Add env var to disable default attestations#1612
Conversation
| if _, ok := opt.Attests["attest:provenance"]; !ok && supportsAttestations { | ||
| so.FrontendAttrs["attest:provenance"] = "mode=min,inline-only=true" | ||
| var noProv bool | ||
| if v, ok := os.LookupEnv("BUILDX_NO_DEFAULT_PROVENANCE"); ok { |
There was a problem hiding this comment.
I recall we have
Line 386 in 78058ce
BUILDKIT_NO_DEFAULT_PROVENANCE instead for consistency even if BUILDKIT_INLINE_CACHE should have been BUILDX_INLINE_CACHE imo as this var is not handled in BuildKit but Buildx.
There was a problem hiding this comment.
Yeah, we also have BUILDX_NO_DEFAULT_LOAD though 🤔
Consistency isn't great here, though I'd be tempted to go with the BUILDX_ prefix if possible.
I wonder if we should make the variable name more generic though, something like BUILDX_NO_DEFAULT_ATTESTATIONS - just in case we ever went the route of making some other attestations default as well (currently not planned, but better to have the breathing room IMHO).
There was a problem hiding this comment.
BUILDX_NO_DEFAULT_ATTESTATIONS lgtm
For certain cases we need to build with `--provenance=false`. However not all build envs (especially in the OSS ethos) have the latest buildx so just blanket setting `--provenance=false` will fail in these cases. Having an env var allows people to set the value without having to worry about if the buildx version has the `--provenance` flag. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
cpuguy83
force-pushed
the
env_no_provenance
branch
from
1c59ec1 to
bc9cb2c
Compare
jedevc
left a comment
jedevc
left a comment
There was a problem hiding this comment.
LGTM, @tonistiigi?
Probably worth cherry-picking to 0.10 as well?
|
Cherry-picked to 0.10 in #1645. |
5 participants
For certain cases we need to build with
--provenance=false. However not all build envs (especially in the OSS ethos) have the latest buildx so just blanket setting--provenance=falsewill fail in these cases.Having an env var allows people to set the value without having to worry about if the buildx version has the
--provenanceflag.