Skip to content

Commit 8601274

Browse files
tonistiigitonistiigi
authored
Merge pull request #3998 from crazy-max/split-builder-policy-verifier
avoid policy dependency from builder loading
2 parents b777294 + 6b9f532 commit 8601274

12 files changed

Lines changed: 70 additions & 38 deletions

File tree

‎builder/builder.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,7 @@ type CreateOpts struct {
347347
Endpoint string
348348
Append bool
349349
Timeout time.Duration
350+
ImageVerifier driver.ImageVerifier
350351
}
351352

352353
func updateNodeGroup(ctx context.Context, factory driver.Factory, ng *store.NodeGroup, node driver.Node, appendNode bool, buildkitdFlags []string, buildkitdConfigFile string) error {
@@ -609,7 +610,7 @@ func Create(ctx context.Context, txn *store.Txn, dockerCli command.Cli, opts Cre
609610
}
610611
defer func() { cancel(errors.WithStack(context.Canceled)) }()
611612

612-
nodes, err := b.LoadNodes(timeoutCtx, WithData())
613+
nodes, err := b.LoadNodes(timeoutCtx, WithData(), WithImageVerifier(opts.ImageVerifier))
613614
if err != nil {
614615
return nil, err
615616
}

‎builder/node.go‎

Lines changed: 12 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,15 @@ import (
88

99
"github.com/containerd/platforms"
1010
"github.com/docker/buildx/driver"
11-
"github.com/docker/buildx/policy"
1211
"github.com/docker/buildx/store"
1312
"github.com/docker/buildx/store/storeutil"
14-
"github.com/docker/buildx/util/confutil"
1513
"github.com/docker/buildx/util/dockerutil"
1614
"github.com/docker/buildx/util/imagetools"
1715
"github.com/docker/buildx/util/platformutil"
1816
"github.com/moby/buildkit/client"
1917
"github.com/moby/buildkit/util/grpcerrors"
20-
digest "github.com/opencontainers/go-digest"
2118
ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
2219
"github.com/pkg/errors"
23-
"github.com/sirupsen/logrus"
2420
"golang.org/x/sync/errgroup"
2521
"google.golang.org/grpc/codes"
2622
)
@@ -51,10 +47,11 @@ func (b *Builder) Nodes() []Node {
5147
type LoadNodesOption func(*loadNodesOptions)
5248

5349
type loadNodesOptions struct {
54-
data bool
55-
skipImageOpt bool
56-
dialMeta map[string][]string
57-
clientOpt []client.ClientOpt
50+
data bool
51+
skipImageOpt bool
52+
dialMeta map[string][]string
53+
clientOpt []client.ClientOpt
54+
imageVerifier driver.ImageVerifier
5855
}
5956

6057
func WithData() LoadNodesOption {
@@ -81,6 +78,12 @@ func WithClientOpt(clientOpt ...client.ClientOpt) LoadNodesOption {
8178
}
8279
}
8380

81+
func WithImageVerifier(imageVerifier driver.ImageVerifier) LoadNodesOption {
82+
return func(o *loadNodesOptions) {
83+
o.imageVerifier = imageVerifier
84+
}
85+
}
86+
8487
// LoadNodes loads and returns nodes for this builder.
8588
// TODO: this should be a method on a Node object and lazy load data for each driver.
8689
func (b *Builder) LoadNodes(ctx context.Context, opts ...LoadNodesOption) (_ []Node, err error) {
@@ -113,19 +116,6 @@ func (b *Builder) LoadNodes(ctx context.Context, opts ...LoadNodesOption) (_ []N
113116
}
114117
}
115118

116-
var imageVerifier driver.ImageVerifier
117-
if policy.DefaultPolicyEnabled() {
118-
pol := policy.DefaultPolicy(policy.Opt{
119-
Log: func(_ logrus.Level, msg string) {
120-
logrus.Debug(msg)
121-
},
122-
VerifierProvider: policy.SignatureVerifier(confutil.NewConfig(b.opts.dockerCli)),
123-
})
124-
imageVerifier = func(ctx context.Context, ref string, platform *ocispecs.Platform, resolver policy.SourceMetadataResolver) (digest.Digest, error) {
125-
return pol.CheckSource(ctx, ref, platform, resolver)
126-
}
127-
}
128-
129119
for i, n := range b.NodeGroup.Nodes {
130120
func(i int, n store.Node) {
131121
eg.Go(func() error {
@@ -154,7 +144,7 @@ func (b *Builder) LoadNodes(ctx context.Context, opts ...LoadNodesOption) (_ []N
154144
Files: n.Files,
155145
DriverOpts: n.DriverOpts,
156146
Auth: imageopt.Auth,
157-
ImageVerifier: imageVerifier,
147+
ImageVerifier: lno.imageVerifier,
158148
Platforms: n.Platforms,
159149
ContextPathHash: b.opts.contextPathHash,
160150
DialMeta: lno.dialMeta,

