers, cleanup)
+
+	defer func() {
+		if retErr != nil {
+			repo.Release()
+			repo = nil
+		}
+	}()
+
+	ref := gs.src.Ref
+	git := repo.GitCLI
+	if gs.src.Checksum != "" {
+		actualHashBuf, err := repo.Run(ctx, "rev-parse", ref)
+		if err != nil {
+			return nil, errors.Wrapf(err, "failed to rev-parse %s for %s", ref, urlutil.RedactCredentials(gs.src.Remote))
+		}
+		actualHash := strings.TrimSpace(string(actualHashBuf))
+		if !strings.HasPrefix(actualHash, gs.src.Checksum) {
+			retErr := errors.Errorf("expected checksum to match %s, got %s", gs.src.Checksum, actualHash)
+			actualHashBuf2, err := git.Run(ctx, "rev-parse", ref+"^{}")
+			if err != nil {
+				return nil, retErr
+			}
+			actualHash2 := strings.TrimSpace(string(actualHashBuf2))
+			if actualHash2 == actualHash {
+				return nil, retErr
+			}
+			if !strings.HasPrefix(actualHash2, gs.src.Checksum) {
+				return nil, errors.Errorf("expected checksum to match %s, got %s or %s", gs.src.Checksum, actualHash, actualHash2)
+			}
+		}
+	}
+
+	return repo, nil
+}
+
 func (gs *gitSourceHandler) Snapshot(ctx context.Context, jobCtx solver.JobContext) (cache.ImmutableRef, error) {
 	cacheKey := gs.cacheKey
 	if cacheKey == "" {
@@ -585,21 +701,15 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, jobCtx solver.JobConte
 		return gs.cache.Get(ctx, sis[0].ID(), nil)
 	}
 
-	gs.locker.Lock(gs.src.Remote)
-	defer gs.locker.Unlock(gs.src.Remote)
+	repo, err := gs.remoteFetch(ctx, g)
+	if err != nil {
+		return nil, err
+	}
+	defer repo.Release()
 
-	ref, err := gs.trySnapshot(ctx, g, false)
+	ref, err := gs.checkout(ctx, repo, g)
 	if err != nil {
-		var wce *wouldClobberExistingTagError
-		var ulre *unableToUpdateLocalRefError
-		if errors.As(err, &wce) || errors.As(err, &ulre) {
-			ref, err = gs.trySnapshot(ctx, g, true)
-			if err != nil {
-				return nil, err
-			}
-		} else {
-			return nil, err
-		}
+		return nil, err
 	}
 
 	md := cacheRefMetadata{ref}
@@ -609,19 +719,47 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, jobCtx solver.JobConte
 	return ref, nil
 }
 
-func (gs *gitSourceHandler) trySnapshot(ctx context.Context, g session.Group, reset bool) (out cache.ImmutableRef, retErr error) {
+type gitRepo struct {
+	*gitutil.GitCLI
+	dir       string
+	releasers []func() error
+}
+
+func (g *gitRepo) Release() error {
+	var err error
+	for _, r := range g.releasers {
+		if err1 := r(); err == nil {
+			err = err1
+		}
+	}
+	return err
+}
+
+func (gs *gitSourceHandler) tryRemoteFetch(ctx context.Context, g session.Group, reset bool) (_ *gitRepo, retErr error) {
+	repo := &gitRepo{}
+
+	defer func() {
+		if retErr != nil {
+			repo.Release()
+			repo = nil
+		}
+	}()
+
 	git, cleanup, err := gs.emptyGitCli(ctx, g)
 	if err != nil {
 		return nil, err
 	}
-	defer cleanup()
+	repo.releasers = append(repo.releasers, cleanup)
 
 	gitDir, unmountGitDir, err := gs.mountRemote(ctx, gs.src.Remote, gs.authArgs, gs.sha256, reset, g)
 	if err != nil {
 		return nil, err
 	}
-	defer unmountGitDir()
+	repo.releasers = append(repo.releasers, unmountGitDir)
+	repo.dir = gitDir
+
 	git = git.New(gitutil.WithGitDir(gitDir))
+	repo.GitCLI = git
 
 	ref := gs.src.Ref
 	if ref == "" {
@@ -629,6 +767,7 @@ func (gs *gitSourceHandler) trySnapshot(ctx context.Context, g session.Group, re
 		if err != nil {
 			return nil, err
 		}
+		gs.src.Ref = ref
 	}
 
 	doFetch := true
@@ -727,6 +866,11 @@ func (gs *gitSourceHandler) trySnapshot(ctx context.Context, g session.Group, re
 		}
 	}
 
+	return repo, nil
+}
+
+func (gs *gitSourceHandler) checkout(ctx context.Context, repo *gitRepo, g session.Group) (_ cache.ImmutableRef, retErr error) {
+	ref := gs.src.Ref
 	checkoutRef, err := gs.cache.New(ctx, nil, g, cache.WithRecordType(client.UsageRecordTypeGitCheckout), cache.WithDescription(fmt.Sprintf("git snapshot for %s#%s", urlutil.RedactCredentials(gs.src.Remote), ref)))
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to create new mutable for %s", urlutil.RedactCredentials(gs.src.Remote))
@@ -738,6 +882,9 @@ func (gs *gitSourceHandler) trySnapshot(ctx context.Context, g session.Group, re
 		}
 	}()
 
+	git := repo.GitCLI
+	gitDir := repo.dir
+
 	mount, err := checkoutRef.Mount(ctx, false, g)
 	if err != nil {
 		return nil, err
@@ -758,28 +905,6 @@ func (gs *gitSourceHandler) trySnapshot(ctx context.Context, g session.Group, re
 		subdir = "."
