Compare commits

...

18 Commits

Author SHA1 Message Date
Paweł Gronowski
e77ff99ede Merge pull request #50354 from vvoland/50353-28.x
[28.x backport] Update to go1.24.5
2025-07-09 12:33:03 +02:00
Paweł Gronowski
6e3cf7f12b Merge pull request #50351 from vvoland/50179-28.x
[28.x backport] gha: update to windows 2022 / 2025
2025-07-09 10:14:10 +02:00
Paweł Gronowski
38c0abffce update to go1.24.5
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5

This minor releases include 1 security fixes following the security policy:

- cmd/go: unexpected command execution in untrusted VCS repositories

    Various uses of the Go toolchain in untrusted VCS repositories can result in
    unexpected code execution. When using the Go toolchain in directories fetched
    using various VCS tools (such as directly cloning Git or Mercurial repositories)
    can cause the toolchain to execute unexpected commands, if said directory
    contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
    repository). This is due to how the Go toolchain attempts to resolve which VCS
    is being used in order to embed build information in binaries and determine
    module versions.

    The toolchain will now abort attempting to resolve which VCS is being used if it
    detects multiple VCS configuration metadata in a module directory or nested VCS
    configuration metadata (such as a '.git' directoy in a parent directory and a
    '.hg' directory in a child directory). This will not prevent the toolchain from
    building modules, but will result in binaries omitting VCS related build
    information.

    If this behavior is expected by the user, the old behavior can be re-enabled by
    setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted
    repositories.

    Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting
    this issue.

    This is CVE-2025-4674 and https://go.dev/issue/74380.

View the release notes for more information:
https://go.dev/doc/devel/release#go1.24.5

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 0a047e825c)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-09 10:11:05 +02:00
Paweł Gronowski
3b7d703484 Merge pull request #50352 from vvoland/50347-28.x
[28.x backport] integration/networking: increase context timeout for attach
2025-07-08 19:01:29 +02:00
Sebastiaan van Stijn
d14a60fe24 Merge pull request #50348 from vvoland/50314-28.x
[28.x backport] gha: remove GO_VERSION build-arg from builds
2025-07-08 18:25:27 +02:00
Paweł Gronowski
da65c869b5 Merge pull request #50350 from vvoland/50333-28.x
[28.x backport] api: swagger: Tweak type of GwPriority to integer
2025-07-08 18:06:38 +02:00
Paweł Gronowski
76fbfe9953 Merge pull request #50349 from vvoland/50255-28.x
[28.x backport] dockerfile: update govulncheck to v1.1.4
2025-07-08 17:48:43 +02:00
Sebastiaan van Stijn
bfade89ec2 integration/networking: increase context timeout for attach
The TestNatNetworkICC and TestFlakyPortMappedHairpinWindows (TestPortMappedHairpinWindows)
tests were frequently failing on Windows with a context timeout;

    === FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC/User_defined_nat_network (9.67s)
        nat_windows_test.go:62: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/4357bd24c9b77b955ee961530d1f552ce099b3dcbeb396db599971b2396d8b08/start": context deadline exceeded
        panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network mynat has active endpoints (name:"ctr2" id:"dc8d597dafef")

    === FAIL: github.com/docker/docker/integration/networking TestNatNetworkICC (18.34s)

    === FAIL: github.com/docker/docker/integration/networking TestFlakyPortMappedHairpinWindows (13.02s)
        nat_windows_test.go:110: assertion failed: error is not nil: Post "http://%2F%2F.%2Fpipe%2Fdocker_engine/v1.51/containers/65207ae3d6953d85cd2123feac45af60b059842d570d4f897ea53c813cba3cb4/start": context deadline exceeded
        panic.go:636: assertion failed: error is not nil: Error response from daemon: error while removing network: network clientnet has active endpoints (name:"amazing_visvesvaraya" id:"18add58d415e")

These timeouts were set in c1ab6eda4b and
2df4391473, and were shared between Linux
and Windows; likely Windows is slower to start, so these timeouts to be
expected.

