Justin Chadwell

Not quite sure how this model would interact with tooling that generates a lot of attestations. One possible way might be to allow grouping attestations together into layers, though I'm...

Another complexity that's come up that we might want to investigate - we might want to have the capacity to have scanners able to analyze individual layers - so for...

Based on discussions, a couple notes: - Buildkit will have to have some knowledge of attestations somewhere - we can't entirely treat them like a completely opaque blob. It might...

I'm happy with the state of this now :smile: A couple of follow-ups will likely be necessary: adding support for other exporters (e.g. tar/local), clean-up of conversions between different `Result`...

As discussed with @tonistiigi, to keep the scope of this PR low, a list of the planned follow-ups: - [x] Suppress warning messages from containerd pusher - https://github.com/moby/buildkit/pull/3063 - [...

I think what you're describing is how it works currently. This directive parsing code modified is only used for extracting the syntax directive, the directive parsing used to actually parse...

Alright sounds good - I think I was confused since DetectSyntax seems to be the only thing that ever calls the ParseDirectives function, but I suppose there could be external...

Have done another pass through this, `ParseDirectives` now only parses `#` directives, while `DetectSyntax` searches through all the supported possibilities. I've also added a commit to skip shebang lines for...

Have completely rewritten the code to be significantly less clever, so the `DetectSyntax` function should be much easier to read from top-to-bottom. In addition to adding the shebang, c-style comments...

To test locally, you can use `justinchadwell050/buildkit:sbom-attestations` and `justinchadwell050/dockerfile:sbom-attestations`: ```console $ docker buildx create --driver docker-container --name sbom-builder --driver-opt image=justinchadwell050/buildkit:sbom-attestations $ docker buildx build --driver sbom-builder --build-arg BUILDKIT_SYNTAX=justinchadwell050/dockerfile:sbom-attestations ... ```