 	}
 
-	if gs.src.Checksum != "" {
-		actualHashBuf, err := git.Run(ctx, "rev-parse", ref)
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to rev-parse %s for %s", ref, urlutil.RedactCredentials(gs.src.Remote))
-		}
-		actualHash := strings.TrimSpace(string(actualHashBuf))
-		if !strings.HasPrefix(actualHash, gs.src.Checksum) {
-			retErr := errors.Errorf("expected checksum to match %s, got %s", gs.src.Checksum, actualHash)
-			actualHashBuf2, err := git.Run(ctx, "rev-parse", ref+"^{}")
-			if err != nil {
-				return nil, retErr
-			}
-			actualHash2 := strings.TrimSpace(string(actualHashBuf2))
-			if actualHash2 == actualHash {
-				return nil, retErr
-			}
-			if !strings.HasPrefix(actualHash2, gs.src.Checksum) {
-				return nil, errors.Errorf("expected checksum to match %s, got %s or %s", gs.src.Checksum, actualHash, actualHash2)
-			}
-		}
-	}
-
 	cd := checkoutDir
 	if gs.src.KeepGitDir && subdir == "." {
 		checkoutDirGit := filepath.Join(checkoutDir, ".git")
diff --git a/source/git/source_test.go b/source/git/source_test.go
index 2f368e114cd3..a221622b05e8 100644
--- a/source/git/source_test.go
+++ b/source/git/source_test.go
@@ -15,6 +15,7 @@ import (
 	"strconv"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/containerd/containerd/v2/core/diff/apply"
 	ctdmetadata "github.com/containerd/containerd/v2/core/metadata"
@@ -28,8 +29,8 @@ import (
 	"github.com/moby/buildkit/client"
 	"github.com/moby/buildkit/snapshot"
 	containerdsnapshot "github.com/moby/buildkit/snapshot/containerd"
-	"github.com/moby/buildkit/source"
 	"github.com/moby/buildkit/util/gitutil"
+	"github.com/moby/buildkit/util/gitutil/gitobject"
 	"github.com/moby/buildkit/util/leaseutil"
 	"github.com/moby/buildkit/util/progress"
 	"github.com/moby/buildkit/util/progress/logs"
@@ -1397,6 +1398,92 @@ func testMultipleTagAccess(t *testing.T, keepGitDir bool, format string) {
 	require.Equal(t, string(dt1), string(dt2))
 }
 
+func TestResolveMetadataObjectSHA1(t *testing.T) {
+	testResolveMetadataObject(t, false, "sha1")
+}
+
+func TestResolveMetadataObjectKeepGitDirSHA1(t *testing.T) {
+	testResolveMetadataObject(t, true, "sha1")
+}
+
+func TestResolveMetadataObjectSHA256(t *testing.T) {
+	testResolveMetadataObject(t, false, "sha256")
+}
+
+func TestResolveMetadataObjectKeepGitDirSHA256(t *testing.T) {
+	testResolveMetadataObject(t, true, "sha256")
+}
+
+func testResolveMetadataObject(t *testing.T, keepGitDir bool, format string) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Depends on unimplemented containerd bind-mount support on Windows")
+	}
+
+	t.Parallel()
+	ctx := namespaces.WithNamespace(context.Background(), "buildkit-test")
+	ctx = logProgressStreams(ctx, t)
+
+	gs := setupGitSource(t, t.TempDir())
+
+	repo := setupGitRepo(t, format)
+
+	id := &GitIdentifier{Remote: repo.mainURL, KeepGitDir: keepGitDir, Ref: "v1.2.3"}
+
+	md, err := gs.ResolveMetadata(ctx, id, nil, nil, MetadataOpts{
+		ReturnObject: true,
+	})
+	require.NoError(t, err)
+
+	expLen := 40
+	if format == "sha256" {
+		expLen = 64
+	}
+	require.Len(t, md.Checksum, expLen)
+	require.Len(t, md.CommitChecksum, expLen)
+
