@@ -50,7 +50,7 @@ require (

 	github.com/klauspost/compress v1.15.9

 	github.com/miekg/dns v1.1.27

 	github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible

-	github.com/moby/buildkit v0.10.4

+	github.com/moby/buildkit v0.10.5

 	github.com/moby/ipvs v1.0.2

 	github.com/moby/locker v1.0.1

 	github.com/moby/patternmatcher v0.5.0

@@ -764,8 +764,8 @@ github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0Qu

 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=

 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=

 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=

-github.com/moby/buildkit v0.10.4 h1:FvC+buO8isGpUFZ1abdSLdGHZVqg9sqI4BbFL8tlzP4=

-github.com/moby/buildkit v0.10.4/go.mod h1:Yajz9vt1Zw5q9Pp4pdb3TCSUXJBIroIQGQ3TTs/sLug=

+github.com/moby/buildkit v0.10.5 h1:d9krS/lG3dn6N7y+R8o9PTgIixlYAaDk35f3/B4jZOw=

+github.com/moby/buildkit v0.10.5/go.mod h1:Yajz9vt1Zw5q9Pp4pdb3TCSUXJBIroIQGQ3TTs/sLug=

 github.com/moby/ipvs v1.0.2 h1:NSbzuRTvfneftLU3VwPU5QuA6NZ0IUmqq9+VHcQxqHw=

 github.com/moby/ipvs v1.0.2/go.mod h1:2pngiyseZbIKXNv7hsKj3O9UEz30c53MT9005gt2hxQ=

 github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=

@@ -126,7 +126,11 @@ func (gs *gitSource) mountRemote(ctx context.Context, remote string, auth []stri

 	}()

 	if initializeRepo {

-		if _, err := gitWithinDir(ctx, dir, "", "", "", auth, "init", "--bare"); err != nil {

+		// Explicitly set the Git config 'init.defaultBranch' to the

+		// implied default to suppress "hint:" output about not having a

+		// default initial branch name set which otherwise spams unit

+		// test logs.

+		if _, err := gitWithinDir(ctx, dir, "", "", "", auth, "-c", "init.defaultBranch=master", "init", "--bare"); err != nil {

 			return "", nil, errors.Wrapf(err, "failed to init repo at %s", dir)

 		}

@@ -493,11 +497,14 @@ func (gs *gitSourceHandler) Snapshot(ctx context.Context, g session.Group) (out

 		if err := os.MkdirAll(checkoutDir, 0711); err != nil {

 			return nil, err

 		}

-		_, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "init")

+		_, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "-c", "init.defaultBranch=master", "init")

 		if err != nil {

 			return nil, err

 		}

-		_, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "remote", "add", "origin", gitDir)

+		// Defense-in-depth: clone using the file protocol to disable local-clone

+		// optimizations which can be abused on some versions of Git to copy unintended

+		// host files into the build context.

+		_, err = gitWithinDir(ctx, checkoutDirGit, "", sock, knownHosts, nil, "remote", "add", "origin", "file://"+gitDir)

 		if err != nil {

 			return nil, err

 		}

@@ -650,6 +657,7 @@ func git(ctx context.Context, dir, sshAuthSock, knownHosts string, args ...strin

 				flush()

 			}

 		}()

+		args = append([]string{"-c", "protocol.file.allow=user"}, args...) // Block sneaky repositories from using repos from the filesystem as submodules.

 		cmd := exec.Command("git", args...)

 		cmd.Dir = dir // some commands like submodule require this

 		buf := bytes.NewBuffer(nil)

@@ -662,6 +670,8 @@ func git(ctx context.Context, dir, sshAuthSock, knownHosts string, args ...strin

 			"GIT_TERMINAL_PROMPT=0",

 			"GIT_SSH_COMMAND=" + getGitSSHCommand(knownHosts),

 			//	"GIT_TRACE=1",

+			"GIT_CONFIG_NOSYSTEM=1", // Disable reading from system gitconfig.

+			"HOME=/dev/null",        // Disable reading from user gitconfig.

 		}

 		if sshAuthSock != "" {

 			cmd.Env = append(cmd.Env, "SSH_AUTH_SOCK="+sshAuthSock)

@@ -4,6 +4,7 @@ import (

 	"bytes"

 	"context"

 	"io/ioutil"

+	"strings"

 	"sync"

 	"time"

@@ -18,12 +19,14 @@ import (

 type Buffer interface {

 	content.Provider

 	content.Ingester

+	content.Manager

 }

 // NewBuffer returns a new buffer

 func NewBuffer() Buffer {

 	return &buffer{

 		buffers: map[digest.Digest][]byte{},

+		infos:   map[digest.Digest]content.Info{},

 		refs:    map[string]struct{}{},

 	}

 }

@@ -31,9 +34,59 @@ func NewBuffer() Buffer {

 type buffer struct {

 	mu      sync.Mutex

 	buffers map[digest.Digest][]byte

+	infos   map[digest.Digest]content.Info

 	refs    map[string]struct{}

 }

+func (b *buffer) Info(ctx context.Context, dgst digest.Digest) (content.Info, error) {

+	b.mu.Lock()

