vendor: github.com/moby/buildkit v0.12.1-0.20230717122532-faa0cc7da353

full diff:

- https://github.com/moby/buildkit/compare/20230620112432...v0.12.0
- https://github.com/moby/buildkit/compare/v0.12.0...faa0cc7da3536923d85b74b2bb2d13c12a6ecc99

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

vendor/github.com/moby/buildkit/util/contentutil/refs.go

@@ -20,7 +20,6 @@ func ProviderFromRef(ref string) (ocispecs.Descriptor, content.Provider, error)
 	headers := http.Header{}
 	headers.Set("User-Agent", version.UserAgent())
 	remote := docker.NewResolver(docker.ResolverOptions{
-		Client:  http.DefaultClient,
 		Headers: headers,
 	})
 
@@ -40,7 +39,6 @@ func IngesterFromRef(ref string) (content.Ingester, error) {
 	headers := http.Header{}
 	headers.Set("User-Agent", version.UserAgent())
 	remote := docker.NewResolver(docker.ResolverOptions{
-		Client:  http.DefaultClient,
 		Headers: headers,
 	})
 

vendor/github.com/moby/buildkit/util/flightcontrol/flightcontrol.go

@@ -25,13 +25,13 @@ type contextKeyT string
 var contextKey = contextKeyT("buildkit/util/flightcontrol.progress")
 
 // Group is a flightcontrol synchronization group
-type Group struct {
-	mu sync.Mutex       // protects m
-	m  map[string]*call // lazily initialized
+type Group[T any] struct {
+	mu sync.Mutex          // protects m
+	m  map[string]*call[T] // lazily initialized
 }
 
 // Do executes a context function syncronized by the key
-func (g *Group) Do(ctx context.Context, key string, fn func(ctx context.Context) (interface{}, error)) (v interface{}, err error) {
+func (g *Group[T]) Do(ctx context.Context, key string, fn func(ctx context.Context) (T, error)) (v T, err error) {
 	var backoff time.Duration
 	for {
 		v, err = g.do(ctx, key, fn)
@@ -53,10 +53,10 @@ func (g *Group) Do(ctx context.Context, key string, fn func(ctx context.Context)
 	}
 }
 
-func (g *Group) do(ctx context.Context, key string, fn func(ctx context.Context) (interface{}, error)) (interface{}, error) {
+func (g *Group[T]) do(ctx context.Context, key string, fn func(ctx context.Context) (T, error)) (T, error) {
 	g.mu.Lock()
 	if g.m == nil {
-		g.m = make(map[string]*call)
+		g.m = make(map[string]*call[T])
 	}
 
 	if c, ok := g.m[key]; ok { // register 2nd waiter
@@ -78,16 +78,16 @@ func (g *Group) do(ctx context.Context, key string, fn func(ctx context.Context)
 	return c.wait(ctx)
 }
 
-type call struct {
+type call[T any] struct {
 	mu      sync.Mutex
-	result  interface{}
+	result  T
 	err     error
 	ready   chan struct{}
 	cleaned chan struct{}
 
-	ctx  *sharedContext
+	ctx  *sharedContext[T]
 	ctxs []context.Context
-	fn   func(ctx context.Context) (interface{}, error)
+	fn   func(ctx context.Context) (T, error)
 	once sync.Once
 
 	closeProgressWriter func()
@@ -95,8 +95,8 @@ type call struct {
 	progressCtx         context.Context
 }
 
-func newCall(fn func(ctx context.Context) (interface{}, error)) *call {
-	c := &call{
+func newCall[T any](fn func(ctx context.Context) (T, error)) *call[T] {
+	c := &call[T]{
 		fn:            fn,
 		ready:         make(chan struct{}),
 		cleaned:       make(chan struct{}),
@@ -114,7 +114,7 @@ func newCall(fn func(ctx context.Context) (interface{}, error)) *call {
 	return c
 }
 
-func (c *call) run() {
+func (c *call[T]) run() {
 	defer c.closeProgressWriter()
 	ctx, cancel := context.WithCancel(c.ctx)
 	defer cancel()
@@ -126,7 +126,8 @@ func (c *call) run() {
 	close(c.ready)
 }
 
