diff --git a/solver/llbsolver/provenance/predicate.go b/solver/llbsolver/provenance/predicate.go index 76132a33c9a8..bf01c0b9d6cc 100644 --- a/solver/llbsolver/provenance/predicate.go +++ b/solver/llbsolver/provenance/predicate.go @@ -8,6 +8,7 @@ import ( slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common" slsa02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2" provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types" + "github.com/moby/buildkit/util/gitutil" "github.com/moby/buildkit/util/purl" "github.com/moby/buildkit/util/urlutil" "github.com/package-url/packageurl-go" @@ -69,6 +70,35 @@ func digestSetForCommit(commit string) slsa.DigestSet { } func findMaterial(srcs provenancetypes.Sources, uri string) (*slsa.ProvenanceMaterial, bool) { + // Git URLs in querystring format or subdir need to be converted to fragment format with only ref + gitRef, err := gitutil.ParseURL(uri) + if err == nil && gitRef != nil { + u := gitRef.Remote + var ref string + if gitRef.Opts != nil { + ref = gitRef.Opts.Ref + } + if len(gitRef.Query) > 0 { + for k, v := range gitRef.Query { + if len(v) == 0 { + continue + } + switch k { + case "ref": + ref = v[0] + case "branch": + ref = "refs/heads/" + v[0] + case "tag": + ref = "refs/tags/" + v[0] + } + } + } + if ref != "" { + u += "#" + ref + } + uri = u + } + for _, s := range srcs.Git { if s.URL == uri { return &slsa.ProvenanceMaterial{ @@ -102,6 +132,8 @@ func NewPredicate(c *Capture) (*provenancetypes.ProvenancePredicateSLSA02, error contextKey := "context" if v, ok := args["contextkey"]; ok && v != "" { contextKey = v + } else if v, ok := c.Args["input:context"]; ok && v != "" { + contextKey = "input:context" } if v, ok := args[contextKey]; ok && v != "" {