Let's increase the context timeout to give it a bit more time.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 0ea28fede0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 17:19:06 +02:00
Sebastiaan van Stijn
a818cfd87b gha: run windows 2025 on PRs, 2022 scheduled
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 9316396db0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:31:35 +02:00
Sebastiaan van Stijn
653777a522 gha: update to windows 2022 / 2025
The hosted Windows 2019 runners reach EOL on June 30;
https://github.com/actions/runner-images/issues/12045

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 6f484d0d4c)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:31:28 +02:00
Niel Drummond
1ad3df4768 api: swagger: Tweak type of GwPriority to integer
Signed-off-by: Niel Drummond <niel@drummond.lu>
(cherry picked from commit 51d6687754)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:27:00 +02:00
Niel Drummond
6323db8e78 docs: api: Tweak type of GwPriority to integer
Signed-off-by: Niel Drummond <niel@drummond.lu>
(cherry picked from commit bfc0c7cff5)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:26:58 +02:00
CrazyMax
a3c8f7fa8c dockerfile: update govulncheck to v1.1.4
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit fcf666f9b0)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:26:11 +02:00
Sebastiaan van Stijn
dfbba63a34 gha: remove GO_VERSION build-arg from builds
The same env-var is used for action/setup-go as for overriding
the default Go version in Dockerfiles, however action/setup-go
only accepts SemVer (e.g. 1.25.0-rc.1) whereas the official golang
image follows the Go project's versioning, which doesn't use
a SemVer-compatible format (go1.25rc1 / 1.25rc1).

Trying to use the same "GO_VERSION" value for both will therefore
fail.

As we're already updating the default version in the Dockerfile to
the version we want to use, let's remove the --build-arg, and use
the default that's set in the Dockerfile.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit fa4f3c979f)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-07-08 15:24:52 +02:00
Sebastiaan van Stijn
5beb93de84 Merge pull request #50309 from crazy-max/28.x_pick_buildkit-0.23.2
[28.x backport] vendor: update buildkit to v0.23.2
2025-07-02 15:31:29 +02:00
Tonis Tiigi
e17e96e3c5 vendor: update buildkit to v0.23.2
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
2025-07-02 11:48:40 +02:00
Sebastiaan van Stijn
e0183475e0 Merge pull request #50264 from vvoland/50263-28.x
[28.x backport] gha/bin-image: add major and minor version image tags
2025-06-25 14:47:55 +02:00
Paweł Gronowski
a2af8bdebd gha/bin-image: add major and minor version image tags
Adding image tags that follow the semver major and minor versions (e.g., `28`
and `28.3`) for the moby-bin images.

This makes it easier for users to reference the latest build within a
major or minor version series without having to know the exact
minor/patch version.

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
(cherry picked from commit 38b98bcf68)
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
2025-06-24 23:32:35 +02:00
28 changed files with 94 additions and 68 deletions

View File

@@ -16,7 +16,7 @@ on:
workflow_call:
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
GOTESTLIST_VERSION: v0.3.1
TESTSTAT_VERSION: v0.1.25
SETUP_BUILDX_VERSION: edge

View File

@@ -21,7 +21,7 @@ on:
default: "graphdriver"
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
GOTESTLIST_VERSION: v0.3.1
TESTSTAT_VERSION: v0.1.25
ITG_CLI_MATRIX_SIZE: 6

