vendor: buildkit 4d1f260e8490ec438ab66e08bb105577aca0ce06

cli/command/image/build_buildkit.go

@@ -427,30 +427,31 @@ func (t *tracer) write(msg jsonmessage.JSONMessage) {
 }
 
 func parseSecretSpecs(sl []string) (session.Attachable, error) {
-	fs := make([]secretsprovider.FileSource, 0, len(sl))
+	fs := make([]secretsprovider.Source, 0, len(sl))
 	for _, v := range sl {
 		s, err := parseSecret(v)
 		if err != nil {
 			return nil, err
 		}
 		fs = append(fs, *s)
 	}
-	store, err := secretsprovider.NewFileStore(fs)
+	store, err := secretsprovider.NewStore(fs)
 	if err != nil {
 		return nil, err
 	}
 	return secretsprovider.NewSecretProvider(store), nil
 }
 
-func parseSecret(value string) (*secretsprovider.FileSource, error) {
+func parseSecret(value string) (*secretsprovider.Source, error) {
 	csvReader := csv.NewReader(strings.NewReader(value))
 	fields, err := csvReader.Read()
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to parse csv secret")
 	}
 
-	fs := secretsprovider.FileSource{}
+	fs := secretsprovider.Source{}
 
+	var typ string
 	for _, field := range fields {
 		parts := strings.SplitN(field, "=", 2)
 		key := strings.ToLower(parts[0])
@@ -462,17 +463,24 @@ func parseSecret(value string) (*secretsprovider.FileSource, error) {
 		value := parts[1]
 		switch key {
 		case "type":
-			if value != "file" {
+			if value != "file" && value != "env" {
 				return nil, errors.Errorf("unsupported secret type %q", value)
 			}
+			typ = value
 		case "id":
 			fs.ID = value
 		case "source", "src":
 			fs.FilePath = value
+		case "env":
+			fs.Env = value
 		default:
 			return nil, errors.Errorf("unexpected key '%s' in '%s'", key, field)
 		}
 	}
+	if typ == "env" && fs.Env == "" {
+		fs.Env = fs.FilePath
+		fs.FilePath = ""
+	}
 	return &fs, nil
 }
 

cli/command/image/build_test.go

@@ -187,7 +187,7 @@ func TestParseSecret(t *testing.T) {
 		value       string
 		errExpected bool
 		errMatch    string
-		filesource  *secretsprovider.FileSource
+		source      *secretsprovider.Source
 	}
 	var testcases = []testcase{
 		{
@@ -206,23 +206,32 @@ func TestParseSecret(t *testing.T) {
 			errExpected: true,
 			errMatch:    "unexpected key",
 		}, {
-			value:      "src=somefile",
-			filesource: &secretsprovider.FileSource{FilePath: "somefile"},
+			value:  "src=somefile",
+			source: &secretsprovider.Source{FilePath: "somefile"},
 		}, {
-			value:      "source=somefile",
-			filesource: &secretsprovider.FileSource{FilePath: "somefile"},
+			value:  "source=somefile",
+			source: &secretsprovider.Source{FilePath: "somefile"},
 		}, {
-			value:      "id=mysecret",
-			filesource: &secretsprovider.FileSource{ID: "mysecret"},
+			value:  "id=mysecret",
+			source: &secretsprovider.Source{ID: "mysecret"},
 		}, {
-			value:      "id=mysecret,src=somefile",
-			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "somefile"},
+			value:  "id=mysecret,src=somefile",
+			source: &secretsprovider.Source{ID: "mysecret", FilePath: "somefile"},
 		}, {
-			value:      "id=mysecret,source=somefile,type=file",
-			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "somefile"},
+			value:  "id=mysecret,source=somefile,type=file",
+			source: &secretsprovider.Source{ID: "mysecret", FilePath: "somefile"},
 		}, {
-			value:      "id=mysecret,src=somefile,src=othersecretfile",
-			filesource: &secretsprovider.FileSource{ID: "mysecret", FilePath: "othersecretfile"},
+			value:  "id=mysecret,src=somefile,src=othersecretfile",
+			source: &secretsprovider.Source{ID: "mysecret", FilePath: "othersecretfile"},
+		}, {
+			value:  "id=mysecret,src=somefile,env=SECRET",
+			source: &secretsprovider.Source{ID: "mysecret", FilePath: "somefile", Env: "SECRET"},
+		}, {
+			value:  "type=file",
+			source: &secretsprovider.Source{},
+		}, {
+			value:  "type=env",
+			source: &secretsprovider.Source{},
 		}, {
 			value:       "type=invalid",
 			errExpected: true,
@@ -237,7 +246,7 @@ func TestParseSecret(t *testing.T) {
 			if tc.errMatch != "" {
 				assert.ErrorContains(t, err, tc.errMatch)
 			}
-			assert.DeepEqual(t, secret, tc.filesource)
+			assert.DeepEqual(t, secret, tc.source)
 		})
 	}
 }

vendor.conf

@@ -47,7 +47,7 @@ github.com/Microsoft/go-winio                       6c72808b55902eae4c5943626030
 github.com/Microsoft/hcsshim                        5bc557dd210ff2caf615e6e22d398123de77fc11 # v0.8.9
 github.com/miekg/pkcs11                             210dc1e16747c5ba98a03bcbcf728c38086ea357 # v1.0.3
 github.com/mitchellh/mapstructure                   d16e9488127408e67948eb43b6d3fbb9f222da10 # v1.3.2
-github.com/moby/buildkit                            df35e9818d1f9066e616e03f4b8d727c97562e5b
+github.com/moby/buildkit                            4d1f260e8490ec438ab66e08bb105577aca0ce06
 github.com/moby/sys                                 6154f11e6840c0d6b0dbb23f4125a6134b3013c9 # mountinfo/v0.1.3
 github.com/moby/term                                73f35e472e8f0a3f91347164138ce6bd73b756a9
 github.com/modern-go/concurrent                     bacd9c7ef1dd9b15be4a9909b8ac7a4e313eec94 # 1.0.3