+	tagObject, err := gitobject.Parse(md.TagObject)
+	require.NoError(t, err)
+
+	err = tagObject.VerifyChecksum(md.Checksum)
+	require.NoError(t, err)
+
+	tag, err := tagObject.ToTag()
+	require.NoError(t, err)
+
+	require.Equal(t, "v1.2.3", tag.Tag)
+	require.Equal(t, "this is an annotated tag\n", tag.Message)
+	require.Equal(t, "test-user", tag.Tagger.Name)
+	require.Equal(t, "test-user@example.com", tag.Tagger.Email)
+
+	tagTime := tag.Tagger.When
+	require.NotNil(t, tagTime)
+	require.WithinDuration(t, time.Now(), *tagTime, 5*time.Minute)
+
+	require.Equal(t, "commit", tag.Type)
+	require.Equal(t, md.CommitChecksum, tag.Object)
+
+	commitObject, err := gitobject.Parse(md.CommitObject)
+	require.NoError(t, err)
+
+	err = commitObject.VerifyChecksum(md.CommitChecksum)
+	require.NoError(t, err)
+
+	commit, err := commitObject.ToCommit()
+	require.NoError(t, err)
+
+	require.Equal(t, "second\n", commit.Message)
+	require.Equal(t, "test-user", commit.Author.Name)
+	require.Equal(t, "test-user@example.com", commit.Author.Email)
+	require.Equal(t, "test-user", commit.Committer.Name)
+	require.Equal(t, "test-user@example.com", commit.Committer.Email)
+	commitTime := commit.Committer.When
+	require.NotNil(t, commitTime)
+	require.WithinDuration(t, time.Now(), *commitTime, 5*time.Minute)
+
+	require.Equal(t, 1, len(commit.Parents))
+	require.Len(t, commit.Tree, len(md.Checksum))
+}
+
 func TestMultipleReposSHA1(t *testing.T) {
 	testMultipleRepos(t, false, "sha1")
 }
@@ -1673,7 +1760,7 @@ func testSubdir(t *testing.T, keepGitDir bool) {
 	require.Equal(t, "abc\n", string(dt))
 }
 
-func setupGitSource(t *testing.T, tmpdir string) source.Source {
+func setupGitSource(t *testing.T, tmpdir string) *Source {
 	snapshotter, err := native.NewSnapshotter(filepath.Join(tmpdir, "snapshots"))
 	require.NoError(t, err)
 
@@ -1752,8 +1839,8 @@ func setupGitRepo(t *testing.T, format string) gitRepoFixture {
 	// * (tag: refs/tags/a/v1.2.3, refs/tags/a/v1.2.3-same) initial
 	runShell(t, fixture.mainPath,
 		"git -c init.defaultBranch=master init --object-format="+format,
-		"git config --local user.email test",
-		"git config --local user.name test",
+		"git config --local user.email test-user@example.com",
+		"git config --local user.name test-user",
 
 		"echo foo > abc",
 		"git add abc",
diff --git a/util/gitutil/gitobject/parse.go b/util/gitutil/gitobject/parse.go
new file mode 100644
index 000000000000..d5fd002426d8
--- /dev/null
+++ b/util/gitutil/gitobject/parse.go
@@ -0,0 +1,252 @@
+package gitobject
+
+import (
+	"bytes"
+	"crypto/sha1" //nolint:gosec // used for git object hashes
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"hash"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/pkg/errors"
+)
+
+type GitObject struct {
+	Type       string
+	Headers    map[string][]string
+	Message    string
+	GPGSig     string
+	SignedData string
+	Raw        []byte
+}
+
+type Actor struct {
+	Name  string
+	Email string
+	When  *time.Time
+}
+
+type Commit struct {
+	Tree      string
+	Parents   []string
+	Author    Actor
+	Committer Actor
+	Message   string
+}
+
+type Tag struct {
+	Object  string
+	Type    string
+	Tag     string