-func (c *call) wait(ctx context.Context) (v interface{}, err error) {
+func (c *call[T]) wait(ctx context.Context) (v T, err error) {
+	var empty T
 	c.mu.Lock()
 	// detect case where caller has just returned, let it clean up before
 	select {
@@ -134,7 +135,7 @@ func (c *call) wait(ctx context.Context) (v interface{}, err error) {
 		c.mu.Unlock()
 		if c.err != nil { // on error retry
 			<-c.cleaned
-			return nil, errRetry
+			return empty, errRetry
 		}
 		pw, ok, _ := progress.NewFromContext(ctx)
 		if ok {
@@ -145,7 +146,7 @@ func (c *call) wait(ctx context.Context) (v interface{}, err error) {
 	case <-c.ctx.done: // could return if no error
 		c.mu.Unlock()
 		<-c.cleaned
-		return nil, errRetry
+		return empty, errRetry
 	default:
 	}
 
@@ -174,13 +175,13 @@ func (c *call) wait(ctx context.Context) (v interface{}, err error) {
 		if ok {
 			c.progressState.close(pw)
 		}
-		return nil, ctx.Err()
+		return empty, ctx.Err()
 	case <-c.ready:
 		return c.result, c.err // shared not implemented yet
 	}
 }
 
-func (c *call) Deadline() (deadline time.Time, ok bool) {
+func (c *call[T]) Deadline() (deadline time.Time, ok bool) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 	for _, ctx := range c.ctxs {
@@ -196,11 +197,11 @@ func (c *call) Deadline() (deadline time.Time, ok bool) {
 	return time.Time{}, false
 }
 
-func (c *call) Done() <-chan struct{} {
+func (c *call[T]) Done() <-chan struct{} {
 	return c.ctx.done
 }
 
-func (c *call) Err() error {
+func (c *call[T]) Err() error {
 	select {
 	case <-c.ctx.Done():
 		return c.ctx.err
@@ -209,7 +210,7 @@ func (c *call) Err() error {
 	}
 }
 
-func (c *call) Value(key interface{}) interface{} {
+func (c *call[T]) Value(key interface{}) interface{} {
 	if key == contextKey {
 		return c.progressState
 	}
@@ -239,17 +240,17 @@ func (c *call) Value(key interface{}) interface{} {
 	return nil
 }
 
-type sharedContext struct {
-	*call
+type sharedContext[T any] struct {
+	*call[T]
 	done chan struct{}
 	err  error
 }
 
-func newContext(c *call) *sharedContext {
-	return &sharedContext{call: c, done: make(chan struct{})}
+func newContext[T any](c *call[T]) *sharedContext[T] {
+	return &sharedContext[T]{call: c, done: make(chan struct{})}
 }
 
-func (sc *sharedContext) checkDone() bool {
+func (sc *sharedContext[T]) checkDone() bool {
 	sc.mu.Lock()
 	select {
 	case <-sc.done:

