Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package buildkit for openSUSE:Factory checked in at 2026-08-11 17:11:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/buildkit (Old) and /work/SRC/openSUSE:Factory/.buildkit.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "buildkit" Tue Aug 11 17:11:47 2026 rev:33 rq:1370469 version:0.32.2 Changes: -------- --- /work/SRC/openSUSE:Factory/buildkit/buildkit.changes 2026-08-09 21:41:58.571838539 +0200 +++ /work/SRC/openSUSE:Factory/.buildkit.new.17972/buildkit.changes 2026-08-11 17:12:59.659518037 +0200 @@ -1,0 +2,10 @@ +Mon Aug 10 04:50:02 UTC 2026 - Bharti Gautam <[email protected]> + +- Update to version 0.32.2: + * ci: use Docker Hub OIDC for buildkit images + * build(deps): bump github/codeql-action/upload-sarif + * ci: use Docker Hub OIDC for dockerfile-upstream image + * exporter: revert attestation manifest push order + * build(deps): bump docker/login-action from 4.5.2 to 4.6.0 + +------------------------------------------------------------------- Old: ---- buildkit-0.32.1.obscpio New: ---- buildkit-0.32.2.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ buildkit.spec ++++++ --- /var/tmp/diff_new_pack.k02JCn/_old 2026-08-11 17:13:05.071747299 +0200 +++ /var/tmp/diff_new_pack.k02JCn/_new 2026-08-11 17:13:05.075747468 +0200 @@ -23,7 +23,7 @@ %global provider_prefix %{provider}.%{provider_tld}/%{project}/%{repo} %global import_path %{provider_prefix} Name: buildkit -Version: 0.32.1 +Version: 0.32.2 Release: 0 Summary: Toolkit for converting source code to build artifacts License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.k02JCn/_old 2026-08-11 17:13:05.107748824 +0200 +++ /var/tmp/diff_new_pack.k02JCn/_new 2026-08-11 17:13:05.111748993 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/moby/buildkit.git</param> <param name="scm">git</param> <param name="filename">buildkit</param> - <param name="version">v0.32.1</param> + <param name="version">v0.32.2</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.k02JCn/_old 2026-08-11 17:13:05.135750010 +0200 +++ /var/tmp/diff_new_pack.k02JCn/_new 2026-08-11 17:13:05.139750180 +0200 @@ -1,7 +1,7 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/moby/buildkit.git</param> - <param name="changesrevision">ad8b7a721b434a3b9ecb4cc514fbe812f4751d45</param> + <param name="changesrevision">8f966671738d20a4e05e6e0f7fd344b9299ea6cd</param> </service> </servicedata> (No newline at EOF) ++++++ buildkit-0.32.1.obscpio -> buildkit-0.32.2.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/.github/workflows/buildkit.yml new/buildkit-0.32.2/.github/workflows/buildkit.yml --- old/buildkit-0.32.1/.github/workflows/buildkit.yml 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/.github/workflows/buildkit.yml 2026-08-06 14:57:14.000000000 +0200 @@ -160,7 +160,7 @@ - name: Upload SARIF report if: ${{ github.ref == 'refs/heads/master' && github.repository == 'moby/buildkit' }} - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: ${{ env.DESTDIR }}/govulncheck.out @@ -221,7 +221,7 @@ core.setOutput('includes', JSON.stringify(matrix)); image: - uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0 + uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 needs: - image-prepare - test @@ -231,7 +231,7 @@ include: ${{ fromJson(needs.image-prepare.outputs.includes) }} permissions: contents: read # same as global permission - id-token: write # for signing attestation(s) with GitHub OIDC Token + id-token: write # for signing attestations, cache entries and logging in to Docker Hub with GitHub OIDC with: runner: ubuntu-24.04 target: image-cross @@ -279,20 +279,18 @@ org.opencontainers.image.title=BuildKit org.opencontainers.image.vendor=Moby meta-bake-target: meta-helper - secrets: - registry-auths: | - - registry: docker.io - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: moby + connection_id: ${{ vars.BUILDKIT_OIDC_CONNECTIONID }} scout: runs-on: ubuntu-24.04 if: ${{ github.ref == 'refs/heads/master' && github.repository == 'moby/buildkit' }} permissions: - # same as global permission - contents: read - # required to write sarif report - security-events: write + contents: read # same as