+	Tagger  Actor
+	Message string
+}
+
+func Parse(raw []byte) (*GitObject, error) {
+	obj := &GitObject{Headers: make(map[string][]string), Raw: raw}
+	lines := strings.Split(string(raw), "\n")
+	if len(lines) == 0 {
+		return nil, errors.Errorf("invalid empty git object")
+	}
+
+	isTag := bytes.HasPrefix(raw, []byte("object "))
+	if isTag {
+		obj.Type = "tag"
+	} else {
+		obj.Type = "commit"
+	}
+
+	var headersDone bool
+	var messageDone bool
+	var sigLines []string
+	var messageLines []string
+	var signedDataLines []string
+	inSig := false
+
+	for _, l := range lines {
+		if !headersDone {
+			if l == "" {
+				headersDone = true
+				signedDataLines = append(signedDataLines, l)
+				continue
+			}
+			if !isTag && strings.HasPrefix(l, "gpgsig ") {
+				inSig = true
+				sigLines = append(sigLines, strings.TrimPrefix(l, "gpgsig "))
+				continue
+			}
+			if inSig {
+				if v, ok := strings.CutPrefix(l, " "); ok {
+					sigLines = append(sigLines, v)
+					continue
+				} else {
+					inSig = false
+				}
+			}
+			signedDataLines = append(signedDataLines, l)
+			parts := strings.SplitN(l, " ", 2)
+			if len(parts) == 2 {
+				obj.Headers[parts[0]] = append(obj.Headers[parts[0]], parts[1])
+			}
+			continue
+		}
+		if isTag && (l == "-----BEGIN PGP SIGNATURE-----" || l == "-----BEGIN SSH SIGNATURE-----") {
+			messageDone = true
+		}
+		if messageDone {
+			sigLines = append(sigLines, l)
+		} else {
+			messageLines = append(messageLines, l)
+			signedDataLines = append(signedDataLines, l)
+		}
+	}
+
+	obj.Message = strings.Join(messageLines, "\n")
+	if len(sigLines) > 0 {
+		obj.GPGSig = strings.Join(sigLines, "\n")
+	}
+
+	obj.SignedData = strings.Join(signedDataLines, "\n")
+
+	// basic validation
+	requiredHeaders := []string{}
+	switch obj.Type {
+	case "commit":
+		requiredHeaders = append(requiredHeaders, "tree", "author", "committer")
+	case "tag":
+		requiredHeaders = append(requiredHeaders, "object", "type", "tag", "tagger")
+	}
+
+	for _, header := range requiredHeaders {
+		if _, ok := obj.Headers[header]; !ok {
+			return nil, errors.Errorf("invalid %s object: missing %s header", obj.Type, header)
+		}
+	}
+
+	return obj, nil
+}
+
+func (obj *GitObject) Checksum(hashFunc func() hash.Hash) ([]byte, error) {
+	h := hashFunc()
+	header := fmt.Sprintf("commit %d\u0000", len(obj.Raw))
+	if obj.Type == "tag" {
+		header = fmt.Sprintf("tag %d\u0000", len(obj.Raw))
+	}
+	data := append([]byte(header), obj.Raw...)
+	h.Write(data)
+	return h.Sum(nil), nil
+}
+
+func (obj *GitObject) VerifyChecksum(sha string) error {
+	var hf func() hash.Hash
+	switch len(sha) {
+	case 40:
+		hf = sha1.New
+	case 64:
+		hf = sha256.New
+	default:
+		return errors.Errorf("unsupported sha length %d", len(sha))
+	}
+	sum, err := obj.Checksum(hf)
+	if err != nil {
+		return err
+	}
+	if hexValue := hex.EncodeToString(sum); sha != hexValue {
+		return errors.Errorf("checksum mismatch: expected %s, got %s", sha, hexValue)
+	}
+	return nil
+}
+
+func (obj *GitObject) ToCommit() (*Commit, error) {
+	if obj.Type != "commit" {
+		return nil, errors.Errorf("not a commit object")
+	}
+	c := &Commit{}