vendor/github.com/moby/buildkit/util/imageutil/config.go

@@ -0,0 +1,285 @@
+package imageutil
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/leases"
+	"github.com/containerd/containerd/platforms"
+	"github.com/containerd/containerd/reference"
+	"github.com/containerd/containerd/remotes"
+	"github.com/containerd/containerd/remotes/docker"
+	intoto "github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/moby/buildkit/solver/pb"
+	srctypes "github.com/moby/buildkit/source/types"
+	"github.com/moby/buildkit/sourcepolicy"
+	spb "github.com/moby/buildkit/sourcepolicy/pb"
+	"github.com/moby/buildkit/util/contentutil"
+	"github.com/moby/buildkit/util/leaseutil"
+	"github.com/moby/buildkit/util/resolver/limited"
+	"github.com/moby/buildkit/util/resolver/retryhandler"
+	digest "github.com/opencontainers/go-digest"
+	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+)
+
+type ContentCache interface {
+	content.Ingester
+	content.Provider
+	content.Manager
+}
+
+var leasesMu sync.Mutex
+var leasesF []func(context.Context) error
+
+func CancelCacheLeases() {
+	leasesMu.Lock()
+	for _, f := range leasesF {
+		f(context.TODO())
+	}
+	leasesF = nil
+	leasesMu.Unlock()
+}
+
+func AddLease(f func(context.Context) error) {
+	leasesMu.Lock()
+	leasesF = append(leasesF, f)
+	leasesMu.Unlock()
+}
+
+// ResolveToNonImageError is returned by the resolver when the ref is mutated by policy to a non-image ref
+type ResolveToNonImageError struct {
+	Ref     string
+	Updated string
+}
+
+func (e ResolveToNonImageError) Error() string {
+	return fmt.Sprintf("ref mutated by policy to non-image: %s://%s -> %s", srctypes.DockerImageScheme, e.Ref, e.Updated)
+}
+
+func Config(ctx context.Context, str string, resolver remotes.Resolver, cache ContentCache, leaseManager leases.Manager, p *ocispecs.Platform, spls []*spb.Policy) (string, digest.Digest, []byte, error) {
+	// TODO: fix buildkit to take interface instead of struct
+	var platform platforms.MatchComparer
+	if p != nil {
+		platform = platforms.Only(*p)
+	} else {
+		platform = platforms.Default()
+	}
+	ref, err := reference.Parse(str)
+	if err != nil {
+		return "", "", nil, errors.WithStack(err)
+	}
+
+	op := &pb.Op{
+		Op: &pb.Op_Source{
+			Source: &pb.SourceOp{
+				Identifier: srctypes.DockerImageScheme + "://" + ref.String(),
+			},
+		},
+	}
+
+	mut, err := sourcepolicy.NewEngine(spls).Evaluate(ctx, op)
+	if err != nil {
+		return "", "", nil, errors.Wrap(err, "could not resolve image due to policy")
+	}
+
+	if mut {
+		var (
+			t  string
+			ok bool
+		)
+		t, newRef, ok := strings.Cut(op.GetSource().GetIdentifier(), "://")
+		if !ok {
+			return "", "", nil, errors.Errorf("could not parse ref: %s", op.GetSource().GetIdentifier())
+		}
+		if ok && t != srctypes.DockerImageScheme {
+			return "", "", nil, &ResolveToNonImageError{Ref: str, Updated: newRef}
+		}
+		ref, err = reference.Parse(newRef)
+		if err != nil {
+			return "", "", nil, errors.WithStack(err)
+		}
+	}
+
+	if leaseManager != nil {
+		ctx2, done, err := leaseutil.WithLease(ctx, leaseManager, leases.WithExpiration(5*time.Minute), leaseutil.MakeTemporary)
+		if err != nil {
+			return "", "", nil, errors.WithStack(err)
+		}
+		ctx = ctx2
+		defer func() {
+			// this lease is not deleted to allow other components to access manifest/config from cache. It will be deleted after 5 min deadline or on pruning inactive builder
+			AddLease(done)
+		}()
+	}
+
+	desc := ocispecs.Descriptor{
+		Digest: ref.Digest(),
+	}
+	if desc.Digest != "" {
+		ra, err := cache.ReaderAt(ctx, desc)
+		if err == nil {
+			info, err := cache.Info(ctx, desc.Digest)
+			if err == nil {
+				if ok, err := contentutil.HasSource(info, ref); err == nil && ok {
+					desc.Size = ra.Size()
+					mt, err := DetectManifestMediaType(ra)
+					if err == nil {
+						desc.MediaType = mt
+					}
+				}
+			}
+		}
+	}
+	// use resolver if desc is incomplete
+	if desc.MediaType == "" {
+		_, desc, err = resolver.Resolve(ctx, ref.String())
+		if err != nil {
+			return "", "", nil, err
+		}
+	}
+
+	fetcher, err := resolver.Fetcher(ctx, ref.String())
