vendor: update buildkit to v0.16.0-rc1

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

vendor/github.com/moby/buildkit/client/llb/exec.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"sort"
+	"strings"
 
 	"github.com/moby/buildkit/solver/pb"
 	"github.com/moby/buildkit/util/system"
@@ -290,7 +291,7 @@ func (e *ExecOp) Marshal(ctx context.Context, c *Constraints) (digest.Digest, []
 	if len(e.secrets) > 0 {
 		addCap(&e.constraints, pb.CapExecMountSecret)
 		for _, s := range e.secrets {
-			if s.IsEnv {
+			if s.Env != nil {
 				addCap(&e.constraints, pb.CapExecSecretEnv)
 				break
 			}
@@ -388,15 +389,17 @@ func (e *ExecOp) Marshal(ctx context.Context, c *Constraints) (digest.Digest, []
 	}
 
 	for _, s := range e.secrets {
-		if s.IsEnv {
+		if s.Env != nil {
 			peo.Secretenv = append(peo.Secretenv, &pb.SecretEnv{
 				ID:       s.ID,
-				Name:     s.Target,
+				Name:     *s.Env,
 				Optional: s.Optional,
 			})
-		} else {
+		}
+		if s.Target != nil {
 			pm := &pb.Mount{
-				Dest:      s.Target,
+				Input:     pb.Empty,
+				Dest:      *s.Target,
 				MountType: pb.MountType_SECRET,
 				SecretOpt: &pb.SecretOpt{
 					ID:       s.ID,
@@ -412,6 +415,7 @@ func (e *ExecOp) Marshal(ctx context.Context, c *Constraints) (digest.Digest, []
 
 	for _, s := range e.ssh {
 		pm := &pb.Mount{
+			Input:     pb.Empty,
 			Dest:      s.Target,
 			MountType: pb.MountType_SSH,
 			SSHOpt: &pb.SSHOpt{
@@ -678,7 +682,19 @@ type SSHInfo struct {
 // AddSecret is a RunOption that adds a secret to the exec.
 func AddSecret(dest string, opts ...SecretOption) RunOption {
 	return runOptionFunc(func(ei *ExecInfo) {
-		s := &SecretInfo{ID: dest, Target: dest, Mode: 0400}
+		s := &SecretInfo{ID: dest, Target: &dest, Mode: 0400}
+		for _, opt := range opts {
+			opt.SetSecretOption(s)
+		}
+		ei.Secrets = append(ei.Secrets, *s)
+	})
+}
+
+// AddSecretWithDest is a RunOption that adds a secret to the exec
+// with an optional destination.
+func AddSecretWithDest(src string, dest *string, opts ...SecretOption) RunOption {
+	return runOptionFunc(func(ei *ExecInfo) {
+		s := &SecretInfo{ID: src, Target: dest, Mode: 0400}
 		for _, opt := range opts {
 			opt.SetSecretOption(s)
 		}
@@ -697,13 +713,15 @@ func (fn secretOptionFunc) SetSecretOption(si *SecretInfo) {
 }
 
 type SecretInfo struct {
-	ID       string
-	Target   string
+	ID string
+	// Target optionally specifies the target for the secret mount
+	Target *string
+	// Env optionally names the environment variable for the secret
+	Env      *string
 	Mode     int
 	UID      int
 	GID      int
 	Optional bool
-	IsEnv    bool
 }
 
 var SecretOptional = secretOptionFunc(func(si *SecretInfo) {
@@ -719,7 +737,24 @@ func SecretID(id string) SecretOption {
 // SecretAsEnv defines if the secret should be added as an environment variable
 func SecretAsEnv(v bool) SecretOption {
 	return secretOptionFunc(func(si *SecretInfo) {
-		si.IsEnv = v
+		if !v {
+			si.Env = nil
+			return
+		}
+		if si.Target == nil {
+			return
+		}
+		target := strings.Clone(*si.Target)
+		si.Env = &target
+		si.Target = nil
+	})
+}
+
+// SecretAsEnvName defines if the secret should be added as an environment variable
+// with the specified name
+func SecretAsEnvName(v string) SecretOption {
+	return secretOptionFunc(func(si *SecretInfo) {
+		si.Env = &v
 	})
 }
 