+	v, ok := b.infos[dgst]

+	b.mu.Unlock()

+	if !ok {

+		return content.Info{}, errdefs.ErrNotFound

+	}

+	return v, nil

+}

+

+func (b *buffer) Update(ctx context.Context, new content.Info, fieldpaths ...string) (content.Info, error) {

+	b.mu.Lock()

+	defer b.mu.Unlock()

+

+	updated, ok := b.infos[new.Digest]

+	if !ok {

+		return content.Info{}, errdefs.ErrNotFound

+	}

+

+	if len(fieldpaths) == 0 {

+		fieldpaths = []string{"labels"}

+	}

+

+	for _, path := range fieldpaths {

+		if strings.HasPrefix(path, "labels.") {

+			if updated.Labels == nil {

+				updated.Labels = map[string]string{}

+			}

+			key := strings.TrimPrefix(path, "labels.")

+			updated.Labels[key] = new.Labels[key]

+			continue

+		}

+		if path == "labels" {

+			updated.Labels = new.Labels

+		}

+	}

+

+	b.infos[new.Digest] = updated

+	return updated, nil

+}

+

+func (b *buffer) Walk(ctx context.Context, fn content.WalkFunc, filters ...string) error {

+	return nil // not implemented

+}

+

+func (b *buffer) Delete(ctx context.Context, dgst digest.Digest) error {

+	return nil // not implemented

+}

+

 func (b *buffer) Writer(ctx context.Context, opts ...content.WriterOpt) (content.Writer, error) {

 	var wOpts content.WriterOpts

 	for _, opt := range opts {

@@ -82,6 +135,7 @@ func (b *buffer) addValue(k digest.Digest, dt []byte) {

 	b.mu.Lock()

 	defer b.mu.Unlock()

 	b.buffers[k] = dt

+	b.infos[k] = content.Info{Digest: k, Size: int64(len(dt))}

 }

 type bufferedWriter struct {

new file mode 100644

@@ -0,0 +1,34 @@

+package contentutil

+

+import (

+	"net/url"

+	"strings"

+

+	"github.com/containerd/containerd/content"

+	"github.com/containerd/containerd/reference"

+)

+

+func HasSource(info content.Info, refspec reference.Spec) (bool, error) {

+	u, err := url.Parse("dummy://" + refspec.Locator)

+	if err != nil {

+		return false, err

+	}

+

+	if info.Labels == nil {

+		return false, nil

+	}

+

+	source, target := u.Hostname(), strings.TrimPrefix(u.Path, "/")

+	repoLabel, ok := info.Labels["containerd.io/distribution.source."+source]

+	if !ok || repoLabel == "" {

+		return false, nil

+	}

+

+	for _, repo := range strings.Split(repoLabel, ",") {

+		// the target repo is not a candidate

+		if repo == target {

+			return true, nil

+		}

+	}

+	return false, nil

+}

@@ -13,6 +13,7 @@ import (

 	"github.com/containerd/containerd/reference"

 	"github.com/containerd/containerd/remotes"

 	"github.com/containerd/containerd/remotes/docker"

+	"github.com/moby/buildkit/util/contentutil"

 	"github.com/moby/buildkit/util/leaseutil"

 	"github.com/moby/buildkit/util/resolver/limited"

 	"github.com/moby/buildkit/util/resolver/retryhandler"

@@ -24,6 +25,7 @@ import (

 type ContentCache interface {

 	content.Ingester

 	content.Provider

+	content.Manager

 }

 var leasesMu sync.Mutex

@@ -75,10 +77,15 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co

 	if desc.Digest != "" {

 		ra, err := cache.ReaderAt(ctx, desc)

 		if err == nil {

-			desc.Size = ra.Size()

-			mt, err := DetectManifestMediaType(ra)

+			info, err := cache.Info(ctx, desc.Digest)

 			if err == nil {

-				desc.MediaType = mt

+				if ok, err := contentutil.HasSource(info, ref); err == nil && ok {

+					desc.Size = ra.Size()

+					mt, err := DetectManifestMediaType(ra)

+					if err == nil {

+						desc.MediaType = mt

+					}

+				}

 			}

 		}

 	}

@@ -101,8 +108,14 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co

 	children := childrenConfigHandler(cache, platform)

+	dslHandler, err := docker.AppendDistributionSourceLabel(cache, ref.String())

+	if err != nil {

+		return "", nil, err

+	}

+

 	handlers := []images.Handler{

 		retryhandler.New(limited.FetchHandler(cache, fetcher, str), func(_ []byte) {}),

+		dslHandler,

 		children,

 	}

 	if err := images.Dispatch(ctx, images.Handlers(handlers...), nil, desc); err != nil {

@@ -475,7 +475,7 @@ github.com/mistifyio/go-zfs

 # github.com/mitchellh/hashstructure/v2 v2.0.2

 ## explicit; go 1.14

 github.com/mitchellh/hashstructure/v2

-# github.com/moby/buildkit v0.10.4

+# github.com/moby/buildkit v0.10.5

 ## explicit; go 1.17

 github.com/moby/buildkit/api/services/control

 github.com/moby/buildkit/api/types