global permission + security-events: write # required to write sarif report needs: - image strategy: @@ -306,8 +304,9 @@ name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - + # FIXME: switch to OIDC once Scout supports it name: Login to DockerHub - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -325,7 +324,7 @@ jq . ${{ steps.scout.outputs.result-file }} - name: Upload SARIF report - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: ${{ steps.scout.outputs.result-file }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/.github/workflows/buildx-image.yml new/buildkit-0.32.2/.github/workflows/buildx-image.yml --- old/buildkit-0.32.1/.github/workflows/buildx-image.yml 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/.github/workflows/buildx-image.yml 2026-08-06 14:57:14.000000000 +0200 @@ -55,11 +55,12 @@ buildkitd-flags: --debug - name: Login to DockerHub - if: github.event.inputs.dry-run != 'true' - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 + if: ${{ !inputs['dry-run'] }} + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 + env: + DOCKERHUB_OIDC_CONNECTIONID: ${{ vars.BUILDKIT_OIDC_CONNECTIONID }} with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + username: moby - name: Create uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/.github/workflows/frontend.yml new/buildkit-0.32.2/.github/workflows/frontend.yml --- old/buildkit-0.32.1/.github/workflows/frontend.yml 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/.github/workflows/frontend.yml 2026-08-06 14:57:14.000000000 +0200 @@ -125,7 +125,7 @@ core.setOutput('includes', JSON.stringify(matrix)); image: - uses: docker/github-builder/.github/workflows/bake.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0 + uses: docker/github-builder/.github/workflows/bake.yml@a492c6d04fd3315f67230809b44d60cc0acd50b3 # v1.16.0 needs: - prepare - test @@ -135,7 +135,7 @@ include: ${{ fromJson(needs.prepare.outputs.includes) }} permissions: contents: read # same as global permission - id-token: write # for signing attestation(s) with GitHub OIDC Token + id-token: write # for signing attestations, cache entries and logging in to Docker Hub with GitHub OIDC with: runner: ubuntu-24.04 target: frontend-image-cross @@ -180,20 +180,18 @@ org.opencontainers.image.title=Dockerfile Frontend org.opencontainers.image.vendor=Moby meta-bake-target: frontend-meta-helper - secrets: - registry-auths: | - - registry: docker.io - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} + registry-identities: | + - type: dockerhub + registry: docker.io + username: docker + connection_id: ${{ vars.DOCKERFILE_OIDC_CONNECTIONID }} scout: runs-on: ubuntu-24.04 if: ${{ github.repository == 'moby/buildkit' && github.ref == 'refs/heads/master' }} permissions: - # same as global permission - contents: read - # required to write sarif report - security-events: write + contents: read # same as global permission + security-events: write # required to write sarif report needs: - image strategy: @@ -207,8 +205,9 @@ name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - + # FIXME: switch to OIDC once Scout supports it name: Login to DockerHub - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} @@ -226,7 +225,7 @@ jq . ${{ steps.scout.outputs.result-file }} - name: Upload SARIF report - uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: ${{ steps.scout.outputs.result-file }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/client/client_export_metadata_test.go new/buildkit-0.32.2/client/client_export_metadata_test.go --- old/buildkit-0.32.1/client/client_export_metadata_test.go 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/client/client_export_metadata_test.go 2026-08-06 14:57:14.000000000 +0200 @@ -5,17 +5,12 @@ "context" "encoding/json" "fmt" - "io" - "net/http" - "net/http/httptest" - "net/http/httputil" "net/url" "os" "path" "path/filepath" "strconv" "strings" - "sync" "testing" "time" @@ -673,7 +668,7 @@ require.Equal(t, ocispecs.MediaTypeImageIndex, imgs2.Index.MediaType) } -func testExportAttestations(t *testing.T, sb integration.Sandbox, ociArtifact bool, setOCIArtifact bool, strictSubjectRegistry bool) { +func