Make Travis usable for forks

[TBBle]

Travis will now correctly build on branches in forks that do not exist in moby/buildkit, so I don't need to actually create the PR just to see if the build will pass. Or ignore the 'build failed' emails from Travis.

There's also a couple of other fixes that came up when I was working on #1387, iterating on the integration tests.

[FernandoMiguel]

FYI builds out of the repo can lead to security issues

[TBBle]

How do you mean?

[FernandoMiguel]

How do you mean?

I don't have the details on hand, but both github actions and gitlab runners have clear warning about allowing jobs to run from forks

[FernandoMiguel]

A pull request sent from a fork of the upstream repository could be manipulated to expose environment variables. The upstream repository’s maintainer would have no protection against this attack, as pull requests can be sent by anyone who forks the repository on GitHub.

https://docs.travis-ci.com/user/pull-requests/

[TBBle]

That's a different problem from what was being fixed here. This change was just to make the non-PR builds that was already allowed to run pass, by not hard-coding a branch name in the script.

The problem you're referencing is for exposing secret data to PRs, which Travis already does not do for out-of-repo PRs, as mentioned on that link.

Travis CI makes encrypted variables and data available only to pull requests coming from the same repository. These are considered trustworthy, as only members with write access to the repository can send them.

If you're aware of another leaked env-var problem that needs fixing, it'd be better as a new issue than comments here. This is already handled with things like MASTERCACHE_PASSWORD which is not available for out-of-repo PRs, instead generating a one-time use session key isolated to resources for that PR specifically.

[TBBle]

Github Actions has a similar protection for secrets.

With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.

[FernandoMiguel]

Thanks for the keen eye for security.
Keep up the awesome work!