View File

@@ -28,12 +28,12 @@ on:
default: false
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
GOTESTLIST_VERSION: v0.3.1
TESTSTAT_VERSION: v0.1.25
WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore
WINDOWS_BASE_TAG_2019: ltsc2019
WINDOWS_BASE_TAG_2022: ltsc2022
WINDOWS_BASE_TAG_2025: ltsc2025
TEST_IMAGE_NAME: moby:test
TEST_CTN_NAME: moby
DOCKER_BUILDKIT: 0
@@ -65,8 +65,8 @@ jobs:
run: |
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go-build"
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go\pkg\mod"
If ("${{ inputs.os }}" -eq "windows-2019") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
If ("${{ inputs.os }}" -eq "windows-2025") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2025 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
} ElseIf ("${{ inputs.os }}" -eq "windows-2022") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
}
@@ -92,7 +92,6 @@ jobs:
& docker build `
--build-arg WINDOWS_BASE_IMAGE `
--build-arg WINDOWS_BASE_IMAGE_TAG `
--build-arg GO_VERSION `
-t ${{ env.TEST_IMAGE_NAME }} `
-f Dockerfile.windows .
-
@@ -145,8 +144,8 @@ jobs:
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go-build"
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go\pkg\mod"
New-Item -ItemType "directory" -Path "bundles"
If ("${{ inputs.os }}" -eq "windows-2019") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
If ("${{ inputs.os }}" -eq "windows-2025") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2025 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
} ElseIf ("${{ inputs.os }}" -eq "windows-2022") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
}
@@ -172,7 +171,6 @@ jobs:
& docker build `
--build-arg WINDOWS_BASE_IMAGE `
--build-arg WINDOWS_BASE_IMAGE_TAG `
--build-arg GO_VERSION `
-t ${{ env.TEST_IMAGE_NAME }} `
-f Dockerfile.windows .
-
@@ -321,8 +319,8 @@ jobs:
name: Init
run: |
New-Item -ItemType "directory" -Path "bundles"
If ("${{ inputs.os }}" -eq "windows-2019") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
If ("${{ inputs.os }}" -eq "windows-2025") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2025 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
} ElseIf ("${{ inputs.os }}" -eq "windows-2022") {
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
}

View File

@@ -23,7 +23,7 @@ on:
pull_request:
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
TESTSTAT_VERSION: v0.1.25
DESTDIR: ./build
SETUP_BUILDX_VERSION: edge

View File

@@ -69,6 +69,8 @@ jobs:
type=semver,pattern={{version}}
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{major}}
type=semver,pattern={{major}}.{{minor}}
-
name: Rename meta bake definition file
# see https://github.com/docker/metadata-action/issues/381#issuecomment-1918607161

View File

@@ -23,7 +23,7 @@ on:
pull_request:
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
DESTDIR: ./build
SETUP_BUILDX_VERSION: edge
SETUP_BUILDKIT_IMAGE: moby/buildkit:latest
@@ -220,7 +220,6 @@ jobs:
& docker build `
--build-arg WINDOWS_BASE_IMAGE `
--build-arg WINDOWS_BASE_IMAGE_TAG `
--build-arg GO_VERSION `
-t ${{ env.TEST_IMAGE_NAME }} `
-f Dockerfile.windows .

View File

@@ -58,7 +58,7 @@ jobs:
- name: Update Go
uses: actions/setup-go@v5
with:
go-version: "1.24.4"
go-version: "1.24.5"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:

View File

@@ -23,7 +23,7 @@ on:
pull_request:
env:
GO_VERSION: "1.24.4"
GO_VERSION: "1.24.5"
GIT_PAGER: "cat"
PAGER: "cat"
SETUP_BUILDX_VERSION: edge

View File

@@ -14,13 +14,9 @@ concurrency:
cancel-in-progress: true
on:
schedule:
- cron: '0 10 * * *'
workflow_dispatch:
push:
branches:
- 'master'
- '[0-9]+.[0-9]+'
- '[0-9]+.x'
pull_request:
jobs:
validate-dco:

View File

@@ -1,4 +1,4 @@
name: windows-2019
name: windows-2025
# Default to 'contents: read', which grants actions to read commits.
#
@@ -14,9 +14,13 @@ concurrency:
cancel-in-progress: true
on:
schedule:
- cron: '0 10 * * *'
workflow_dispatch:
push:
branches:
- 'master'
- '[0-9]+.[0-9]+'
- '[0-9]+.x'
pull_request:
jobs:
validate-dco:
@@ -37,6 +41,6 @@ jobs:
matrix:
storage: ${{ fromJson(needs.test-prepare.outputs.matrix) }}
with:
os: windows-2019
os: windows-2025
storage: ${{ matrix.storage }}
send_coverage: false

View File

@@ -3,7 +3,7 @@ version: "2"
run:
# prevent golangci-lint from deducting the go version to lint for through go.mod,
# which causes it to fallback to go1.17 semantics.
go: "1.24.4"
go: "1.24.5"
concurrency: 2
# Only supported with go modules enabled (build flag -mod=vendor only valid when using modules)
# modules-download-mode: vendor