testExportAttestations(t *testing.T, sb integration.Sandbox, ociArtifact bool, setOCIArtifact bool) { workers.CheckFeatureCompat(t, sb, workers.FeatureDirectPush) requiresLinux(t) c, err := New(sb.Context(), sb.Address()) @@ -686,12 +681,6 @@ } require.NoError(t, err) - var strictRegistry *strictSubjectRegistryProxy - if strictSubjectRegistry { - strictRegistry = newStrictSubjectRegistryProxy(t, registry) - registry = strictRegistry.host - } - ps := []ocispecs.Platform{ platforms.MustParse("linux/amd64"), platforms.MustParse("linux/arm64"), @@ -909,10 +898,6 @@ require.Equal(t, subjects, attest2.Subject) } - if strictRegistry != nil { - require.True(t, strictRegistry.sawSubjectManifest(), "expected an OCI artifact manifest with subject") - } - cdAddress := sb.ContainerdAddress() if cdAddress == "" { return @@ -929,10 +914,6 @@ checkAllReleasable(t, c, sb, true) }) - if strictRegistry != nil { - return // strict registry only exercises the image push path - } - t.Run("local", func(t *testing.T) { dir := t.TempDir() _, err = c.Build(sb.Context(), SolveOpt{ @@ -1041,19 +1022,15 @@ } func testExportAttestationsDefaultOCIArtifact(t *testing.T, sb integration.Sandbox) { - testExportAttestations(t, sb, false, false, false) + testExportAttestations(t, sb, false, false) } func testExportAttestationsImageManifest(t *testing.T, sb integration.Sandbox) { - testExportAttestations(t, sb, false, true, false) + testExportAttestations(t, sb, false, true) } func testExportAttestationsOCIArtifact(t *testing.T, sb integration.Sandbox) { - testExportAttestations(t, sb, true, true, false) -} - -func testExportAttestationsOCIArtifactSubjectPushOrder(t *testing.T, sb integration.Sandbox) { - testExportAttestations(t, sb, true, true, true) + testExportAttestations(t, sb, true, true) } func testImageResolveAttestationChainLocal(t *testing.T, sb integration.Sandbox) { @@ -2443,124 +2420,3 @@ return false } } - -type strictSubjectRegistryProxy struct { - host string - - mu sync.Mutex - manifests map[digest.Digest]struct{} - sawSubject bool -} - -func newStrictSubjectRegistryProxy(t *testing.T, registry string) *strictSubjectRegistryProxy { - t.Helper() - - target, err := url.Parse("http://"; + registry) - require.NoError(t, err) - - p := &strictSubjectRegistryProxy{ - manifests: map[digest.Digest]struct{}{}, - } - proxy := &httputil.ReverseProxy{ - Rewrite: func(pr *httputil.ProxyRequest) { - pr.SetURL(target) - pr.Out.Host = target.Host - }, - } - - s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.Method != http.MethodPut || !strings.Contains(r.URL.Path, "/manifests/") { - proxy.ServeHTTP(w, r) - return - } - - body, err := io.ReadAll(r.Body) - if err != nil { - http.Error(w, err.Error(), http.StatusBadRequest) - return - } - r.Body = io.NopCloser(bytes.NewReader(body)) - r.ContentLength = int64(len(body)) - - subject, err := manifestSubject(body) - if err != nil { - http.Error(w, err.Error(), http.StatusBadRequest) - return - } - if subject != "" && !p.hasManifest(subject) { - w.WriteHeader(http.StatusBadRequest) - _, _ = fmt.Fprintf(w, "unknown: blob unknown to registry - %s", subject) - return - } - - rw := &statusRecorder{ResponseWriter: w} - proxy.ServeHTTP(rw, r) - if rw.success() { - p.recordManifest(digest.FromBytes(body), subject) - } - })) - t.Cleanup(s.Close) - - p.host = strings.TrimPrefix(s.URL, "http://";) - return p -} - -func (p *strictSubjectRegistryProxy) hasManifest(dgst digest.Digest) bool { - p.mu.Lock() - defer p.mu.Unlock() - _, ok := p.manifests[dgst] - return ok -} - -func (p *strictSubjectRegistryProxy) recordManifest(dgst, subject digest.Digest) { - p.mu.Lock() - defer p.mu.Unlock() - p.manifests[dgst] = struct{}{} - p.sawSubject = p.sawSubject || subject != "" -} - -func (p *strictSubjectRegistryProxy) sawSubjectManifest() bool { - p.mu.Lock() - defer p.mu.Unlock() - return p.sawSubject -} - -func manifestSubject(dt []byte) (digest.Digest, error) { - var manifest struct { - Subject *ocispecs.Descriptor `json:"subject"` - } - if err := json.Unmarshal(dt, &manifest); err != nil { - return "", err - } - if manifest.Subject == nil { - return "", nil - } - return manifest.Subject.Digest, nil -} - -type statusRecorder struct { - http.ResponseWriter - status int -} - -func (r *statusRecorder) WriteHeader(status int) { - r.status = status - r.ResponseWriter.WriteHeader(status) -} - -func (r *statusRecorder) Write(dt []byte) (int, error) { - if r.status == 0 { - r.status = http.StatusOK - } - return r.ResponseWriter.Write(dt) -} - -func (r *statusRecorder) Flush() { - if f, ok := r.ResponseWriter.