vendor/github.com/moby/buildkit/errdefs/errdefs.go

@@ -1,31 +0,0 @@
-package errdefs
-
-import "errors"
-
-type internalErr struct {
-	error
-}
-
-func (internalErr) System() {}
-
-func (err internalErr) Unwrap() error {
-	return err.error
-}
-
-type system interface {
-	System()
-}
-
-var _ system = internalErr{}
-
-func Internal(err error) error {
-	if err == nil {
-		return nil
-	}
-	return internalErr{err}
-}
-
-func IsInternal(err error) bool {
-	var s system
-	return errors.As(err, &s)
-}

vendor/github.com/moby/buildkit/errdefs/internal.go

@@ -0,0 +1,59 @@
+package errdefs
+
+import (
+	"errors"
+	"syscall"
+)
+
+type internalErr struct {
+	error
+}
+
+func (internalErr) System() {}
+
+func (err internalErr) Unwrap() error {
+	return err.error
+}
+
+type system interface {
+	System()
+}
+
+var _ system = internalErr{}
+
+func Internal(err error) error {
+	if err == nil {
+		return nil
+	}
+	return internalErr{err}
+}
+
+func IsInternal(err error) bool {
+	var s system
+	if errors.As(err, &s) {
+		return true
+	}
+
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		if _, ok := isInternalSyscall(errno); ok {
+			return true
+		}
+	}
+	return false
+}
+
+func IsResourceExhausted(err error) bool {
+	var errno syscall.Errno
+	if errors.As(err, &errno) {
+		if v, ok := isInternalSyscall(errno); ok && v {
+			return v
+		}
+	}
+	return false
+}
+
+func isInternalSyscall(err syscall.Errno) (bool, bool) {
+	v, ok := syscallErrors()[err]
+	return v, ok
+}

vendor/github.com/moby/buildkit/errdefs/internal_linux.go

@@ -0,0 +1,23 @@
+//go:build linux
+// +build linux
+
+package errdefs
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+// syscallErrors returns a map of syscall errors that are considered internal.
+// value is true if the error is of type resource exhaustion, false otherwise.
+func syscallErrors() map[syscall.Errno]bool {
+	return map[syscall.Errno]bool{
+		unix.EIO:             false, // I/O error
+		unix.ENOMEM:          true,  // Out of memory
+		unix.EFAULT:          false, // Bad address
+		unix.ENOSPC:          true,  // No space left on device
+		unix.ENOTRECOVERABLE: false, // State not recoverable
+		unix.EHWPOISON:       false, // Memory page has hardware error
+	}
+}

vendor/github.com/moby/buildkit/errdefs/internal_nolinux.go

@@ -0,0 +1,10 @@
+//go:build !linux
+// +build !linux
+
+package errdefs
+
+import "syscall"
+
+func syscallErrors() map[syscall.Errno]bool {
+	return nil
+}

vendor/github.com/moby/buildkit/frontend/dockerfile/linter/linter.go

@@ -10,42 +10,61 @@ import (
 )
 
 type Config struct {
-	Warn          LintWarnFunc
-	SkipRules     []string
-	SkipAll       bool
-	ReturnAsError bool
+	ExperimentalAll   bool
+	ExperimentalRules []string
+	ReturnAsError     bool
+	SkipAll           bool
+	SkipRules         []string
+	Warn              LintWarnFunc
 }
 
 type Linter struct {
-	SkippedRules  map[string]struct{}
-	CalledRules   []string
-	SkipAll       bool
-	ReturnAsError bool
-	Warn          LintWarnFunc
+	CalledRules       []string
+	ExperimentalAll   bool
+	ExperimentalRules map[string]struct{}
+	ReturnAsError     bool
+	SkipAll           bool
+	SkippedRules      map[string]struct{}
+	Warn              LintWarnFunc
 }
 
 func New(config *Config) *Linter {
 	toret := &Linter{
-		SkippedRules: map[string]struct{}{},
-		CalledRules:  []string{},
-		Warn:         config.Warn,
+		SkippedRules:      map[string]struct{}{},
+		ExperimentalRules: map[string]struct{}{},
+		CalledRules:       []string{},
+		Warn:              config.Warn,
 	}
 	toret.SkipAll = config.SkipAll
+	toret.ExperimentalAll = config.ExperimentalAll
 	toret.ReturnAsError = config.ReturnAsError
 	for _, rule := range config.SkipRules {
 		toret.SkippedRules[rule] = struct{}{}
 	}
+	for _, rule := range config.ExperimentalRules {
+		toret.ExperimentalRules[rule] = struct{}{}
+	}
 	return toret
 }
 