+	if trees, ok := obj.Headers["tree"]; ok && len(trees) > 0 {
+		c.Tree = trees[0]
+	}
+	if parents, ok := obj.Headers["parent"]; ok && len(parents) > 0 {
+		c.Parents = parents
+	}
+	if authors, ok := obj.Headers["author"]; ok && len(authors) > 0 {
+		c.Author = parseActor(authors[0])
+	}
+	if committers, ok := obj.Headers["committer"]; ok && len(committers) > 0 {
+		c.Committer = parseActor(committers[0])
+	}
+	c.Message = obj.Message
+	return c, nil
+}
+
+func (obj *GitObject) ToTag() (*Tag, error) {
+	if obj.Type != "tag" {
+		return nil, errors.Errorf("not a tag object")
+	}
+	t := &Tag{}
+	if objects, ok := obj.Headers["object"]; ok && len(objects) > 0 {
+		t.Object = objects[0]
+	}
+	if types, ok := obj.Headers["type"]; ok && len(types) > 0 {
+		t.Type = types[0]
+	}
+	if tags, ok := obj.Headers["tag"]; ok && len(tags) > 0 {
+		t.Tag = tags[0]
+	}
+	if taggers, ok := obj.Headers["tagger"]; ok && len(taggers) > 0 {
+		t.Tagger = parseActor(taggers[0])
+	}
+	t.Message = obj.Message
+	return t, nil
+}
+
+func parseActor(s string) Actor {
+	s = strings.TrimSpace(s)
+	var a Actor
+
+	// find last angle brackets, because name can contain '<'
+	start := strings.LastIndex(s, "<")
+	end := strings.LastIndex(s, ">")
+	if start == -1 || end == -1 || end < start {
+		// malformed, treat as plain name
+		a.Name = s
+		return a
+	}
+
+	a.Name = strings.TrimSpace(s[:start])
+	a.Email = strings.TrimSpace(s[start+1 : end])
+
+	rest := strings.TrimSpace(s[end+1:])
+	if rest == "" {
+		return a
+	}
+
+	parts := strings.Fields(rest)
+	if len(parts) < 2 {
+		return a
+	}
+
+	unix, err := strconv.ParseInt(parts[0], 10, 64)
+	if err != nil {
+		return a
+	}
+
+	tz := parts[1]
+	if len(tz) != 5 || (tz[0] != '+' && tz[0] != '-') {
+		return a
+	}
+
+	sign := 1
+	if tz[0] == '-' {
+		sign = -1
+	}
+	hh, _ := strconv.Atoi(tz[1:3])
+	mm, _ := strconv.Atoi(tz[3:5])
+	offset := sign * (hh*3600 + mm*60)
+
+	t := time.Unix(unix, 0).In(time.FixedZone("", offset))
+	a.When = &t
+	return a
+}
diff --git a/util/gitutil/gitobject/parse_test.go b/util/gitutil/gitobject/parse_test.go
new file mode 100644
index 000000000000..5e6d64dfd9e2
--- /dev/null
+++ b/util/gitutil/gitobject/parse_test.go
@@ -0,0 +1,274 @@
+package gitobject
+
+import (
+	"crypto/sha1" //nolint:gosec // used for git object hashes
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestParseGitObject(t *testing.T) {
+	rawCommit := `tree c60378fad086260463884449208b0545cef5703d
+parent 2777c1b86e59a951188b81e310d3dc8b05b6ac9c
+parent 916074cfc59ff9d4a29e0e1e74c3dd745b5e0d23
+author Tõnis Tiigi <tonistiigi@gmail.com> 1758656883 -0700
+committer GitHub <noreply@github.com> 1758656883 -0700
+gpgsig -----BEGIN PGP SIGNATURE-----
+ 
+ wsFcBAABCAAQBQJo0vlzCRC1aQ7uu5UhlAAAmL0QACwN0cWbwqWeoI14uhYSFqV2
+ iRaUm2+vAoJcDkx4eRiKWyZxnCt1NApBpHZ3/R46nQyYf5syPAWtSfe/I9cBO6ed
+ qiQldlYqaEDzKqLc5AKqmf+jP6PxvfOY7qX1Qnwe9IVNqVmrCak3GJchedQStxIz
+ yHfx/4EFRf46LkpmmRgnou5P9Z6/em5zr70G8nOEGE0evSdgHF5hVkNzmfLBbRbI
+ RkhvHYZJGdn+bphAFM487+ySbzEwz0sFxXiUn+sLkKUU/Y62jqto7WXrToXOoeCc
+ h1DDrfSMzOJThQ+glgfyugXtBobXbuV62qLcnWfBoazWX6vc82UMlTH+lDd0rvQJ
+ 4Rx6jzeivwtIkMzOKDpJfEIaqXTLXEj5utI95t7vO9v6V/UctjLIr4K86o02VF7v