‎commands/bake.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"github.com/docker/buildx/build"
2626
"github.com/docker/buildx/builder"
2727
"github.com/docker/buildx/localstate"
28+
"github.com/docker/buildx/policy"
2829
"github.com/docker/buildx/util/buildflags"
2930
"github.com/docker/buildx/util/cobrautil"
3031
"github.com/docker/buildx/util/cobrautil/completion"
@@ -168,7 +169,8 @@ func runBake(ctx context.Context, dockerCli command.Cli, targets []string, in ba
168169
if err = updateLastActivity(dockerCli, b.NodeGroup); err != nil {
169170
return errors.Wrapf(err, "failed to update builder last activity time")
170171
}
171-
nodes, err = b.LoadNodes(ctx)
172+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
173+
nodes, err = b.LoadNodes(ctx, builder.WithImageVerifier(imageVerifier))
172174
if err != nil {
173175
return err
174176
}

‎commands/build.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"github.com/containerd/containerd/v2/pkg/epoch"
2222
"github.com/docker/buildx/build"
2323
"github.com/docker/buildx/builder"
24+
"github.com/docker/buildx/policy"
2425
"github.com/docker/buildx/store"
2526
"github.com/docker/buildx/store/storeutil"
2627
"github.com/docker/buildx/util/buildflags"
@@ -356,7 +357,8 @@ func runBuild(ctx context.Context, dockerCli command.Cli, debugOpts debuggerOpti
356357
if err != nil {
357358
return err
358359
}
359-
_, err = b.LoadNodes(ctx)
360+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
361+
_, err = b.LoadNodes(ctx, builder.WithImageVerifier(imageVerifier))
360362
if err != nil {
361363
return err
362364
}
@@ -1193,7 +1195,8 @@ func RunBuild(ctx context.Context, dockerCli command.Cli, in *BuildOptions, inSt
11931195
if err = updateLastActivity(dockerCli, b.NodeGroup); err != nil {
11941196
return nil, nil, errors.Wrapf(err, "failed to update builder last activity time")
11951197
}
1196-
nodes, err := b.LoadNodes(ctx)
1198+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
1199+
nodes, err := b.LoadNodes(ctx, builder.WithImageVerifier(imageVerifier))
11971200
if err != nil {
11981201
return nil, nil, err
11991202
}

‎commands/create.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@ import (
88

99
"github.com/docker/buildx/builder"
1010
"github.com/docker/buildx/driver"
11+
"github.com/docker/buildx/policy"
1112
"github.com/docker/buildx/store/storeutil"
1213
"github.com/docker/buildx/util/cobrautil"
1314
"github.com/docker/buildx/util/cobrautil/completion"
15+
"github.com/docker/buildx/util/confutil"
1416
"github.com/docker/cli/cli"
1517
"github.com/docker/cli/cli/command"
1618
"github.com/spf13/cobra"
@@ -64,6 +66,7 @@ func runCreate(ctx context.Context, dockerCli command.Cli, in createOptions, arg
6466
Endpoint: ep,
6567
Append: in.actionAppend,
6668
Timeout: in.timeout,
69+
ImageVerifier: policy.DefaultImageVerifier(confutil.NewConfig(dockerCli)),
6770
})
6871
if err != nil {
6972
return err

‎commands/dial_stdio.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ import (
99
"github.com/containerd/platforms"
1010
"github.com/docker/buildx/build"
1111
"github.com/docker/buildx/builder"
12+
"github.com/docker/buildx/policy"
13+
"github.com/docker/buildx/util/confutil"
1214
"github.com/docker/buildx/util/progress"
1315
"github.com/docker/cli/cli/command"
1416
"github.com/moby/buildkit/util/appcontext"
@@ -39,7 +41,8 @@ func runDialStdio(dockerCli command.Cli, opts stdioOptions) error {
3941
if err = updateLastActivity(dockerCli, b.NodeGroup); err != nil {
4042
return errors.Wrapf(err, "failed to update builder last activity time")
4143
}
42-
nodes, err := b.LoadNodes(ctx)
44+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
45+
nodes, err := b.LoadNodes(ctx, builder.WithImageVerifier(imageVerifier))
4346
if err != nil {
4447
return err
4548
}

‎commands/history/utils.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ import (
1313
"time"
1414

1515
"github.com/docker/buildx/builder"
16+
"github.com/docker/buildx/policy"
17+
"github.com/docker/buildx/util/confutil"
1618
"github.com/docker/cli/cli/command"
1719
"github.com/docker/go-units"
1820
controlapi "github.com/moby/buildkit/api/services/control"
@@ -356,14 +358,15 @@ func loadNodes(ctx context.Context, dockerCli command.Cli, builderName string) (
356358
if err != nil {
357359
return nil, err
358360
}
359-
nodes, err := b.LoadNodes(ctx, builder.WithData())
361+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
362+
nodes, err := b.LoadNodes(ctx, builder.WithData(), builder.WithImageVerifier(imageVerifier))
360363
if err != nil {
361364
return nil, err
362365
}
363366
if ok, err := b.Boot(ctx); err != nil {
364367
return nil, err
365368
} else if ok {
366-
nodes, err = b.LoadNodes(ctx, builder.WithData())
369+
nodes, err = b.LoadNodes(ctx, builder.WithData(), builder.WithImageVerifier(imageVerifier))
367370
if err != nil {
368371
return nil, err
369372
}