 func (lc *Linter) Run(rule LinterRuleI, location []parser.Range, txt ...string) {
-	if lc == nil || lc.Warn == nil || lc.SkipAll || rule.IsDeprecated() {
+	if lc == nil || lc.Warn == nil || rule.IsDeprecated() {
 		return
 	}
+
 	rulename := rule.RuleName()
-	if _, ok := lc.SkippedRules[rulename]; ok {
-		return
+	if rule.IsExperimental() {
+		_, experimentalOk := lc.ExperimentalRules[rulename]
+		if !(lc.ExperimentalAll || experimentalOk) {
+			return
+		}
+	} else {
+		_, skipOk := lc.SkippedRules[rulename]
+		if lc.SkipAll || skipOk {
+			return
+		}
 	}
+
 	lc.CalledRules = append(lc.CalledRules, rulename)
 	rule.Run(lc.Warn, location, txt...)
 }
@@ -72,14 +91,16 @@ type LinterRuleI interface {
 	RuleName() string
 	Run(warn LintWarnFunc, location []parser.Range, txt ...string)
 	IsDeprecated() bool
+	IsExperimental() bool
 }
 
 type LinterRule[F any] struct {
-	Name        string
-	Description string
-	Deprecated  bool
-	URL         string
-	Format      F
+	Name         string
+	Description  string
+	Deprecated   bool
+	Experimental bool
+	URL          string
+	Format       F
 }
 
 func (rule *LinterRule[F]) RuleName() string {
@@ -98,6 +119,10 @@ func (rule *LinterRule[F]) IsDeprecated() bool {
 	return rule.Deprecated
 }
 
+func (rule *LinterRule[F]) IsExperimental() bool {
+	return rule.Experimental
+}
+
 func LintFormatShort(rulename, msg string, line int) string {
 	msg = fmt.Sprintf("%s: %s", rulename, msg)
 	if line > 0 {
@@ -114,9 +139,9 @@ func ParseLintOptions(checkStr string) (*Config, error) {
 		return &Config{}, nil
 	}
 
-	parts := strings.SplitN(checkStr, ";", 2)
-	var skipSet []string
-	var errorOnWarn, skipAll bool
+	parts := strings.SplitN(checkStr, ";", 3)
+	var skipSet, experimentalSet []string
+	var errorOnWarn, skipAll, experimentalAll bool
 	for _, p := range parts {
 		k, v, ok := strings.Cut(p, "=")
 		if !ok {
@@ -134,6 +159,16 @@ func ParseLintOptions(checkStr string) (*Config, error) {
 					skipSet[i] = strings.TrimSpace(rule)
 				}
 			}
+		case "experimental":
+			v = strings.TrimSpace(v)
+			if v == "all" {
+				experimentalAll = true
+			} else {
+				experimentalSet = strings.Split(v, ",")
+				for i, rule := range experimentalSet {
+					experimentalSet[i] = strings.TrimSpace(rule)
+				}
+			}
 		case "error":
 			v, err := strconv.ParseBool(strings.TrimSpace(v))
 			if err != nil {
@@ -145,8 +180,10 @@ func ParseLintOptions(checkStr string) (*Config, error) {
 		}
 	}
 	return &Config{
-		SkipRules:     skipSet,
-		SkipAll:       skipAll,
-		ReturnAsError: errorOnWarn,
+		ExperimentalAll:   experimentalAll,
+		ExperimentalRules: experimentalSet,
+		SkipRules:         skipSet,
+		SkipAll:           skipAll,
+		ReturnAsError:     errorOnWarn,
 	}, nil
 }

vendor/github.com/moby/buildkit/frontend/dockerfile/linter/ruleset.go

@@ -163,5 +163,6 @@ var (
 		Format: func(cmd, file string) string {
 			return fmt.Sprintf("Attempting to %s file %q that is excluded by .dockerignore", cmd, file)
 		},
+		Experimental: true,
 	}
 )

vendor/github.com/moby/buildkit/frontend/dockerfile/shell/lex.go

@@ -378,6 +378,9 @@ func (sw *shellWord) processDollar() (string, error) {
 		fallthrough
 	case '+', '-', '?', '#', '%':
 		rawEscapes := ch == '#' || ch == '%'
+		if nullIsUnset && rawEscapes {
+			return "", errors.Errorf("unsupported modifier (%s) in substitution", chs)
+		}
 		word, _, err := sw.processStopOn('}', rawEscapes)
 		if err != nil {
 			if sw.scanner.Peek() == scanner.EOF {

