Merge pull request #3481 from tonistiigi/v0.11-picks-2

[v0.11] cherry-picks
moby · Jan 9, 2023 · 96a7478 · 96a7478
2 parents d83d496 + fe02a41
commit 96a7478
Show file tree

Hide file tree

Showing 5 changed files with 33 additions and 5 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -24,15 +24,15 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  REPO_SLUG_ORIGIN: "moby/buildkit:master@sha256:49f8a220b0b7a217b15d4857df9ba42f22d01341dc77a42432c6bc3a66e33b25"
+  REPO_SLUG_ORIGIN: "moby/buildkit:v0.11.0-rc4"
   REPO_SLUG_TARGET: "moby/buildkit"
   DF_REPO_SLUG_TARGET: "docker/dockerfile-upstream"
   PLATFORMS: "linux/amd64,linux/arm/v7,linux/arm64,linux/s390x,linux/ppc64le,linux/riscv64"
   CACHE_GHA_SCOPE_IT: "integration-tests"
   CACHE_GHA_SCOPE_BINARIES: "binaries"
   CACHE_GHA_SCOPE_CROSS: "cross"
   TESTFLAGS: "-v --parallel=6 --timeout=30m"
-  BUILDX_VERSION: "v0.10.0-rc1"  # leave empty to use the one available on GitHub virtual environment
+  BUILDX_VERSION: "v0.10.0-rc3"  # leave empty to use the one available on GitHub virtual environment
   GO_VERSION: "1.19"
 
 jobs:

diff --git a/docs/attestations/slsa-definitions.md b/docs/attestations/slsa-definitions.md
@@ -43,7 +43,7 @@ Describes the config that initialized the build.
 ```json
     "invocation": {
       "configSource": {
-        "uri": "https://github.com/moby/buildkit.git#refs/tags/v0.11.0-rc3",
+        "uri": "https://github.com/moby/buildkit.git#refs/tags/v0.11.0",
         "digest": {
           "sha1": "4b220de5058abfd01ff619c9d2ff6b09a049bea0"
         },

diff --git a/exporter/attestation/unbundle.go b/exporter/attestation/unbundle.go
@@ -81,13 +81,41 @@ func Unbundle(ctx context.Context, s session.Group, bundled []exporter.Attestati
 	for _, atts := range unbundled {
 		joined = append(joined, atts...)
 	}
+	joined = sort(joined)
 
 	if err := Validate(joined); err != nil {
 		return nil, err
 	}
 	return joined, nil
 }
 
+func sort(atts []exporter.Attestation) []exporter.Attestation {
+	isCore := make([]bool, len(atts))
+	for i, att := range atts {
+		name, ok := att.Metadata[result.AttestationSBOMCore]
+		if !ok {
+			continue
+		}
+		if n, _, _ := strings.Cut(att.Path, "."); n != string(name) {
+			continue
+		}
+		isCore[i] = true
+	}
+
+	result := make([]exporter.Attestation, 0, len(atts))
+	for i, att := range atts {
+		if isCore[i] {
+			result = append(result, att)
+		}
+	}
+	for i, att := range atts {
+		if !isCore[i] {
+			result = append(result, att)
+		}
+	}
+	return result
+}
+
 func unbundle(ctx context.Context, root string, bundle exporter.Attestation) ([]exporter.Attestation, error) {
 	dir, err := fs.RootPath(root, bundle.Path)
 	if err != nil {

diff --git a/hack/azblob_test/test1/Dockerfile b/hack/azblob_test/test1/Dockerfile
@@ -1,4 +1,4 @@
-FROM busybox AS build
+FROM busybox:1.35 AS build
 RUN cat /dev/urandom | head -c 100 | sha256sum > unique_first
 RUN cat /dev/urandom | head -c 100 | sha256sum > unique_second
 

diff --git a/hack/azblob_test/test2/Dockerfile b/hack/azblob_test/test2/Dockerfile
@@ -1,4 +1,4 @@
-FROM busybox AS build
+FROM busybox:1.35 AS build
 RUN cat /dev/urandom | head -c 100 | sha256sum > unique_first
 RUN cat /dev/urandom | head -c 100 | sha256sum > unique_second
 RUN cat /dev/urandom | head -c 100 | sha256sum > unique_third