+ 6H60+3nKYt7kVeI0x6Hc3R9fWtohYAc8a/2xzyGxluqJokdaKOx5eTOrkAN/wdiv
+ es/nyYwMW07fxAns0BoH3aHgwFrMWmGLovhwLOAdBgVYAuW2I5KNa6FavBUBaGWD
+ /Cb2f8ZcaGVcvnwFEFkjcp9k+xCB2SGOJszbdehz86f/+rhQHJKvyIXvlWTYCswq
+ K6/YilEke++bcpfoOV2PgOEmV4rWescIcxlremnYqtahR81BQYkrZYnihxIaVZc/
+ Mq9vT7yP08mV6474Ihno
+ =sixl
+ -----END PGP SIGNATURE-----
+ 
+
+Merge pull request #6237 from jsternberg/hack-compose
+
+hack: update hack/compose with newer otel collector`
+	shaCommit := `c8fad61a079f8272be5559fe473171a8f6333679`
+
+	obj, err := Parse([]byte(rawCommit))
+	require.NoError(t, err)
+
+	sum, err := obj.Checksum(sha1.New)
+	require.NoError(t, err)
+	require.Equal(t, shaCommit, hex.EncodeToString(sum))
+	err = obj.VerifyChecksum(shaCommit)
+	require.NoError(t, err)
+
+	err = obj.VerifyChecksum("0000000000000000000000000000000000000000")
+	require.Error(t, err)
+
+	const expectedSig = `-----BEGIN PGP SIGNATURE-----
+
+wsFcBAABCAAQBQJo0vlzCRC1aQ7uu5UhlAAAmL0QACwN0cWbwqWeoI14uhYSFqV2
+iRaUm2+vAoJcDkx4eRiKWyZxnCt1NApBpHZ3/R46nQyYf5syPAWtSfe/I9cBO6ed
+qiQldlYqaEDzKqLc5AKqmf+jP6PxvfOY7qX1Qnwe9IVNqVmrCak3GJchedQStxIz
+yHfx/4EFRf46LkpmmRgnou5P9Z6/em5zr70G8nOEGE0evSdgHF5hVkNzmfLBbRbI
+RkhvHYZJGdn+bphAFM487+ySbzEwz0sFxXiUn+sLkKUU/Y62jqto7WXrToXOoeCc
+h1DDrfSMzOJThQ+glgfyugXtBobXbuV62qLcnWfBoazWX6vc82UMlTH+lDd0rvQJ
+4Rx6jzeivwtIkMzOKDpJfEIaqXTLXEj5utI95t7vO9v6V/UctjLIr4K86o02VF7v
+6H60+3nKYt7kVeI0x6Hc3R9fWtohYAc8a/2xzyGxluqJokdaKOx5eTOrkAN/wdiv
+es/nyYwMW07fxAns0BoH3aHgwFrMWmGLovhwLOAdBgVYAuW2I5KNa6FavBUBaGWD
+/Cb2f8ZcaGVcvnwFEFkjcp9k+xCB2SGOJszbdehz86f/+rhQHJKvyIXvlWTYCswq
+K6/YilEke++bcpfoOV2PgOEmV4rWescIcxlremnYqtahR81BQYkrZYnihxIaVZc/
+Mq9vT7yP08mV6474Ihno
+=sixl
+-----END PGP SIGNATURE-----
+`
+	require.Equal(t, expectedSig, obj.GPGSig)
+
+	const expectedSignedData = `tree c60378fad086260463884449208b0545cef5703d
+parent 2777c1b86e59a951188b81e310d3dc8b05b6ac9c
+parent 916074cfc59ff9d4a29e0e1e74c3dd745b5e0d23
+author Tõnis Tiigi <tonistiigi@gmail.com> 1758656883 -0700
+committer GitHub <noreply@github.com> 1758656883 -0700
+
+Merge pull request #6237 from jsternberg/hack-compose
+
+hack: update hack/compose with newer otel collector`
+	require.Equal(t, expectedSignedData, obj.SignedData)
+
+	require.Equal(t, []string{"c60378fad086260463884449208b0545cef5703d"}, obj.Headers["tree"])
+
+	require.Equal(t, "commit", obj.Type)
+	require.Equal(t, `Merge pull request #6237 from jsternberg/hack-compose
+
+hack: update hack/compose with newer otel collector`, obj.Message)
+
+	commit, err := obj.ToCommit()
+	require.NoError(t, err)
+	require.Equal(t, "Tõnis Tiigi", commit.Author.Name)
+	require.Equal(t, "tonistiigi@gmail.com", commit.Author.Email)
+	require.Equal(t, int64(1758656883), commit.Author.When.Unix())
+	_, offset := commit.Author.When.Zone()
+	require.Equal(t, -7*3600, offset)
+
+	require.Equal(t, 2, len(commit.Parents))
+	require.Equal(t, "2777c1b86e59a951188b81e310d3dc8b05b6ac9c", commit.Parents[0])
+	require.Equal(t, "916074cfc59ff9d4a29e0e1e74c3dd745b5e0d23", commit.Parents[1])
+
+	require.Equal(t, "GitHub", commit.Committer.Name)
+	require.Equal(t, "noreply@github.com", commit.Committer.Email)