vendor/github.com/moby/buildkit/frontend/dockerui/config.go

@@ -46,30 +46,28 @@ const (
 
 	// Don't forget to update frontend documentation if you add
 	// a new build-arg: frontend/dockerfile/docs/reference.md
-	keyCacheNSArg              = "build-arg:BUILDKIT_CACHE_MOUNT_NS"
-	keyMultiPlatformArg        = "build-arg:BUILDKIT_MULTI_PLATFORM"
-	keyHostnameArg             = "build-arg:BUILDKIT_SANDBOX_HOSTNAME"
-	keyDockerfileLintArg       = "build-arg:BUILDKIT_DOCKERFILE_CHECK"
-	keyContextKeepGitDirArg    = "build-arg:BUILDKIT_CONTEXT_KEEP_GIT_DIR"
-	keySourceDateEpoch         = "build-arg:SOURCE_DATE_EPOCH"
-	keyCopyIgnoredCheckEnabled = "build-arg:BUILDKIT_DOCKERFILE_CHECK_COPYIGNORED_EXPERIMENT"
+	keyCacheNSArg           = "build-arg:BUILDKIT_CACHE_MOUNT_NS"
+	keyMultiPlatformArg     = "build-arg:BUILDKIT_MULTI_PLATFORM"
+	keyHostnameArg          = "build-arg:BUILDKIT_SANDBOX_HOSTNAME"
+	keyDockerfileLintArg    = "build-arg:BUILDKIT_DOCKERFILE_CHECK"
+	keyContextKeepGitDirArg = "build-arg:BUILDKIT_CONTEXT_KEEP_GIT_DIR"
+	keySourceDateEpoch      = "build-arg:SOURCE_DATE_EPOCH"
 )
 
 type Config struct {
-	BuildArgs               map[string]string
-	CacheIDNamespace        string
-	CgroupParent            string
-	Epoch                   *time.Time
-	ExtraHosts              []llb.HostIP
-	Hostname                string
-	ImageResolveMode        llb.ResolveMode
-	Labels                  map[string]string
-	NetworkMode             pb.NetMode
-	ShmSize                 int64
-	Target                  string
-	Ulimits                 []pb.Ulimit
-	LinterConfig            *linter.Config
-	CopyIgnoredCheckEnabled bool
+	BuildArgs        map[string]string
+	CacheIDNamespace string
+	CgroupParent     string
+	Epoch            *time.Time
+	ExtraHosts       []llb.HostIP
+	Hostname         string
+	ImageResolveMode llb.ResolveMode
+	Labels           map[string]string
+	NetworkMode      pb.NetMode
+	ShmSize          int64
+	Target           string
+	Ulimits          []pb.Ulimit
+	LinterConfig     *linter.Config
 
 	CacheImports           []client.CacheOptionsEntry
 	TargetPlatforms        []ocispecs.Platform // nil means default
@@ -291,16 +289,6 @@ func (bc *Client) init() error {
 		}
 	}
 
-	// CopyIgnoredCheckEnabled is an experimental feature to check if COPY is ignored by .dockerignore,
-	// and it is disabled by default. It is expected that this feature will be enabled by default in a future
-	// release, and this build-arg will be removed.
-	if v, ok := opts[keyCopyIgnoredCheckEnabled]; ok {
-		bc.CopyIgnoredCheckEnabled, err = strconv.ParseBool(v)
-		if err != nil {
-			return errors.Wrapf(err, "failed to parse %s", keyCopyIgnoredCheckEnabled)
-		}
-	}
-
 	bc.localsSessionIDs = parseLocalSessionIDs(opts)
 
 	return nil

vendor/github.com/moby/buildkit/frontend/dockerui/requests.go

@@ -66,7 +66,7 @@ func (bc *Client) HandleSubrequest(ctx context.Context, h RequestHandler) (*clie
 			if warnings == nil {
 				return nil, true, nil
 			}
-			res, err := warnings.ToResult()
+			res, err := warnings.ToResult(nil)
 			return res, true, err
 		}
 	}

vendor/github.com/moby/buildkit/frontend/subrequests/lint/lint.go

@@ -16,6 +16,8 @@ import (
 	"github.com/pkg/errors"
 )
 
+type SourceInfoMap func(*pb.SourceInfo) *pb.SourceInfo
+
 const RequestLint = "frontend.lint"
 
 var SubrequestLintDefinition = subrequests.Request{
@@ -39,6 +41,27 @@ type Warning struct {
 	Location    pb.Location `json:"location,omitempty"`
 }
 