+	if err != nil {
+		return "", "", nil, err
+	}
+
+	if desc.MediaType == images.MediaTypeDockerSchema1Manifest {
+		dgst, dt, err := readSchema1Config(ctx, ref.String(), desc, fetcher, cache)
+		return ref.String(), dgst, dt, err
+	}
+
+	children := childrenConfigHandler(cache, platform)
+
+	dslHandler, err := docker.AppendDistributionSourceLabel(cache, ref.String())
+	if err != nil {
+		return "", "", nil, err
+	}
+
+	handlers := []images.Handler{
+		retryhandler.New(limited.FetchHandler(cache, fetcher, str), func(_ []byte) {}),
+		dslHandler,
+		children,
+	}
+	if err := images.Dispatch(ctx, images.Handlers(handlers...), nil, desc); err != nil {
+		return "", "", nil, err
+	}
+	config, err := images.Config(ctx, cache, desc, platform)
+	if err != nil {
+		return "", "", nil, err
+	}
+
+	dt, err := content.ReadBlob(ctx, cache, config)
+	if err != nil {
+		return "", "", nil, err
+	}
+
+	return ref.String(), desc.Digest, dt, nil
+}
+
+func childrenConfigHandler(provider content.Provider, platform platforms.MatchComparer) images.HandlerFunc {
+	return func(ctx context.Context, desc ocispecs.Descriptor) ([]ocispecs.Descriptor, error) {
+		var descs []ocispecs.Descriptor
+		switch desc.MediaType {
+		case images.MediaTypeDockerSchema2Manifest, ocispecs.MediaTypeImageManifest:
+			p, err := content.ReadBlob(ctx, provider, desc)
+			if err != nil {
+				return nil, err
+			}
+
+			// TODO(stevvooe): We just assume oci manifest, for now. There may be
+			// subtle differences from the docker version.
+			var manifest ocispecs.Manifest
+			if err := json.Unmarshal(p, &manifest); err != nil {
+				return nil, err
+			}
+
+			descs = append(descs, manifest.Config)
+		case images.MediaTypeDockerSchema2ManifestList, ocispecs.MediaTypeImageIndex:
+			p, err := content.ReadBlob(ctx, provider, desc)
+			if err != nil {
+				return nil, err
+			}
+
+			var index ocispecs.Index
+			if err := json.Unmarshal(p, &index); err != nil {
+				return nil, err
+			}
+
+			if platform != nil {
+				for _, d := range index.Manifests {
+					if d.Platform == nil || platform.Match(*d.Platform) {
+						descs = append(descs, d)
+					}
+				}
+			} else {
+				descs = append(descs, index.Manifests...)
+			}
+		case images.MediaTypeDockerSchema2Config, ocispecs.MediaTypeImageConfig, docker.LegacyConfigMediaType,
+			intoto.PayloadType:
+			// childless data types.
+			return nil, nil
+		default:
+			return nil, errors.Errorf("encountered unknown type %v; children may not be fetched", desc.MediaType)
+		}
+
+		return descs, nil
+	}
+}
+
+// specs.MediaTypeImageManifest, // TODO: detect schema1/manifest-list
+func DetectManifestMediaType(ra content.ReaderAt) (string, error) {
+	// TODO: schema1
+
+	dt := make([]byte, ra.Size())
+	if _, err := ra.ReadAt(dt, 0); err != nil {
+		return "", err
+	}
+
+	return DetectManifestBlobMediaType(dt)
+}
+
+func DetectManifestBlobMediaType(dt []byte) (string, error) {
+	var mfst struct {
+		MediaType *string         `json:"mediaType"`
+		Config    json.RawMessage `json:"config"`
+		Manifests json.RawMessage `json:"manifests"`
+		Layers    json.RawMessage `json:"layers"`
+	}
+
+	if err := json.Unmarshal(dt, &mfst); err != nil {
+		return "", err
+	}
+
+	mt := images.MediaTypeDockerSchema2ManifestList
+
+	if mfst.Config != nil || mfst.Layers != nil {
+		mt = images.MediaTypeDockerSchema2Manifest
+
+		if mfst.Manifests != nil {
+			return "", errors.Errorf("invalid ambiguous manifest and manifest list")
+		}
+	}
+
+	if mfst.MediaType != nil {
+		switch *mfst.MediaType {
+		case images.MediaTypeDockerSchema2ManifestList, ocispecs.MediaTypeImageIndex:
+			if mt != images.MediaTypeDockerSchema2ManifestList {
+				return "", errors.Errorf("mediaType in manifest does not match manifest contents")
+			}
+			mt = *mfst.MediaType
+		case images.MediaTypeDockerSchema2Manifest, ocispecs.MediaTypeImageManifest:
+			if mt != images.MediaTypeDockerSchema2Manifest {
+				return "", errors.Errorf("mediaType in manifest does not match manifest contents")
+			}
+			mt = *mfst.MediaType
+		}
+	}
+	return mt, nil
+}

