buildx

mirror of https://github.com/docker/buildx.git synced 2026-10-28 06:39:39 +03:00

Files

Tonis Tiigi 69a8e58c7d bake: require fs.read for implicit secret files and oci-layout contexts

A secret with only an id falls back to reading the file named by the id when
no environment variable with that name exists, but the entitlement check only
looked at an explicit src. Resolve the source the same way BuildKit does so
the implicit file read needs fs.read permission.

Named contexts using oci-layout:// were treated as relative paths and
resolved under the working directory, so any layout directory was allowed.
Parse the reference and check the actual layout path instead.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit f7979d8a5b2e363129ef9850950cce0c5c87c031)

2026-09-30 12:23:21 +02:00

hclparser

bake/hclparser: use testify instead of manually using go-spew

2026-08-18 11:58:05 +02:00

bake_test.go

Merge pull request #3962 from crazy-max/bake-secret-source-override

2026-07-22 14:36:50 +02:00

bake.go

bake: require fs.read for implicit secret files and oci-layout contexts

2026-09-30 12:23:21 +02:00

compose_test.go

bake: align compose path base with compose