+func (w *Warning) PrintTo(wr io.Writer, sources []*pb.SourceInfo, scb SourceInfoMap) error {
+	fmt.Fprintf(wr, "\nWARNING: %s", w.RuleName)
+	if w.URL != "" {
+		fmt.Fprintf(wr, " - %s", w.URL)
+	}
+	fmt.Fprintf(wr, "\n%s\n", w.Detail)
+
+	if w.Location.SourceIndex < 0 {
+		return nil
+	}
+	sourceInfo := sources[w.Location.SourceIndex]
+	if scb != nil {
+		sourceInfo = scb(sourceInfo)
+	}
+	source := errdefs.Source{
+		Info:   sourceInfo,
+		Ranges: w.Location.Ranges,
+	}
+	return source.Print(wr)
+}
+
 type BuildError struct {
 	Message  string      `json:"message"`
 	Location pb.Location `json:"location"`
@@ -93,7 +116,7 @@ func (results *LintResults) AddWarning(rulename, description, url, fmtmsg string
 	})
 }
 
-func (results *LintResults) ToResult() (*client.Result, error) {
+func (results *LintResults) ToResult(scb SourceInfoMap) (*client.Result, error) {
 	res := client.NewResult()
 	dt, err := json.MarshalIndent(results, "", "  ")
 	if err != nil {
@@ -102,7 +125,7 @@ func (results *LintResults) ToResult() (*client.Result, error) {
 	res.AddMeta("result.json", dt)
 
 	b := bytes.NewBuffer(nil)
-	if err := PrintLintViolations(dt, b); err != nil {
+	if err := PrintLintViolations(dt, b, scb); err != nil {
 		return nil, err
 	}
 	res.AddMeta("result.txt", b.Bytes())
@@ -117,28 +140,7 @@ func (results *LintResults) ToResult() (*client.Result, error) {
 	return res, nil
 }
 
-func (results *LintResults) validateWarnings() error {
-	for _, warning := range results.Warnings {
-		if int(warning.Location.SourceIndex) >= len(results.Sources) {
-			return errors.Errorf("sourceIndex is out of range")
-		}
-		if warning.Location.SourceIndex > 0 {
-			warningSource := results.Sources[warning.Location.SourceIndex]
-			if warningSource == nil {
-				return errors.Errorf("sourceIndex points to nil source")
-			}
-		}
-	}
-	return nil
-}
-
-func PrintLintViolations(dt []byte, w io.Writer) error {
-	var results LintResults
-
-	if err := json.Unmarshal(dt, &results); err != nil {
-		return err
-	}
-
+func (results *LintResults) PrintTo(w io.Writer, scb SourceInfoMap) error {
 	if err := results.validateWarnings(); err != nil {
 		return err
 	}
@@ -169,21 +171,7 @@ func PrintLintViolations(dt []byte, w io.Writer) error {
 	})
 
 	for _, warning := range results.Warnings {
-		fmt.Fprintf(w, "\nWARNING: %s", warning.RuleName)
-		if warning.URL != "" {
-			fmt.Fprintf(w, " - %s", warning.URL)
-		}
-		fmt.Fprintf(w, "\n%s\n", warning.Detail)
-
-		if warning.Location.SourceIndex < 0 {
-			continue
-		}
-		sourceInfo := results.Sources[warning.Location.SourceIndex]
-		source := errdefs.Source{
-			Info:   sourceInfo,
-			Ranges: warning.Location.Ranges,
-		}
-		err := source.Print(w)
+		err := warning.PrintTo(w, results.Sources, scb)
 		if err != nil {
 			return err
 		}
@@ -192,6 +180,47 @@ func PrintLintViolations(dt []byte, w io.Writer) error {
 	return nil
 }
 
+func (results *LintResults) PrintErrorTo(w io.Writer) {
+	// This prints out the error in LintResults to the writer in a format that
+	// is consistent with the warnings for easier downstream consumption.
+	if results.Error == nil {
+		return
+	}
+
+	fmt.Fprintln(w, results.Error.Message)
+	sourceInfo := results.Sources[results.Error.Location.SourceIndex]
+	source := errdefs.Source{
+		Info:   sourceInfo,
+		Ranges: results.Error.Location.Ranges,
+	}
+	source.Print(w)
+}
+
+func (results *LintResults) validateWarnings() error {
+	for _, warning := range results.Warnings {
+		if int(warning.Location.SourceIndex) >= len(results.Sources) {
+			return errors.Errorf("sourceIndex is out of range")
+		}
+		if warning.Location.SourceIndex > 0 {
+			warningSource := results.Sources[warning.Location.SourceIndex]
+			if warningSource == nil {
+				return errors.Errorf("sourceIndex points to nil source")
+			}
+		}
+	}
+	return nil
+}
+
+func PrintLintViolations(dt []byte, w io.Writer, scb SourceInfoMap) error {
+	var results LintResults
+
+	if err := json.Unmarshal(dt, &results); err != nil {
+		return err
+	}
+
+	return results.PrintTo(w, scb)
+}
+
 func sourceInfoEqual(a, b *pb.SourceInfo) bool {
 	if a.Filename != b.Filename || a.Language != b.Language {
 		return false

vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go

@@ -32,7 +32,7 @@ func (sp *secretProvider) GetSecret(ctx context.Context, req *secrets.GetSecretR
 	dt, err := sp.store.GetSecret(ctx, req.ID)
 	if err != nil {
 		if errors.Is(err, secrets.ErrNotFound) {
-			return nil, status.Errorf(codes.NotFound, err.Error())
+			return nil, status.Error(codes.NotFound, err.Error())
 		}
 		return nil, err
 	}

vendor/github.com/moby/buildkit/session/upload/uploadprovider/provider.go

@@ -13,15 +13,15 @@ import (
 )
 
 func New() *Uploader {
-	return &Uploader{m: map[string]io.Reader{}}
+	return &Uploader{m: map[string]io.ReadCloser{}}
 }
 
 type Uploader struct {
 	mu sync.Mutex
-	m  map[string]io.Reader
+	m  map[string]io.ReadCloser
 }
 
-func (hp *Uploader) Add(r io.Reader) string {
+func (hp *Uploader) Add(r io.ReadCloser) string {
 	id := identity.NewID()
 	hp.m[id] = r
 	return "http://buildkit-session/" + id
@@ -51,6 +51,11 @@ func (hp *Uploader) Pull(stream upload.Upload_PullServer) error {
 	hp.mu.Unlock()
 
 	_, err := io.Copy(&writer{stream}, r)
+
+	if err1 := r.Close(); err == nil {
+		err = err1
+	}
+
 	return err
 }
 

vendor/github.com/moby/buildkit/util/appcontext/appcontext.go

@@ -38,7 +38,7 @@ func Context() context.Context {
 				err := errors.Errorf("got %d SIGTERM/SIGINTs, forcing shutdown", retries)
 				cancel(err)
 				if retries >= exitLimit {
-					bklog.G(ctx).Errorf(err.Error())
+					bklog.G(ctx).Error(err.Error())
 					os.Exit(1)
 				}
 			}

vendor/github.com/moby/buildkit/util/appdefaults/appdefaults_linux.go

@@ -0,0 +1,6 @@
+package appdefaults
+
+const (
+	Address         = "unix:///run/buildkit/buildkitd.sock"
+	traceSocketPath = "/run/buildkit/otel-grpc.sock"
+)

vendor/github.com/moby/buildkit/util/appdefaults/appdefaults_unix.go

@@ -10,7 +10,6 @@ import (
 )
 
 const (
-	Address              = "unix:///run/buildkit/buildkitd.sock"
 	Root                 = "/var/lib/buildkit"
 	ConfigDir            = "/etc/buildkit"
 	DefaultCNIBinDir     = "/opt/cni/bin"
@@ -82,5 +81,5 @@ func TraceSocketPath(inUserNS bool) string {
 			return filepath.Join(dirs[0], "buildkit", "otel-grpc.sock")
 		}
 	}
-	return "/run/buildkit/otel-grpc.sock"
+	return traceSocketPath
 }

vendor/github.com/moby/buildkit/util/appdefaults/appdefaults_unix_nolinux.go

@@ -0,0 +1,8 @@
+//go:build unix && !linux
+
+package appdefaults
+
+const (
+	Address         = "unix:///var/run/buildkit/buildkitd.sock"
+	traceSocketPath = "/var/run/buildkit/otel-grpc.sock"
+)

vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go

@@ -96,6 +96,9 @@ func withDetails(ctx context.Context, s *status.Status, details ...proto.Message
 
 func Code(err error) codes.Code {
 	if errdefs.IsInternal(err) {
+		if errdefs.IsResourceExhausted(err) {
+			return codes.ResourceExhausted
+		}
 		return codes.Internal
 	}
 