vendor/github.com/moby/buildkit/util/imageutil/schema1.go

@@ -0,0 +1,88 @@
+package imageutil
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"strings"
+	"time"
+
+	"github.com/containerd/containerd/remotes"
+	"github.com/moby/buildkit/exporter/containerimage/image"
+	digest "github.com/opencontainers/go-digest"
+	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
+	"github.com/pkg/errors"
+)
+
+func readSchema1Config(ctx context.Context, ref string, desc ocispecs.Descriptor, fetcher remotes.Fetcher, cache ContentCache) (digest.Digest, []byte, error) {
+	rc, err := fetcher.Fetch(ctx, desc)
+	if err != nil {
+		return "", nil, err
+	}
+	defer rc.Close()
+	dt, err := io.ReadAll(rc)
+	if err != nil {
+		return "", nil, errors.Wrap(err, "failed to fetch schema1 manifest")
+	}
+	dt, err = convertSchema1ConfigMeta(dt)
+	if err != nil {
+		return "", nil, err
+	}
+	return desc.Digest, dt, nil
+}
+
+func convertSchema1ConfigMeta(in []byte) ([]byte, error) {
+	type history struct {
+		V1Compatibility string `json:"v1Compatibility"`
+	}
+	var m struct {
+		History []history `json:"history"`
+	}
+	if err := json.Unmarshal(in, &m); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal schema1 manifest")
+	}
+	if len(m.History) == 0 {
+		return nil, errors.Errorf("invalid schema1 manifest")
+	}
+
+	var img image.Image
+	if err := json.Unmarshal([]byte(m.History[0].V1Compatibility), &img); err != nil {
+		return nil, errors.Wrap(err, "failed to unmarshal image from schema 1 history")
+	}
+
+	img.RootFS = ocispecs.RootFS{
+		Type: "layers", // filled in by exporter
+	}
+	img.History = make([]ocispecs.History, len(m.History))
+
+	for i := range m.History {
+		var h v1History
+		if err := json.Unmarshal([]byte(m.History[i].V1Compatibility), &h); err != nil {
+			return nil, errors.Wrap(err, "failed to unmarshal history")
+		}
+		img.History[len(m.History)-i-1] = ocispecs.History{
+			Author:     h.Author,
+			Comment:    h.Comment,
+			Created:    &h.Created,
+			CreatedBy:  strings.Join(h.ContainerConfig.Cmd, " "),
+			EmptyLayer: (h.ThrowAway != nil && *h.ThrowAway) || (h.Size != nil && *h.Size == 0),
+		}
+	}
+
+	dt, err := json.MarshalIndent(img, "", "  ")
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to marshal schema1 config")
+	}
+	return dt, nil
+}
+
+type v1History struct {
+	Author          string    `json:"author,omitempty"`
+	Created         time.Time `json:"created"`
+	Comment         string    `json:"comment,omitempty"`
+	ThrowAway       *bool     `json:"throwaway,omitempty"`
+	Size            *int      `json:"Size,omitempty"` // used before ThrowAway field
+	ContainerConfig struct {
+		Cmd []string `json:"Cmd,omitempty"`
+	} `json:"container_config,omitempty"`
+}

