Introduce attestation metadata

exporter/attestation/filter.go

@@ -0,0 +1,45 @@
+package attestation
+
+import (
+	"bytes"
+
+	"github.com/moby/buildkit/solver/result"
+)
+
+func Filter(attestations []result.Attestation, include map[string][]byte, exclude map[string][]byte) []result.Attestation {
+	if len(include) == 0 && len(exclude) == 0 {
+		return attestations
+	}
+
+	result := []result.Attestation{}
+	for _, att := range attestations {
+		meta := att.Metadata
+		if meta == nil {
+			meta = map[string][]byte{}
+		}
+
+		match := true
+		for k, v := range include {
+			if !bytes.Equal(meta[k], v) {
+				match = false
+				break
+			}
+		}
+		if !match {
+			continue
+		}
+
+		for k, v := range exclude {
+			if bytes.Equal(meta[k], v) {
+				match = false
+				break
+			}
+		}
+		if !match {
+			continue
+		}
+
+		result = append(result, att)
+	}
+	return result
+}

exporter/local/fs.go

@@ -7,6 +7,7 @@ import (
 	"io/fs"
 	"os"
 	"path"
+	"strconv"
 	"time"
 
 	"github.com/docker/docker/pkg/idtools"
@@ -87,6 +88,9 @@ func CreateFS(ctx context.Context, sessionID string, k string, ref cache.Immutab
 	}
 
 	outputFS := fsutil.NewFS(src, walkOpt)
+	attestations = attestation.Filter(attestations, nil, map[string][]byte{
+		result.AttestationInlineOnlyKey: []byte(strconv.FormatBool(true)),
+	})
 	attestations, err = attestation.Unbundle(ctx, session.NewGroup(sessionID), refs, attestations)
 	if err != nil {
 		return nil, nil, err

frontend/attestations/sbom/sbom.go

@@ -80,6 +80,9 @@ func CreateSBOMScanner(ctx context.Context, resolver llb.ImageMetaResolver, scan
 		stsbom := runscan.AddMount(outDir, llb.Scratch())
 		return result.Attestation{
 			Kind: gatewaypb.AttestationKindBundle,
+			Metadata: map[string][]byte{
+				result.AttestationReasonKey: result.AttestationReasonSBOM,
+			},
 			InToto: result.InTotoAttestation{
 				PredicateType: intoto.PredicateSPDX,
 			},

solver/llbsolver/proc/provenance.go

@@ -57,8 +57,6 @@ func ProvenanceProcessor(attrs map[string]string) llbsolver.Processor {
 		var mode string
 		if v, ok := attrs["mode"]; ok {
 			switch v {
-			case "disabled", "none":
-				return res, nil
 			case "full":
 				mode = "max"
 			case "max", "min":
@@ -68,6 +66,11 @@ func ProvenanceProcessor(attrs map[string]string) llbsolver.Processor {
 			}
 		}
 
+		var inlineOnly bool
+		if v, err := strconv.ParseBool(attrs["inline-only"]); v && err == nil {
+			inlineOnly = true
+		}
+
 		for _, p := range ps.Platforms {
 			cp, ok := res.Provenance.Refs[p.ID]
 			if !ok {
@@ -145,6 +148,10 @@ func ProvenanceProcessor(attrs map[string]string) llbsolver.Processor {
 
 			res.AddAttestation(p.ID, result.Attestation{
 				Kind: gatewaypb.AttestationKindInToto,
+				Metadata: map[string][]byte{
+					result.AttestationReasonKey:     result.AttestationReasonProvenance,
+					result.AttestationInlineOnlyKey: []byte(strconv.FormatBool(inlineOnly)),
+				},
 				InToto: result.InTotoAttestation{
 					PredicateType: slsa.PredicateSLSAProvenance,
 				},

solver/result/attestation.go

@@ -5,9 +5,21 @@ import (
 	digest "github.com/opencontainers/go-digest"
 )
 
+const (
+	AttestationReasonKey     = "reason"
+	AttestationInlineOnlyKey = "inline-only"
+)
+
+var (
+	AttestationReasonSBOM       = []byte("sbom")
+	AttestationReasonProvenance = []byte("provenance")
+)
+
 type Attestation struct {
 	Kind pb.AttestationKind
 
+	Metadata map[string][]byte
+
 	Ref         string
 	Path        string
 	ContentFunc func() ([]byte, error)