(http.Flusher); ok { - f.Flush() - } -} - -func (r *statusRecorder) success() bool { - return r.status == 0 || r.status >= http.StatusOK && r.status < http.StatusMultipleChoices -} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/client/client_test.go new/buildkit-0.32.2/client/client_test.go --- old/buildkit-0.32.1/client/client_test.go 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/client/client_test.go 2026-08-06 14:57:14.000000000 +0200 @@ -104,7 +104,6 @@ testExportAttestationsDefaultOCIArtifact, testExportAttestationsImageManifest, testExportAttestationsOCIArtifact, - testExportAttestationsOCIArtifactSubjectPushOrder, testImageResolveAttestationChainLocal, testImageResolveAttestationChainRequiresNetwork, testImageResolveProvenanceAttestation, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildkit-0.32.1/util/push/push.go new/buildkit-0.32.2/util/push/push.go --- old/buildkit-0.32.1/util/push/push.go 2026-08-03 12:15:03.000000000 +0200 +++ new/buildkit-0.32.2/util/push/push.go 2026-08-06 14:57:14.000000000 +0200 @@ -138,13 +138,8 @@ return err } - manifestStack, err = orderManifests(ctx, provider, manifestStack) - if err != nil { - return err - } - mfstDone := progress.OneOff(ctx, fmt.Sprintf("pushing manifest for %s", ref)) - for _, desc := range manifestStack { + for _, desc := range slices.Backward(manifestStack) { if _, err := pushHandler(ctx, desc); err != nil { return mfstDone(err) } @@ -152,56 +147,6 @@ return mfstDone(nil) } -// orderManifests returns manifests in push order. It preserves the existing -// child-before-parent behavior from reversing the dispatch stack, and also -// ensures that subjects present in the same push are uploaded before the -// manifests or indexes that reference them. -func orderManifests(ctx context.Context, provider content.Provider, manifests []ocispecs.Descriptor) ([]ocispecs.Descriptor, error) { - manifestByDigest := make(map[digest.Digest]ocispecs.Descriptor, len(manifests)) - for _, desc := range manifests { - manifestByDigest[desc.Digest] = desc - } - - ordered := make([]ocispecs.Descriptor, 0, len(manifests)) - visited := make(map[digest.Digest]struct{}, len(manifests)) - - var visit func(ocispecs.Descriptor) error - visit = func(desc ocispecs.Descriptor) error { - if _, ok := visited[desc.Digest]; ok { - return nil - } - visited[desc.Digest] = struct{}{} - if images.IsManifestType(desc.MediaType) || images.IsIndexType(desc.MediaType) { - p, err := content.ReadBlob(ctx, provider, desc) - if err != nil { - return err - } - var withSubject struct { - Subject *ocispecs.Descriptor `json:"subject"` - } - if err := json.Unmarshal(p, &withSubject); err != nil { - return err - } - if withSubject.Subject != nil { - if dep, ok := manifestByDigest[withSubject.Subject.Digest]; ok { - if err := visit(dep); err != nil { - return err - } - } - } - } - ordered = append(ordered, desc) - return nil - } - - for _, desc := range slices.Backward(manifests) { - if err := visit(desc); err != nil { - return nil, err - } - } - return ordered, nil -} - // TODO: the containerd function for this is filtering too much, that needs to be fixed. // For now we just carry this. func skipNonDistributableBlobs(f images.HandlerFunc) images.HandlerFunc { ++++++ buildkit.obsinfo ++++++ --- /var/tmp/diff_new_pack.k02JCn/_old 2026-08-11 17:13:13.680111949 +0200 +++ /var/tmp/diff_new_pack.k02JCn/_new 2026-08-11 17:13:13.684112118 +0200 @@ -1,5 +1,5 @@ name: buildkit -version: 0.32.1 -mtime: 1785752103 -commit: ad8b7a721b434a3b9ecb4cc514fbe812f4751d45 +version: 0.32.2 +mtime: 1786021034 +commit: 8f966671738d20a4e05e6e0f7fd344b9299ea6cd ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/buildkit/vendor.tar.zst /work/SRC/openSUSE:Factory/.buildkit.new.17972/vendor.tar.zst differ: char 7, line 1