vendor/github.com/moby/buildkit/util/leaseutil/manager.go

@@ -0,0 +1,83 @@
+package leaseutil
+
+import (
+	"context"
+	"time"
+
+	"github.com/containerd/containerd/leases"
+	"github.com/containerd/containerd/namespaces"
+)
+
+func WithLease(ctx context.Context, ls leases.Manager, opts ...leases.Opt) (context.Context, func(context.Context) error, error) {
+	_, ok := leases.FromContext(ctx)
+	if ok {
+		return ctx, func(context.Context) error {
+			return nil
+		}, nil
+	}
+
+	l, err := ls.Create(ctx, append([]leases.Opt{leases.WithRandomID(), leases.WithExpiration(time.Hour)}, opts...)...)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	ctx = leases.WithLease(ctx, l.ID)
+	return ctx, func(ctx context.Context) error {
+		return ls.Delete(ctx, l)
+	}, nil
+}
+
+func MakeTemporary(l *leases.Lease) error {
+	if l.Labels == nil {
+		l.Labels = map[string]string{}
+	}
+	l.Labels["buildkit/lease.temporary"] = time.Now().UTC().Format(time.RFC3339Nano)
+	return nil
+}
+
+func WithNamespace(lm leases.Manager, ns string) *Manager {
+	return &Manager{manager: lm, ns: ns}
+}
+
+type Manager struct {
+	manager leases.Manager
+	ns      string
+}
+
+func (l *Manager) Namespace() string {
+	return l.ns
+}
+
+func (l *Manager) WithNamespace(ns string) *Manager {
+	return WithNamespace(l.manager, ns)
+}
+
+func (l *Manager) Create(ctx context.Context, opts ...leases.Opt) (leases.Lease, error) {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.Create(ctx, opts...)
+}
+
+func (l *Manager) Delete(ctx context.Context, lease leases.Lease, opts ...leases.DeleteOpt) error {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.Delete(ctx, lease, opts...)
+}
+
+func (l *Manager) List(ctx context.Context, filters ...string) ([]leases.Lease, error) {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.List(ctx, filters...)
+}
+
+func (l *Manager) AddResource(ctx context.Context, lease leases.Lease, resource leases.Resource) error {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.AddResource(ctx, lease, resource)
+}
+
+func (l *Manager) DeleteResource(ctx context.Context, lease leases.Lease, resource leases.Resource) error {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.DeleteResource(ctx, lease, resource)
+}
+
+func (l *Manager) ListResources(ctx context.Context, lease leases.Lease) ([]leases.Resource, error) {
+	ctx = namespaces.WithNamespace(ctx, l.ns)
+	return l.manager.ListResources(ctx, lease)
+}

vendor/github.com/moby/buildkit/util/system/path.go

@@ -37,8 +37,8 @@ func NormalizePath(parent, newPath, inputOS string, keepSlash bool) (string, err
 		inputOS = "linux"
 	}
 
-	newPath = toSlash(newPath, inputOS)
-	parent = toSlash(parent, inputOS)
+	newPath = ToSlash(newPath, inputOS)
+	parent = ToSlash(parent, inputOS)
 	origPath := newPath
 
 	if parent == "" {
@@ -82,18 +82,17 @@ func NormalizePath(parent, newPath, inputOS string, keepSlash bool) (string, err
 		}
 	}
 
-	return toSlash(newPath, inputOS), nil
+	return ToSlash(newPath, inputOS), nil
 }
 
-func toSlash(inputPath, inputOS string) string {
-	separator := "/"
-	if inputOS == "windows" {
-		separator = "\\"
+func ToSlash(inputPath, inputOS string) string {
+	if inputOS != "windows" {
+		return inputPath
 	}
-	return strings.Replace(inputPath, separator, "/", -1)
+	return strings.Replace(inputPath, "\\", "/", -1)
 }
 
-func fromSlash(inputPath, inputOS string) string {
+func FromSlash(inputPath, inputOS string) string {
 	separator := "/"
 	if inputOS == "windows" {
 		separator = "\\"
@@ -119,7 +118,7 @@ func NormalizeWorkdir(current, wd string, inputOS string) (string, error) {
 
 	// Make sure we use the platform specific path separator. HCS does not like forward
 	// slashes in CWD.
-	return fromSlash(wd, inputOS), nil
+	return FromSlash(wd, inputOS), nil
 }
 
 // IsAbs returns a boolean value indicating whether or not the path
@@ -142,7 +141,7 @@ func IsAbs(pth, inputOS string) bool {
 	if err != nil {
 		return false
 	}
-	cleanedPath = toSlash(cleanedPath, inputOS)
+	cleanedPath = ToSlash(cleanedPath, inputOS)
 	// We stripped any potential drive letter and converted any backslashes to
 	// forward slashes. We can safely use path.IsAbs() for both Windows and Linux.
 	return path.IsAbs(cleanedPath)
@@ -189,14 +188,14 @@ func CheckSystemDriveAndRemoveDriveLetter(path string, inputOS string) (string,
 	}
 
