Add env var to disable default attestations

cpuguy83 · cpuguy83 · commit 23eb3c3ccd3d · 2023-02-22T18:20:34.000Z
For certain cases we need to build with `--provenance=false`. However not all build envs (especially in the OSS ethos) have the latest buildx so just blanket setting `--provenance=false` will fail in these cases. Having an env var allows people to set the value without having to worry about if the buildx version has the `--provenance` flag. Signed-off-by: Brian Goff <cpuguy83@gmail.com> (cherry picked from commit bc9cb2c) Signed-off-by: Brian Goff <cpuguy83@gmail.com>
diff --git a/build/build.go b/build/build.go
@@ -465,8 +465,19 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt Op
 			so.FrontendAttrs[k] = v
 		}
 	}
+
 	if _, ok := opt.Attests["attest:provenance"]; !ok && supportsAttestations {
-		so.FrontendAttrs["attest:provenance"] = "mode=min,inline-only=true"
+		const noAttestEnv = "BUILDX_NO_DEFAULT_ATTESTATIONS"
+		var noProv bool
+		if v, ok := os.LookupEnv(noAttestEnv); ok {
+			noProv, err = strconv.ParseBool(v)
+			if err != nil {
+				return nil, nil, errors.Wrap(err, "invalid "+noAttestEnv)
+			}
+		}
+		if !noProv {
+			so.FrontendAttrs["attest:provenance"] = "mode=min,inline-only=true"
+		}
 	}
 
 	switch len(opt.Exports) {