‎commands/inspect.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ import (
1111

1212
"github.com/docker/buildx/builder"
1313
"github.com/docker/buildx/driver"
14+
"github.com/docker/buildx/policy"
1415
"github.com/docker/buildx/util/cobrautil/completion"
16+
"github.com/docker/buildx/util/confutil"
1517
"github.com/docker/buildx/util/platformutil"
1618
"github.com/docker/cli/cli"
1719
"github.com/docker/cli/cli/command"
@@ -42,15 +44,16 @@ func runInspect(ctx context.Context, dockerCli command.Cli, in inspectOptions) e
4244
}
4345
defer func() { cancel(errors.WithStack(context.Canceled)) }()
4446

45-
nodes, err := b.LoadNodes(timeoutCtx, builder.WithData())
47+
imageVerifier := policy.DefaultImageVerifier(confutil.NewConfig(dockerCli))
48+
nodes, err := b.LoadNodes(timeoutCtx, builder.WithData(), builder.WithImageVerifier(imageVerifier))
4649
if in.bootstrap {
4750
var ok bool
4851
ok, err = b.Boot(ctx)
4952
if err != nil {
5053
return err
5154
}
5255
if ok {
53-
nodes, err = b.LoadNodes(timeoutCtx, builder.WithData())
56+
nodes, err = b.LoadNodes(timeoutCtx, builder.WithData(), builder.WithImageVerifier(imageVerifier))
5457
}
5558
}
5659

‎driver/image.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ import (
55

66
"github.com/distribution/reference"
77
"github.com/docker/buildx/driver/bkimage"
8-
"github.com/docker/buildx/policy"
98
"github.com/docker/buildx/util/progress"
9+
"github.com/docker/buildx/util/sourcemeta"
1010
digest "github.com/opencontainers/go-digest"
1111
ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
1212
"github.com/pkg/errors"
@@ -20,7 +20,7 @@ import (
2020
// moby/buildkit repository (unmanaged images pass through the default policy
2121
// unchanged). A tagged canonical reference is still verified because its tag
2222
// carries the release identity checked by the policy.
23-
func VerifyImageRef(ctx context.Context, l progress.SubLogger, ref string, platform *ocispecs.Platform, resolver policy.SourceMetadataResolver, verify ImageVerifier) (string, bool, error) {
23+
func VerifyImageRef(ctx context.Context, l progress.SubLogger, ref string, platform *ocispecs.Platform, resolver *sourcemeta.Resolver, verify ImageVerifier) (string, bool, error) {
2424
if verify == nil {
2525
return ref, false, nil
2626
}

‎driver/image_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
"context"
55
"testing"
66

7-
"github.com/docker/buildx/policy"
7+
"github.com/docker/buildx/util/sourcemeta"
88
"github.com/moby/buildkit/client"
99
digest "github.com/opencontainers/go-digest"
1010
ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
@@ -22,7 +22,7 @@ func TestVerifyImageRefTaggedCanonical(t *testing.T) {
2222
ref := "moby/buildkit:v0.31.2@" + dgst.String()
2323
var verifiedRef string
2424

25-
pinned, applied, err := VerifyImageRef(context.Background(), nopSubLogger{}, ref, nil, nil, func(_ context.Context, ref string, _ *ocispecs.Platform, _ policy.SourceMetadataResolver) (digest.Digest, error) {
25+
pinned, applied, err := VerifyImageRef(context.Background(), nopSubLogger{}, ref, nil, nil, func(_ context.Context, ref string, _ *ocispecs.Platform, _ *sourcemeta.Resolver) (digest.Digest, error) {
2626
verifiedRef = ref
2727
return dgst, nil
2828
})
@@ -36,7 +36,7 @@ func TestVerifyImageRefDigestOnly(t *testing.T) {
3636
dgst := digest.FromString("buildkit")
3737
called := false
3838

39-
pinned, applied, err := VerifyImageRef(context.Background(), nopSubLogger{}, "moby/buildkit@"+dgst.String(), nil, nil, func(_ context.Context, _ string, _ *ocispecs.Platform, _ policy.SourceMetadataResolver) (digest.Digest, error) {
39+
pinned, applied, err := VerifyImageRef(context.Background(), nopSubLogger{}, "moby/buildkit@"+dgst.String(), nil, nil, func(_ context.Context, _ string, _ *ocispecs.Platform, _ *sourcemeta.Resolver) (digest.Digest, error) {
4040
called = true
4141
return dgst, nil
4242
})

0 commit comments

Comments
 (0)