14 Commits

Author SHA1 Message Date
Tonis Tiigi
d5d3d3d502
lint: apply x/tools/modernize fixes
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2025-03-07 16:37:24 -08:00
Tonis Tiigi
44fa243d58
vendor: update buildkit to v0.19.0-rc1
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2025-01-14 14:24:38 -08:00
Tonis Tiigi
f374f64d2f
vendor: update buildkit to f7bda278b7e2
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2024-07-02 22:24:55 -07:00
Laurent Goderre
1d0b542b1b Add unit test for SBOM and Provenance scanning
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
2024-03-05 13:15:21 -05:00
Tonis Tiigi
dcdcce6c52
imagetools: supress warnings for dsse mediatypes
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2024-02-28 19:25:42 -08:00
Laurent Goderre
b748185f48 Add support for DSSE envelope for attestation and provenance in imagetools
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
2024-02-28 16:45:51 -05:00
Sebastiaan van Stijn
bafdc63b8c
migrate to github.com/distribution/reference v0.5.0
The "reference" package was moved to a separate module, which was extracted
from b9b19409cf

Also update compose-go, which also switched to distribution/reference;

full diff: https://github.com/compose-spec/compose-go/compare/v1.18.3...v1.18.4

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-09-06 17:41:35 +02:00
Justin Chadwell
642f28f439 imagetools: process com.docker.reference.* annotations
To give us the option later down the road of producing recommended OCI
names in BuildKit (using com instead of vnd, woops), we need to update
Buildx to be able to process both.

Ideally, if a Buildx/BuildKit release hadn't been made we could just
switch over, but since we have, we'd need to support both (at least for
a while, eventually we could consider deprecating+removing the vnd
variant).

Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-02-14 11:24:40 +00:00
Justin Chadwell
56950ece69 inspect: lazily load attestation data
Delay loading the attestation data immediately, and only compute it upon
request. We do this using a deferred function which allows to define the
computation in the same place as before, but perform the computation
later.

With this patch, we ensure that the attestation data is only pulled from
the remote if it is actually referenced in the format string -
otherwise, we can skip it, for improved performance.

Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-10 13:00:42 +00:00
Justin Chadwell
484823c97d inspect: change additional spdxs to not have duplicates
Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-09 19:03:23 +00:00
Justin Chadwell
3ce17b01dc inspect: provide access to multiple spdx documents
Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-09 18:42:26 +00:00
Justin Chadwell
e68c566c1c inspect: parse sbom and provenance into json structs
Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-09 18:09:43 +00:00
Justin Chadwell
19d16aa941 inspect: break after first matching attestation
Signed-off-by: Justin Chadwell <me@jedevc.com>
2023-01-09 18:09:06 +00:00
CrazyMax
e6b9aba997
imagetools inspect: handle provenance and sbom
use stub structs for SLSA/SBOM while waiting for
go-imageinspect library to be public.

Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2023-01-05 17:34:30 +01:00