View File

@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
ARG GO_VERSION=1.24.4
ARG GO_VERSION=1.24.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"
ARG XX_VERSION=1.6.1

View File

@@ -5,7 +5,7 @@
# This represents the bare minimum required to build and test Docker.
ARG GO_VERSION=1.24.4
ARG GO_VERSION=1.24.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG GOLANG_IMAGE="golang:${GO_VERSION}-${BASE_DEBIAN_DISTRO}"

View File

@@ -161,7 +161,7 @@ FROM ${WINDOWS_BASE_IMAGE}:${WINDOWS_BASE_IMAGE_TAG}
# Use PowerShell as the default shell
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
ARG GO_VERSION=1.24.4
ARG GO_VERSION=1.24.5
ARG GOTESTSUM_VERSION=v1.12.0
# GOWINRES_VERSION is the version of go-winres to install.

View File

@@ -2913,7 +2913,8 @@ definitions:
be used. If multiple endpoints have the same priority, endpoints are
lexicographically sorted based on their network name, and the one
that sorts first is picked.
type: "number"
type: "integer"
format: "int64"
example:
- 10

View File

@@ -3039,7 +3039,8 @@ definitions:
be used. If multiple endpoints have the same priority, endpoints are
lexicographically sorted based on their network name, and the one
that sorts first is picked.
type: "number"
type: "integer"
format: "int64"
example:
- 10

View File

@@ -3039,7 +3039,8 @@ definitions:
be used. If multiple endpoints have the same priority, endpoints are
lexicographically sorted based on their network name, and the one
that sorts first is picked.
type: "number"
type: "integer"
format: "int64"
example:
- 10

View File

@@ -2914,7 +2914,8 @@ definitions:
be used. If multiple endpoints have the same priority, endpoints are
lexicographically sorted based on their network name, and the one
that sorts first is picked.
type: "number"
type: "integer"
format: "int64"
example:
- 10

View File

@@ -2913,7 +2913,8 @@ definitions:
be used. If multiple endpoints have the same priority, endpoints are
lexicographically sorted based on their network name, and the one
that sorts first is picked.
type: "number"
type: "integer"
format: "int64"
example:
- 10

View File

@@ -1,6 +1,6 @@
# syntax=docker/dockerfile:1
ARG GO_VERSION=1.24.4
ARG GO_VERSION=1.24.5
ARG BASE_DEBIAN_DISTRO="bookworm"
ARG PROTOC_VERSION=3.11.4

View File

@@ -1,7 +1,7 @@
# syntax=docker/dockerfile:1
ARG GO_VERSION=1.24.4
ARG GOVULNCHECK_VERSION=v1.1.3
ARG GO_VERSION=1.24.5
ARG GOVULNCHECK_VERSION=v1.1.4
ARG FORMAT=text
FROM golang:${GO_VERSION}-alpine AS base
@@ -20,12 +20,6 @@ RUN --mount=type=bind,target=.,rw <<EOT
ln -s vendor.mod go.mod
ln -s vendor.sum go.sum
govulncheck -format ${FORMAT} ./... | tee /out/govulncheck.out
if [ "${FORMAT}" = "sarif" ]; then
# Make sure "results" field is defined in SARIF output otherwise GitHub Code Scanning
# will fail when uploading report with "Invalid SARIF. Missing 'results' array in run."
# Relates to https://github.com/golang/vuln/blob/ffdef74cc44d7eb71931d8d414c478b966812488/internal/sarif/sarif.go#L69
jq '(.runs[] | select(.results == null) | .results) |= []' /out/govulncheck.out | tee >(sponge /out/govulncheck.out)
fi
EOT
FROM scratch AS output

View File

@@ -57,7 +57,7 @@ func TestNatNetworkICC(t *testing.T) {
pingCmd := []string{"ping", "-n", "1", "-w", "3000", ctr1Name}
const ctr2Name = "ctr2"
attachCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
attachCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
defer cancel()
res := container.RunAttach(attachCtx, t, c,
container.WithName(ctr2Name),
@@ -105,9 +105,9 @@ func TestFlakyPortMappedHairpinWindows(t *testing.T) {
inspect := container.Inspect(ctx, t, c, serverId)
hostPort := inspect.NetworkSettings.Ports["80/tcp"][0].HostPort
clientCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
attachCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
defer cancel()
res := container.RunAttach(clientCtx, t, c,
res := container.RunAttach(attachCtx, t, c,
container.WithNetworkMode(clientNetName),
container.WithCmd("wget", "http://"+hostAddr+":"+hostPort),
)