 	// UNC paths should error out
-	if len(path) >= 2 && toSlash(path[:2], inputOS) == "//" {
+	if len(path) >= 2 && ToSlash(path[:2], inputOS) == "//" {
 		return "", errors.Errorf("UNC paths are not supported")
 	}
 
 	parts := strings.SplitN(path, ":", 2)
 	// Path does not have a drive letter. Just return it.
 	if len(parts) < 2 {
-		return toSlash(filepath.Clean(path), inputOS), nil
+		return ToSlash(filepath.Clean(path), inputOS), nil
 	}
 
 	// We expect all paths to be in C:
@@ -221,5 +220,5 @@ func CheckSystemDriveAndRemoveDriveLetter(path string, inputOS string) (string,
 	//
 	// We must return the second element of the split path, as is, without attempting to convert
 	// it to an absolute path. We have no knowledge of the CWD; that is treated elsewhere.
-	return toSlash(filepath.Clean(parts[1]), inputOS), nil
+	return ToSlash(filepath.Clean(parts[1]), inputOS), nil
 }

vendor/github.com/moby/buildkit/util/testutil/integration/dockerd.go

@@ -137,6 +137,7 @@ func (c Moby) New(ctx context.Context, cfg *BackendConfig) (b Backend, cl func()
 	dockerdFlags := []string{
 		"--config-file", dockerdConfigFile,
 		"--userland-proxy=false",
+		"--tls=false",
 		"--debug",
 	}
 	if s := os.Getenv("BUILDKIT_INTEGRATION_DOCKERD_FLAGS"); s != "" {

vendor/github.com/moby/buildkit/util/wildcard/wildcard.go

@@ -0,0 +1,87 @@
+package wildcard
+
+import (
+	"regexp"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+// New returns a wildcard object for a string that contains "*" symbols.
+func New(s string) (*Wildcard, error) {
+	reStr, err := Wildcard2Regexp(s)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to translate wildcard %q to regexp", s)
+	}
+	re, err := regexp.Compile(reStr)
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to compile regexp %q (translated from wildcard %q)", reStr, s)
+	}
+	w := &Wildcard{
+		orig: s,
+		re:   re,
+	}
+	return w, nil
+}
+
+// Wildcard2Regexp translates a wildcard string to a regexp string.
+func Wildcard2Regexp(wildcard string) (string, error) {
+	s := regexp.QuoteMeta(wildcard)
+	if strings.Contains(s, "\\*\\*") {
+		return "", errors.New("invalid wildcard: \"**\"")
+	}
+	s = strings.ReplaceAll(s, "\\*", "(.*)")
+	s = "^" + s + "$"
+	return s, nil
+}
+
+// Wildcard is a wildcard matcher object.
+type Wildcard struct {
+	orig string
+	re   *regexp.Regexp
+}
+
+// String implements fmt.Stringer.
+func (w *Wildcard) String() string {
+	return w.orig
+}
+
+// Match returns a non-nil Match on match.
+func (w *Wildcard) Match(q string) *Match {
+	submatches := w.re.FindStringSubmatch(q)
+	if len(submatches) == 0 {
+		return nil
+	}
+	m := &Match{
+		w:          w,
+		Submatches: submatches,
+		// FIXME: avoid executing regexp twice
+		idx: w.re.FindStringSubmatchIndex(q),
+	}
+	return m
+}
+
+// Match is a matched result.
+type Match struct {
+	w          *Wildcard
+	Submatches []string // 0: the entire query, 1: the first submatch, 2: the second submatch, ...
+	idx        []int
+}
+
+// String implements fmt.Stringer.
+func (m *Match) String() string {
+	if len(m.Submatches) == 0 {
+		return ""
+	}
+	return m.Submatches[0]
+}
+
+// Format formats submatch strings like "$1", "$2".
+func (m *Match) Format(f string) (string, error) {
+	if m.w == nil || len(m.Submatches) == 0 || len(m.idx) == 0 {
+		return "", errors.New("invalid state")
+	}
+	var b []byte
+	b = m.w.re.ExpandString(b, f, m.Submatches[0], m.idx)
+	return string(b), nil
+}