vendor/github.com/moby/buildkit/util/resolver/retryhandler/retry.go

@@ -64,7 +64,7 @@ func retryError(err error) bool {
 		return true
 	}
 	// catches TLS timeout or other network-related temporary errors
-	if ne := net.Error(nil); errors.As(err, &ne) && ne.Temporary() { //nolint:staticcheck // ignoring "SA1019: Temporary is deprecated", continue to propagate net.Error through the "temporary" status
+	if ne := net.Error(nil); errors.As(err, &ne) && ne.Temporary() { // ignoring "SA1019: Temporary is deprecated", continue to propagate net.Error through the "temporary" status
 		return true
 	}
 

vendor/github.com/moby/buildkit/util/stack/compress.go

@@ -0,0 +1,67 @@
+package stack
+
+import (
+	"slices"
+)
+
+func compressStacks(st []*Stack) []*Stack {
+	if len(st) == 0 {
+		return nil
+	}
+
+	slices.SortFunc(st, func(a, b *Stack) int {
+		return len(b.Frames) - len(a.Frames)
+	})
+
+	out := []*Stack{st[0]}
+
+loop0:
+	for _, st := range st[1:] {
+		maxIdx := -1
+		for _, prev := range out {
+			idx := subFrames(st.Frames, prev.Frames)
+			if idx == -1 {
+				continue
+			}
+			// full match, potentially skip all
+			if idx == len(st.Frames)-1 {
+				if st.Pid == prev.Pid && st.Version == prev.Version && slices.Compare(st.Cmdline, st.Cmdline) == 0 {
+					continue loop0
+				}
+			}
+			if idx > maxIdx {
+				maxIdx = idx
+			}
+		}
+
+		if maxIdx > 0 {
+			st.Frames = st.Frames[:len(st.Frames)-maxIdx]
+		}
+		out = append(out, st)
+	}
+
+	return out
+}
+
+func subFrames(a, b []*Frame) int {
+	idx := -1
+	i := len(a) - 1
+	j := len(b) - 1
+	for i >= 0 {
+		if j < 0 {
+			break
+		}
+		if a[i].Equal(b[j]) {
+			idx++
+			i--
+			j--
+		} else {
+			break
+		}
+	}
+	return idx
+}
+
+func (a *Frame) Equal(b *Frame) bool {
+	return a.File == b.File && a.Line == b.Line && a.Name == b.Name
+}

vendor/github.com/moby/buildkit/util/stack/stack.go

@@ -44,6 +44,10 @@ func Helper() {
 }
 
 func Traces(err error) []*Stack {
+	return compressStacks(traces(err))
+}
+
+func traces(err error) []*Stack {
 	var st []*Stack
 
 	switch e := err.(type) {

vendor/github.com/moby/buildkit/util/testutil/integration/run.go

@@ -220,7 +220,7 @@ func Run(t *testing.T, testCases []Test, opt ...TestOpt) {
 func getFunctionName(i interface{}) string {
 	fullname := runtime.FuncForPC(reflect.ValueOf(i).Pointer()).Name()
 	dot := strings.LastIndex(fullname, ".") + 1
-	return strings.Title(fullname[dot:]) //nolint:staticcheck // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
+	return strings.Title(fullname[dot:]) // ignoring "SA1019: strings.Title is deprecated", as for our use we don't need full unicode support
 }
 
 var localImageCache map[string]map[string]struct{}

vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go

@@ -59,6 +59,8 @@ func (sb *sandbox) NewRegistry() (string, error) {
 
 func (sb *sandbox) Cmd(args ...string) *exec.Cmd {
 	if len(args) == 1 {
+		// \\ being stripped off for Windows paths, convert to unix style
+		args[0] = strings.ReplaceAll(args[0], "\\", "/")
 		if split, err := shlex.Split(args[0]); err == nil {
 			args = split
 		}
@@ -151,7 +153,7 @@ func FormatLogs(m map[string]*bytes.Buffer) string {
 func CheckFeatureCompat(t *testing.T, sb Sandbox, features map[string]struct{}, reason ...string) {
 	t.Helper()
 	if err := HasFeatureCompat(t, sb, features, reason...); err != nil {
-		t.Skipf(err.Error())
+		t.Skip(err.Error())
 	}
 }
 

vendor/github.com/moby/buildkit/util/testutil/integration/util_windows.go

@@ -16,6 +16,10 @@ var windowsImagesMirrorMap = map[string]string{
 	"nanoserver:latest": "mcr.microsoft.com/windows/nanoserver:ltsc2022",
 	"servercore:latest": "mcr.microsoft.com/windows/servercore:ltsc2022",
 	"busybox:latest":    "registry.k8s.io/e2e-test-images/busybox@sha256:6d854ffad9666d2041b879a1c128c9922d77faced7745ad676639b07111ab650",
+	// nanoserver with extra binaries, like fc.exe
+	// TODO(profnandaa): get an approved/compliant repo, placeholder for now
+	// see dockerfile here - https://github.com/microsoft/windows-container-tools/pull/178
+	"nanoserver:plus": "docker.io/wintools/nanoserver:ltsc2022",
 }
 