View File

@@ -62,7 +62,7 @@ require (
github.com/miekg/dns v1.1.66
github.com/mistifyio/go-zfs/v3 v3.0.1
github.com/mitchellh/copystructure v1.2.0
github.com/moby/buildkit v0.23.1
github.com/moby/buildkit v0.23.2
github.com/moby/docker-image-spec v1.3.1
github.com/moby/go-archive v0.1.0
github.com/moby/ipvs v1.1.0
@@ -209,7 +209,7 @@ require (
github.com/tinylib/msgp v1.1.8 // indirect
github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 // indirect
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f // indirect
github.com/tonistiigi/go-actions-cache v0.0.0-20250611155157-388a2ec8cdf8 // indirect
github.com/tonistiigi/go-actions-cache v0.0.0-20250626083717-378c5ed1ddd9 // indirect
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
github.com/tonistiigi/units v0.0.0-20180711220420-6950e57a87ea // indirect
github.com/tonistiigi/vt100 v0.0.0-20240514184818-90bafcd6abab // indirect

View File

@@ -384,8 +384,8 @@ github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:F
github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=
github.com/moby/buildkit v0.23.1 h1:CZtFmPRF+IFG1C8QfPnktGO1Dzzt5JSwtQ5eDqIh+ag=
github.com/moby/buildkit v0.23.1/go.mod h1:keNXljNmKX1T0AtM0bMObc8OV6mA9cOuquVbPcRpU/Y=
github.com/moby/buildkit v0.23.2 h1:gt/dkfcpgTXKx+B9I310kV767hhVqTvEyxGgI3mqsGQ=
github.com/moby/buildkit v0.23.2/go.mod h1:iEjAfPQKIuO+8y6OcInInvzqTMiKMbb2RdJz1K/95a0=
github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
@@ -559,8 +559,8 @@ github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323 h1:r0p7fK5
github.com/tonistiigi/dchapes-mode v0.0.0-20250318174251-73d941a28323/go.mod h1:3Iuxbr0P7D3zUzBMAZB+ois3h/et0shEz0qApgHYGpY=
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f h1:MoxeMfHAe5Qj/ySSBfL8A7l1V+hxuluj8owsIEEZipI=
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f/go.mod h1:BKdcez7BiVtBvIcef90ZPc6ebqIWr4JWD7+EvLm6J98=
github.com/tonistiigi/go-actions-cache v0.0.0-20250611155157-388a2ec8cdf8 h1:KbACff2cR+ip6/Kmt8zCzieMlKYyypArQT1ZweFxewQ=
github.com/tonistiigi/go-actions-cache v0.0.0-20250611155157-388a2ec8cdf8/go.mod h1:gJlfrsY8U+1n9RGKSgWryNFfzHRl/b1a99RUVL1L4Qw=
github.com/tonistiigi/go-actions-cache v0.0.0-20250626083717-378c5ed1ddd9 h1:GWuTlpuUQBaK6u0R3HwE+eWaQ2aXwHgo8CaXgqtDQZU=
github.com/tonistiigi/go-actions-cache v0.0.0-20250626083717-378c5ed1ddd9/go.mod h1:cD0SB2270BYw6HYKriFn4H6NRLhGj6ytf48YTpsm8LY=
github.com/tonistiigi/go-archvariant v1.0.0 h1:5LC1eDWiBNflnTF1prCiX09yfNHIxDC/aukdhCdTyb0=
github.com/tonistiigi/go-archvariant v1.0.0/go.mod h1:TxFmO5VS6vMq2kvs3ht04iPXtu2rUT/erOnGFYfk5Ho=
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 h1:2f304B10LaZdB8kkVEaoXvAMVan2tl9AiK4G0odjQtE=