+	require.Equal(t, int64(1758656883), commit.Committer.When.Unix())
+	_, offset = commit.Committer.When.Zone()
+	require.Equal(t, -7*3600, offset)
+
+	_, err = obj.ToTag()
+	require.Error(t, err)
+
+	shaTag := `813f42e05f8d94edb13c70a51dc6f8457c08a672`
+	raw := `object c8fad61a079f8272be5559fe473171a8f6333679
+type commit
+tag v0.25.0-rc1
+tagger Tonis Tiigi <tonistiigi@gmail.com> 1758658255 -0700
+
+v0.25.0-rc1
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEEVxbwWSJT3TMaEhiGr6neX4q3rzkFAmjS/s8ACgkQr6neX4q3
+rzlE+Av/b2FbO2AoBf0CQrRK/ggRcz1lla4xEyV+VrU3M/oEo1kKfpyQE4qXPSZC
+ybn7busZbmwrGpwXbMYk6ADg2lANhR4sjwWPw4b4hh3n0iSlD37eu63UEUeoIHCh
++Low+l5gkojExY8OfG8t34FZMdLzuA70lVclZHYEh+ucDb9kg6GlJCPQ3i1CizPj
+iCkRr2veuTNDykSdS9aqI3NJ5EXJT7A9CFZ7dGTilH+6o4PJLSIp0xl8AWecLju2
+0VYQtfo3W0UftxRLldU+KTc2UqUI3A5I/KyryYd8pJnTkh9xnO8TvF9O/wkvNUem
+pzY8yP5t3/wYbnjrCYhpEauXc/JCxh6dh/mTvcs2GoyLBYRSAtOei10UutdNDf5t
+xBB+AG8ocd4ro+kxXhabvSWG3kmLXkaBXVG31LLcIGEfVNP9hnzV0DXbLCzVBD7+
+SxdXrB7XhARUFFIKtobmBmLfAww18R6DGD0pNE+uSLplUy2D5HJA2R4UnJb+0DIR
+yVkI8y/p
+=12Xx
+-----END PGP SIGNATURE-----
+`
+	obj, err = Parse([]byte(raw))
+	require.NoError(t, err)
+
+	require.Equal(t, "tag", obj.Type)
+	require.Equal(t, []string{"v0.25.0-rc1"}, obj.Headers["tag"])
+	require.Equal(t, "v0.25.0-rc1", obj.Message)
+
+	const expectedTagSig = `-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEEVxbwWSJT3TMaEhiGr6neX4q3rzkFAmjS/s8ACgkQr6neX4q3
+rzlE+Av/b2FbO2AoBf0CQrRK/ggRcz1lla4xEyV+VrU3M/oEo1kKfpyQE4qXPSZC
+ybn7busZbmwrGpwXbMYk6ADg2lANhR4sjwWPw4b4hh3n0iSlD37eu63UEUeoIHCh
++Low+l5gkojExY8OfG8t34FZMdLzuA70lVclZHYEh+ucDb9kg6GlJCPQ3i1CizPj
+iCkRr2veuTNDykSdS9aqI3NJ5EXJT7A9CFZ7dGTilH+6o4PJLSIp0xl8AWecLju2
+0VYQtfo3W0UftxRLldU+KTc2UqUI3A5I/KyryYd8pJnTkh9xnO8TvF9O/wkvNUem
+pzY8yP5t3/wYbnjrCYhpEauXc/JCxh6dh/mTvcs2GoyLBYRSAtOei10UutdNDf5t
+xBB+AG8ocd4ro+kxXhabvSWG3kmLXkaBXVG31LLcIGEfVNP9hnzV0DXbLCzVBD7+
+SxdXrB7XhARUFFIKtobmBmLfAww18R6DGD0pNE+uSLplUy2D5HJA2R4UnJb+0DIR
+yVkI8y/p
+=12Xx
+-----END PGP SIGNATURE-----
+`
+	require.Equal(t, expectedTagSig, obj.GPGSig)
+
+	const expectedTagSignedData = `object c8fad61a079f8272be5559fe473171a8f6333679
+type commit
+tag v0.25.0-rc1
+tagger Tonis Tiigi <tonistiigi@gmail.com> 1758658255 -0700
+
+v0.25.0-rc1`
+	require.Equal(t, expectedTagSignedData, obj.SignedData)
+
+	sum, err = obj.Checksum(sha1.New)
+	require.NoError(t, err)
+	require.Equal(t, shaTag, hex.EncodeToString(sum))
+
+	err = obj.VerifyChecksum(shaTag)
+	require.NoError(t, err)
+
+	tag, err := obj.ToTag()
+	require.NoError(t, err)
+	require.Equal(t, "v0.25.0-rc1", tag.Tag)
+	require.Equal(t, "c8fad61a079f8272be5559fe473171a8f6333679", tag.Object)
+	require.Equal(t, "commit", tag.Type)
+	require.Equal(t, "Tonis Tiigi", tag.Tagger.Name)
+	require.Equal(t, "tonistiigi@gmail.com", tag.Tagger.Email)
+	require.Equal(t, int64(1758658255), tag.Tagger.When.Unix())
+	_, offset = tag.Tagger.When.Zone()
+	require.Equal(t, -7*3600, offset)
+}
+
+func TestParseActor(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		wantName string
+		wantMail string
+		wantTime *time.Time
+	}{
+		{
+			name:     "normal",
+			input:    "User One <user1@example.com> 1759247759 -0500",