 // abstracted function to handle pipe dialing on windows.

vendor/github.com/moby/sys/mountinfo/mounted_linux.go

@@ -51,7 +51,7 @@ func mountedByOpenat2(path string) (bool, error) {
 		Resolve: unix.RESOLVE_NO_XDEV,
 	})
 	_ = unix.Close(dirfd)
-	switch err { //nolint:errorlint // unix errors are bare
+	switch err {
 	case nil: // definitely not a mount
 		_ = unix.Close(fd)
 		return false, nil

vendor/github.com/moby/sys/userns/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

vendor/github.com/moby/sys/userns/userns.go

@@ -0,0 +1,16 @@
+// Package userns provides utilities to detect whether we are currently running
+// in a Linux user namespace.
+//
+// This code was migrated from [libcontainer/runc], which based its implementation
+// on code from [lcx/incus].
+//
+// [libcontainer/runc]: https://github.com/opencontainers/runc/blob/3778ae603c706494fd1e2c2faf83b406e38d687d/libcontainer/userns/userns_linux.go#L12-L49
+// [lcx/incus]: https://github.com/lxc/incus/blob/e45085dd42f826b3c8c3228e9733c0b6f998eafe/shared/util.go#L678-L700
+package userns
+
+// RunningInUserNS detects whether we are currently running in a Linux
+// user namespace and memoizes the result. It returns false on non-Linux
+// platforms.
+func RunningInUserNS() bool {
+	return inUserNS()
+}

vendor/github.com/moby/sys/userns/userns_linux.go

@@ -0,0 +1,53 @@
+package userns
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"sync"
+)
+
+var inUserNS = sync.OnceValue(runningInUserNS)
+
+// runningInUserNS detects whether we are currently running in a user namespace.
+//
+// This code was migrated from [libcontainer/runc] and based on an implementation
+// from [lcx/incus].
+//
+// [libcontainer/runc]: https://github.com/opencontainers/runc/blob/3778ae603c706494fd1e2c2faf83b406e38d687d/libcontainer/userns/userns_linux.go#L12-L49
+// [lcx/incus]: https://github.com/lxc/incus/blob/e45085dd42f826b3c8c3228e9733c0b6f998eafe/shared/util.go#L678-L700
+func runningInUserNS() bool {
+	file, err := os.Open("/proc/self/uid_map")
+	if err != nil {
+		// This kernel-provided file only exists if user namespaces are supported.
+		return false
+	}
+	defer file.Close()
+
+	buf := bufio.NewReader(file)
+	l, _, err := buf.ReadLine()
+	if err != nil {
+		return false
+	}
+
+	return uidMapInUserNS(string(l))
+}
+
+func uidMapInUserNS(uidMap string) bool {
+	if uidMap == "" {
+		// File exist but empty (the initial state when userns is created,
+		// see user_namespaces(7)).
+		return true
+	}
+
+	var a, b, c int64
+	if _, err := fmt.Sscanf(uidMap, "%d %d %d", &a, &b, &c); err != nil {
+		// Assume we are in a regular, non user namespace.
+		return false
+	}
+
+	// As per user_namespaces(7), /proc/self/uid_map of
+	// the initial user namespace shows 0 0 4294967295.
+	initNS := a == 0 && b == 0 && c == 4294967295
+	return !initNS
+}

vendor/github.com/moby/sys/userns/userns_linux_fuzzer.go

@@ -0,0 +1,8 @@
+//go:build linux && gofuzz
+
+package userns
+
+func FuzzUIDMap(uidmap []byte) int {
+	_ = uidMapInUserNS(string(uidmap))
+	return 1
+}

vendor/github.com/moby/sys/userns/userns_unsupported.go

@@ -0,0 +1,6 @@
+//go:build !linux
+
+package userns
+
+// inUserNS is a stub for non-Linux systems. Always returns false.
+func inUserNS() bool { return false }