View File

@@ -180,7 +180,7 @@ func CreateFS(ctx context.Context, sessionID string, k string, ref cache.Immutab
return nil, nil, err
}
stmtFS := staticfs.NewFS()
split := opt.UsePlatformSplit(isMap)
addPlatformToFilename := isMap && !opt.UsePlatformSplit(isMap)
names := map[string]struct{}{}
for i, stmt := range stmts {
@@ -190,7 +190,7 @@ func CreateFS(ctx context.Context, sessionID string, k string, ref cache.Immutab
}
name := opt.AttestationPrefix + path.Base(attestations[i].Path)
if !split {
if addPlatformToFilename {
nameExt := path.Ext(name)
namBase := strings.TrimSuffix(name, nameExt)
name = fmt.Sprintf("%s.%s%s", namBase, strings.ReplaceAll(k, "/", "_"), nameExt)

View File

@@ -593,6 +593,7 @@ type Entry struct {
IsAzureBlob bool `json:"isAzureBlob"`
client *http.Client
reload func(context.Context) error
}
func (ce *Entry) WriteTo(ctx context.Context, w io.Writer) error {

View File

@@ -5,6 +5,7 @@ import (
"context"
"encoding/json"
"io"
"net/http"
"strings"
"time"
@@ -76,17 +77,34 @@ func (c *Cache) uploadV2(ctx context.Context, url string, b Blob) error {
func (ce *Entry) downloadV2(ctx context.Context) ReaderAtCloser {
return toReaderAtCloser(func(offset int64) (io.ReadCloser, error) {
client, err := blockblob.NewClientWithNoCredential(ce.URL, azureOptions)
if err != nil {
return nil, errors.WithStack(err)
var retried bool
for {
client, err := blockblob.NewClientWithNoCredential(ce.URL, azureOptions)
if err != nil {
return nil, errors.WithStack(err)
}
resp, err := client.DownloadStream(ctx, &blob.DownloadStreamOptions{
Range: blob.HTTPRange{Offset: offset},
})
if err != nil {
if !retried {
// the URL might have expired, so we try to load it again
retried = true
var respErr *azcore.ResponseError
if errors.As(err, &respErr) {
if respErr.StatusCode == http.StatusForbidden || respErr.StatusCode == http.StatusUnauthorized {
Log("reload download URL because error %v", err)
if err := ce.reload(ctx); err != nil {
return nil, errors.WithStack(err)
}
continue // retry with the new URL
}
}
}
return nil, errors.WithStack(err)
}
return resp.Body, nil
}
resp, err := client.DownloadStream(ctx, &blob.DownloadStreamOptions{
Range: blob.HTTPRange{Offset: offset},
})
if err != nil {
return nil, errors.WithStack(err)
}
return resp.Body, nil
})
}
@@ -187,6 +205,15 @@ func (c *Cache) loadV2(ctx context.Context, keys ...string) (*Entry, error) {
ce.URL = val.SignedDownloadURL
ce.IsAzureBlob = true
ce.client = c.opt.Client
ce.reload = func(ctx context.Context) error {
v, err := c.loadV2(ctx, keys...)
if err != nil {
return errors.WithStack(err)
}
ce.URL = v.URL
ce.Key = v.Key
return nil
}
return &ce, nil
}

4
vendor/modules.txt vendored
View File

@@ -757,7 +757,7 @@ github.com/mitchellh/hashstructure/v2
# github.com/mitchellh/reflectwalk v1.0.2
## explicit
github.com/mitchellh/reflectwalk
# github.com/moby/buildkit v0.23.1
# github.com/moby/buildkit v0.23.2
## explicit; go 1.23.0
github.com/moby/buildkit/api/services/control
github.com/moby/buildkit/api/types
@@ -1190,7 +1190,7 @@ github.com/tonistiigi/dchapes-mode
github.com/tonistiigi/fsutil
github.com/tonistiigi/fsutil/copy
github.com/tonistiigi/fsutil/types
# github.com/tonistiigi/go-actions-cache v0.0.0-20250611155157-388a2ec8cdf8
# github.com/tonistiigi/go-actions-cache v0.0.0-20250626083717-378c5ed1ddd9
## explicit; go 1.23.0
github.com/tonistiigi/go-actions-cache
# github.com/tonistiigi/go-archvariant v1.0.0