git url: support specifying checksum in query

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

Author: AkihiroSuda

client/llb/source.go

@@ -323,6 +323,9 @@ func Git(url, ref string, opts ...GitOption) State {
 	}
 
 	checksum := gi.Checksum
+	if checksum == "" && remote != nil && remote.Opts != nil {
+		checksum = remote.Opts.Checksum
+	}
 	if checksum != "" {
 		attrs[pb.AttrGitChecksum] = checksum
 		addCap(&gi.Constraints, pb.CapSourceGitChecksum)

frontend/dockerfile/dfgitutil/git_ref.go

@@ -27,6 +27,10 @@ type GitRef struct {
 	// Commit is optional.
 	Commit string
 
+	// Checksum verifies the Commit if specified.
+	// Checksum is optional.
+	Checksum string
+
 	// SubDir is a directory path inside the repo.
 	// SubDir is optional.
 	SubDir string
@@ -99,7 +103,7 @@ func ParseGitRef(ref string) (*GitRef, error) {
 		_, res.Remote, _ = strings.Cut(res.Remote, "://")
 	}
 	if remote.Opts != nil {
-		res.Commit, res.SubDir = remote.Opts.Ref, remote.Opts.Subdir
+		res.Commit, res.Checksum, res.SubDir = remote.Opts.Ref, remote.Opts.Checksum, remote.Opts.Subdir
 	}
 
 	repoSplitBySlash := strings.Split(res.Remote, "/")

frontend/dockerfile/dockerfile2llb/convert.go

@@ -1517,11 +1517,14 @@ func dispatchCopy(d *dispatchState, cfg copyConfig) error {
 			if gitRef.SubDir != "" {
 				commit += ":" + gitRef.SubDir
 			}
-			gitOptions := []llb.GitOption{llb.WithCustomName(pgName)}
+			gitOptions := []llb.GitOption{llb.WithCustomName(pgName), llb.GitChecksum(gitRef.Checksum)}
 			if cfg.keepGitDir {
 				gitOptions = append(gitOptions, llb.KeepGitDir())
 			}
 			if cfg.checksum != "" {
+				if gitRef.Checksum != "" && gitRef.Checksum != cfg.checksum {
+					return errors.Errorf("conflicting checksum: %s vs %s", gitRef.Checksum, cfg.checksum)
+				}
 				gitOptions = append(gitOptions, llb.GitChecksum(cfg.checksum))
 			}
 			st := llb.Git(gitRef.Remote, commit, gitOptions...)

frontend/dockerui/context.go

@@ -149,7 +149,7 @@ func DetectGitContext(ref string, keepGit bool) (*llb.State, bool) {
 	if g.SubDir != "" {
 		commit += ":" + g.SubDir
 	}
-	gitOpts := []llb.GitOption{WithInternalName("load git source " + ref)}
+	gitOpts := []llb.GitOption{WithInternalName("load git source " + ref), llb.GitChecksum(g.Checksum)}
 	if keepGit {
 		gitOpts = append(gitOpts, llb.KeepGitDir())
 	}

source/git/identifier.go

@@ -34,6 +34,7 @@ func NewGitIdentifier(remoteURL string) (*GitIdentifier, error) {
 	repo := GitIdentifier{Remote: u.Remote}
 	if u.Opts != nil {
 		repo.Ref = u.Opts.Ref
+		repo.Checksum = u.Opts.Checksum
 		repo.Subdir = u.Opts.Subdir
 	}
 	if sd := path.Clean(repo.Subdir); sd == "/" || sd == "." {

util/gitutil/git_url.go

@@ -60,6 +60,8 @@ type GitURL struct {
 type GitURLOpts struct {
 	// Ref is the git reference
 	Ref string
+	// Checksum is the commit hash
+	Checksum string
 	// Subdir is the sub-directory inside the git repository to use
 	Subdir string
 }
@@ -97,6 +99,8 @@ func parseOpts(fragment string, query url.Values) (*GitURLOpts, error) {
 			tag = v[0]
 		case "branch":
 			branch = v[0]
+		case "checksum", "commit":
+			opts.Checksum = v[0]
 		case "subdir":
 			if opts.Subdir != "" && opts.Subdir != v[0] {
 				return nil, errors.Errorf("subdir conflicts: %q vs %q", opts.Subdir, v[0])
@@ -122,6 +126,9 @@ func parseOpts(fragment string, query url.Values) (*GitURLOpts, error) {
 		}
 		opts.Ref = "refs/heads/" + branch
 	}
+	if opts.Checksum != "" && opts.Ref == "" {
+		opts.Ref = opts.Checksum
+	}
 	return opts, nil
 }
 

util/gitutil/git_url_test.go

@@ -170,12 +170,12 @@ func TestParseURL(t *testing.T) {
 			},
 		},
 		{
-			url: "https://github.com/moby/buildkit?tag=v1.0.0",
+			url: "https://github.com/moby/buildkit?tag=v1.0.0&commit=deadbeef",
 			result: GitURL{
 				Scheme: HTTPSProtocol,
 				Host:   "github.com",
 				Path:   "/moby/buildkit",
-				Opts:   &GitURLOpts{Ref: "refs/tags/v1.0.0"},
+				Opts:   &GitURLOpts{Ref: "refs/tags/v1.0.0", Checksum: "deadbeef"},
 			},
 		},
 		{