Add env var to disable default attestation (bake)

[tnaroska]

Description

#1645 added BUILDX_NO_DEFAULT_ATTESTATIONS env-var to buildx build as a backward compatible way to disable default provenance.

The same mechanism should be added to buildx bake for exactly same reasons.

[jedevc]

Does it not already work? The logic added is shared between both the build and bake commands.

[tnaroska]

Intersting. I couldn't get it to work in my testing yesterday and then saw the commit had only touched build/build.go. I will give it another try later today.

[tnaroska]

After some more investigation, the flag is indeed working for bake. There was some user-error at play.

One confusing detail that struck me when trying to switch the feature on and off is that once a list.manifest.json exists in the registry for a certain tag, it doesn't get removed by a following push of a simple manifest.json-only image.

In my test I did:

1. Build/push test image with buildx default behavior. This pushed latest tag and created manifest.json and list.manifest.json to store attestation data
2. Build/push same test image with BUILDX_NO_DEFAULT_ATTESTATIONS=true using same tag (latest)
3. Checked the manifest using crane manifest <my-image> expecting a single-arch manifest to be shown since attestation should be disabled
4. However crane still reports the manifest list with attestation data which threw me off

The second build indeed disabled attestation and uploaded manifest.json, but since the list.manifest.json` from previous build was still in the registry, crane would report that.

I'm not sure if this is intended behavior, a bug in buildkit or maybe even an issue specific to the registry implementation (testing against an artifactory server). Switching an image back and forth between manifest and manifest.list is likely not a common scenario. When it happens the current behavior is very confusing though.

@jedevc any thoughts on this?