+			wantName: "User One",
+			wantMail: "user1@example.com",
+			wantTime: func() *time.Time {
+				loc := time.FixedZone("", -5*3600)
+				t := time.Unix(1759247759, 0).In(loc)
+				return &t
+			}(),
+		},
+		{
+			name:     "no timestamp",
+			input:    "User Two <user2@example.com>",
+			wantName: "User Two",
+			wantMail: "user2@example.com",
+			wantTime: nil,
+		},
+		{
+			name:     "invalid timestamp",
+			input:    "User Three <user3@example.com> notatime +0000",
+			wantName: "User Three",
+			wantMail: "user3@example.com",
+			wantTime: nil,
+		},
+		{
+			name:     "invalid tz format",
+			input:    "User Four <user4@example.com> 1759247759 500",
+			wantName: "User Four",
+			wantMail: "user4@example.com",
+			wantTime: nil,
+		},
+		{
+			name:     "missing angle brackets",
+			input:    "User Five user5@example.com 1759247759 +0000",
+			wantName: "User Five user5@example.com 1759247759 +0000",
+			wantMail: "",
+			wantTime: nil,
+		},
+		{
+			name:     "extra spaces",
+			input:    "   User Six   <user6@example.com>   1600000000 +0200   ",
+			wantName: "User Six",
+			wantMail: "user6@example.com",
+			wantTime: func() *time.Time {
+				loc := time.FixedZone("", 2*3600)
+				t := time.Unix(1600000000, 0).In(loc)
+				return &t
+			}(),
+		},
+		{
+			name:     "name contains angle bracket",
+			input:    "Strange <Name <strange@example.com> 1600000000 +0000",
+			wantName: "Strange <Name",
+			wantMail: "strange@example.com",
+			wantTime: func() *time.Time {
+				loc := time.FixedZone("", 0)
+				t := time.Unix(1600000000, 0).In(loc)
+				return &t
+			}(),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := parseActor(tt.input)
+
+			require.Equal(t, tt.wantName, got.Name)
+			require.Equal(t, tt.wantMail, got.Email)
+
+			if tt.wantTime == nil {
+				require.Nil(t, got.When)
+			} else {
+				require.NotNil(t, got.When)
+				require.Equal(t, tt.wantTime.Unix(), got.When.Unix())
+				// compare timezone by offset (Zone), not by Location string which can be empty
+				_, wantOffset := tt.wantTime.Zone()
+				_, gotOffset := got.When.Zone()
+				require.Equal(t, wantOffset, gotOffset)
+			}
+		})
+	}
+}
diff --git a/worker/base/worker.go b/worker/base/worker.go
index 9373b6c006e4..6c1abb1a8d6f 100644
--- a/worker/base/worker.go
+++ b/worker/base/worker.go
@@ -455,7 +455,11 @@ func (w *Worker) ResolveSourceMetadata(ctx context.Context, op *pb.SourceOp, opt
 		if w.GitSource == nil {
 			return nil, errors.New("git source is not supported")
 		}
-		md, err := w.GitSource.ResolveMetadata(ctx, idt, sm, jobCtx)
+		mdOpt := git.MetadataOpts{}
+		if opt.GitOpt != nil {
+			mdOpt.ReturnObject = opt.GitOpt.ReturnObject
+		}
+		md, err := w.GitSource.ResolveMetadata(ctx, idt, sm, jobCtx, mdOpt)
 		if err != nil {
 			return nil, err
 		}
@@ -465,6 +469,8 @@ func (w *Worker) ResolveSourceMetadata(ctx context.Context, op *pb.SourceOp, opt
 				Checksum:       md.Checksum,
 				Ref:            md.Ref,
 				CommitChecksum: md.CommitChecksum,
+				CommitObject:   md.CommitObject,
+				TagObject:      md.TagObject,
 			},
 		}, nil
 	case *http.HTTPIdentifier: