@@ -55,7 +55,7 @@ require (

 	github.com/miekg/dns v1.1.66

 	github.com/mistifyio/go-zfs/v3 v3.0.1

 	github.com/mitchellh/copystructure v1.2.0

-	github.com/moby/buildkit v0.24.0

+	github.com/moby/buildkit v0.25.0-rc1

 	github.com/moby/docker-image-spec v1.3.1

 	github.com/moby/go-archive v0.1.0

 	github.com/moby/ipvs v1.1.0

@@ -110,7 +110,7 @@ require (

 	golang.org/x/time v0.11.0

 	google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a

 	google.golang.org/grpc v1.72.2

-	google.golang.org/protobuf v1.36.6

+	google.golang.org/protobuf v1.36.9

 	gotest.tools/v3 v3.5.2

 	pgregory.net/rapid v1.2.0

 	resenje.org/singleflight v0.4.3

@@ -173,8 +173,8 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi

 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=

 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=

 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=

-github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=

-github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=

+github.com/docker/cli v28.4.0+incompatible h1:RBcf3Kjw2pMtwui5V0DIMdyeab8glEw5QY0UUU4C9kY=

+github.com/docker/cli v28.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=

 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=

 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=

 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=

@@ -396,8 +396,8 @@ github.com/mitchellh/mapstructure v0.0.0-20170523030023-d0303fe80992/go.mod h1:F

 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=

 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=

 github.com/mndrix/tap-go v0.0.0-20171203230836-629fa407e90b/go.mod h1:pzzDgJWZ34fGzaAZGFW22KVZDfyrYW+QABMrWnJBnSs=

-github.com/moby/buildkit v0.24.0 h1:qYfTl7W1SIJzWDIDCcPT8FboHIZCYfi++wvySi3eyFE=

-github.com/moby/buildkit v0.24.0/go.mod h1:4qovICAdR2H4C7+EGMRva5zgHW1gyhT4/flHI7F5F9k=

+github.com/moby/buildkit v0.25.0-rc1 h1:BX93yFRfF1LzD12wCOhjncbpL3RvkPa1+fF7xmsdr28=

+github.com/moby/buildkit v0.25.0-rc1/go.mod h1:phM8sdqnvgK2y1dPDnbwI6veUCXHOZ6KFSl6E164tkc=

 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=

 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=

 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=

@@ -808,8 +808,8 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2

 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=

 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=

 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=

-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=

-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=

+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=

+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=

 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=

 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

@@ -1,6 +1,6 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.

 // versions:

-// 	protoc-gen-go v1.36.6

+// 	protoc-gen-go v1.36.9

 // 	protoc        v3.11.4

 // source: github.com/moby/buildkit/api/services/control/control.proto

@@ -1,6 +1,6 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.

 // versions:

-// 	protoc-gen-go v1.36.6

+// 	protoc-gen-go v1.36.9

 // 	protoc        v3.11.4

 // source: github.com/moby/buildkit/api/types/worker.proto

@@ -92,6 +92,7 @@ type includedPath struct {

 	included         bool

 	includeMatchInfo patternmatcher.MatchInfo

 	excludeMatchInfo patternmatcher.MatchInfo

+	followLinks      bool

 }

 type cacheManager struct {

@@ -431,17 +432,16 @@ func (cc *cacheContext) Checksum(ctx context.Context, mountable cache.Mountable,

 		return "", err

 	}

-	if opts.FollowLinks {

-		for i, w := range includedPaths {

-			if w.record.Type == CacheRecordTypeSymlink {

-				dgst, err := cc.lazyChecksum(ctx, m, w.path, opts.FollowLinks)

-				if err != nil {

-					return "", err

-				}

-				includedPaths[i].record = &CacheRecord{Digest: string(dgst)}

+	for i, w := range includedPaths {

+		if w.followLinks && w.record.Type == CacheRecordTypeSymlink {

+			dgst, err := cc.lazyChecksum(ctx, m, w.path, opts.FollowLinks)

+			if err != nil {

+				return "", err

 			}

+			includedPaths[i].record = &CacheRecord{Digest: string(dgst)}

 		}

 	}

+

 	if len(includedPaths) == 0 {

 		return digest.FromBytes([]byte{}), nil

 	}

@@ -597,6 +597,10 @@ func (cc *cacheContext) includedPaths(ctx context.Context, m *mount, p string, o

 		}

 		maybeIncludedPath := &includedPath{path: fn}

+		if parentDir == nil && opts.FollowLinks {

+			maybeIncludedPath.followLinks = true

+		}

+

 		var shouldInclude bool

 		if opts.Wildcard {

 			if p != "" && (lastMatchedDir == "" || !strings.HasPrefix(fn, lastMatchedDir+"/")) {

@@ -1,6 +1,6 @@

 // Code generated by protoc-gen-go. DO NOT EDIT.

 // versions:

-// 	protoc-gen-go v1.36.6

+// 	protoc-gen-go v1.36.9

 // 	protoc        v3.11.4

 // source: github.com/moby/buildkit/cache/contenthash/checksum.proto

@@ -5,7 +5,6 @@ import (

 	"slices"

 	"time"

-	"github.com/moby/buildkit/identity"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/solver"

 	"github.com/moby/buildkit/util/compression"

@@ -21,8 +20,11 @@ func NewCacheKeyStorage(cc *CacheChains, w worker.Worker) (solver.CacheKeyStorag

 		byResult: map[string]map[string]struct{}{},

 	}

-	for _, it := range cc.items {

-		if _, err := addItemToStorage(storage, it); err != nil {

+	cc.computeIDs()

+

+	for it := range cc.leaves() {

+		visited := make(map[*item]*itemWithOutgoingLinks)

+		if _, err := addItemToStorage(storage, it, visited); err != nil {

 			return nil, nil, err

 		}

 	}

@@ -37,7 +39,12 @@ func NewCacheKeyStorage(cc *CacheChains, w worker.Worker) (solver.CacheKeyStorag

 	return storage, results, nil

 }

-func addItemToStorage(k *cacheKeyStorage, it *item) (*itemWithOutgoingLinks, error) {

+func addItemToStorage(k *cacheKeyStorage, it *item, visited map[*item]*itemWithOutgoingLinks) (*itemWithOutgoingLinks, error) {

+	if v, ok := visited[it]; ok {

+		return v, nil

+	}

+	visited[it] = nil

+

 	if id, ok := k.byItem[it]; ok {

 		if id == "" {

 			return nil, errors.Errorf("invalid loop")

@@ -45,21 +52,18 @@ func addItemToStorage(k *cacheKeyStorage, it *item) (*itemWithOutgoingLinks, err

 		return k.byID[id], nil

 	}

-	var id string

-	if len(it.links) == 0 {

-		id = it.dgst.String()

-	} else {

-		id = identity.NewID()

-	}

-

+	id := it.id

 	k.byItem[it] = ""

-	for i, m := range it.links {

+	for i, m := range it.parents {

 		for l := range m {

-			src, err := addItemToStorage(k, l.src)

+			src, err := addItemToStorage(k, l.src, visited)

 			if err != nil {

 				return nil, err

 			}

+			if src == nil {

+				continue

+			}

 			cl := nlink{

 				input:    i,

 				dgst:     it.dgst,

@@ -78,8 +82,13 @@ func addItemToStorage(k *cacheKeyStorage, it *item) (*itemWithOutgoingLinks, err

 	k.byID[id] = itl

-	if res := it.result; res != nil {

-		resultID := remoteID(res)

+	seen := map[string]struct{}{}

+	for _, res := range it.results {

+		resultID := remoteID(res.Result)

+		if _, ok := seen[resultID]; ok {

+			continue

+		}

+		seen[resultID] = struct{}{}

 		ids, ok := k.byResult[resultID]

 		if !ok {

 			ids = map[string]struct{}{}

@@ -87,6 +96,7 @@ func addItemToStorage(k *cacheKeyStorage, it *item) (*itemWithOutgoingLinks, err

 		}

 		ids[id] = struct{}{}

 	}

+	visited[it] = itl

 	return itl, nil

 }

@@ -120,21 +130,32 @@ func (cs *cacheKeyStorage) WalkResults(id string, fn func(solver.CacheResult) er

 	if !ok {

 		return nil

 	}

-	if res := it.result; res != nil {

-		return fn(solver.CacheResult{ID: remoteID(res), CreatedAt: it.resultTime})

+	seen := map[string]struct{}{}

+	for _, res := range it.results {

+		id := remoteID(res.Result)

+		if _, ok := seen[id]; ok {

+			continue

+		}

+		if err := fn(solver.CacheResult{ID: id, CreatedAt: res.CreatedAt}); err != nil {

+			return err

+		}

+		seen[id] = struct{}{}

 	}

 	return nil

 }

 func (cs *cacheKeyStorage) Load(id string, resultID string) (solver.CacheResult, error) {

-	it, ok := cs.byID[id]

-	if !ok {

-		return solver.CacheResult{}, nil

-	}

-	if res := it.result; res != nil {

-		return solver.CacheResult{ID: remoteID(res), CreatedAt: it.resultTime}, nil

+	var res solver.CacheResult

+	if err := cs.WalkResults(id, func(r solver.CacheResult) error {

+		if r.ID == resultID {

+			res = r

+			return nil

+		}

+		return nil

+	}); err != nil {

+		return solver.CacheResult{}, errors.Wrapf(err, "failed to load cache result for %s", id)

 	}

-	return solver.CacheResult{}, nil

+	return res, nil

 }

 func (cs *cacheKeyStorage) AddResult(id string, res solver.CacheResult) error {

@@ -250,28 +271,35 @@ func (cs *cacheResultStorage) LoadWithParents(ctx context.Context, res solver.Ca

 	for id := range ids {

 		v, ok := cs.byID[id]

-		if ok && v.result != nil {

-			if err := v.walkAllResults(func(i *item) error {

-				if i.result == nil {

-					return nil

-				}

-				id, ok := cs.byItem[i]

-				if !ok {

-					return nil

-				}

-				if isSubRemote(*i.result, *v.result) {

-					ref, err := cs.w.FromRemote(ctx, i.result)

-					if err != nil {

-						return err

+		if ok {

+			if _, ok := visited[v.item]; ok {

+				continue

+			}

+			for _, result := range v.results {

+				resultID := remoteID(result.Result)

+				if resultID == res.ID {

+					if err := v.walkAllResults(func(i *item) error {

+						for _, subRes := range i.results {

+							id, ok := cs.byItem[i]

+							if !ok {

+								return nil

+							}

+							if isSubRemote(*subRes.Result, *result.Result) {

+								ref, err := cs.w.FromRemote(ctx, subRes.Result)

+								if err != nil {

+									return err

+								}

+								m[id] = worker.NewWorkerRefResult(ref, cs.w)

+							}

+						}

+						return nil

+					}, visited); err != nil {

+						for _, v := range m {

+							v.Release(context.TODO())

+						}

+						return nil, err

 					}

-					m[id] = worker.NewWorkerRefResult(ref, cs.w)

 				}

-				return nil

-			}, visited); err != nil {

-				for _, v := range m {

-					v.Release(context.TODO())

-				}

-				return nil, err

 			}

 		}

 	}

@@ -281,34 +309,43 @@ func (cs *cacheResultStorage) LoadWithParents(ctx context.Context, res solver.Ca

 func (cs *cacheResultStorage) Load(ctx context.Context, res solver.CacheResult) (solver.Result, error) {

 	item := cs.byResultID(res.ID)

-	if item == nil || item.result == nil {

-		return nil, errors.WithStack(solver.ErrNotFound)

-	}

-

-	ref, err := cs.w.FromRemote(ctx, item.result)

-	if err != nil {

-		return nil, errors.Wrap(err, "failed to load result from remote")

+	for _, r := range item.results {

+		resultID := remoteID(r.Result)

+		if resultID != res.ID {

+			continue

+		}

+		ref, err := cs.w.FromRemote(ctx, r.Result)

+		if err != nil {

+			return nil, errors.Wrap(err, "failed to load result from remote")

+		}

+		return worker.NewWorkerRefResult(ref, cs.w), nil

 	}

-	return worker.NewWorkerRefResult(ref, cs.w), nil

+	return nil, errors.WithStack(solver.ErrNotFound)

 }

 func (cs *cacheResultStorage) LoadRemotes(ctx context.Context, res solver.CacheResult, compressionopts *compression.Config, _ session.Group) ([]*solver.Remote, error) {

-	if r := cs.byResultID(res.ID); r != nil && r.result != nil {

-		if compressionopts == nil {

-			return []*solver.Remote{r.result}, nil

-		}

-		// Any of blobs in the remote must meet the specified compression option.

-		match := false

-		for _, desc := range r.result.Descriptors {

-			m := compression.IsMediaType(compressionopts.Type, desc.MediaType)

-			match = match || m

-			if compressionopts.Force && !m {

-				match = false

-				break

+	if it := cs.byResultID(res.ID); it != nil {

+		for _, r := range it.results {

+			if compressionopts == nil {

+				resultID := remoteID(r.Result)

+				if resultID != res.ID {

+					continue

+				}

+				return []*solver.Remote{r.Result}, nil

+			}

+			// Any of blobs in the remote must meet the specified compression option.

+			match := false

+			for _, desc := range r.Result.Descriptors {

+				m := compression.IsMediaType(compressionopts.Type, desc.MediaType)

+				match = match || m

+				if compressionopts.Force && !m {

+					match = false

+					break

+				}

+			}

+			if match {

+				return []*solver.Remote{r.Result}, nil

 			}

-		}

-		if match {

-			return []*solver.Remote{r.result}, nil

 		}

 		return nil, nil // return nil as it's best effort.

 	}

@@ -2,10 +2,13 @@ package cacheimport

 import (

 	"context"

+	"encoding/binary"

+	"maps"

+	"slices"

 	"strings"

-	"sync"

-	"time"

+	"unique"

+	"github.com/cespare/xxhash/v2"

 	"github.com/containerd/containerd/v2/core/content"

 	"github.com/moby/buildkit/session"

 	"github.com/moby/buildkit/solver"

@@ -15,72 +18,187 @@ import (

 )

 func NewCacheChains() *CacheChains {

-	return &CacheChains{visited: map[any]struct{}{}}

+	return &CacheChains{roots: map[digest.Digest]*item{}}

 }

 type CacheChains struct {

-	items   []*item

-	visited map[any]struct{}

+	roots map[digest.Digest]*item

 }

 var _ solver.CacheExporterTarget = &CacheChains{}

-func (c *CacheChains) Add(dgst digest.Digest) solver.CacheExporterRecord {

-	if strings.HasPrefix(dgst.String(), "random:") {

-		// random digests will be different *every* run - so we shouldn't cache

-		// it, since there's a zero chance this random digest collides again

-		return &nopRecord{}

+func (c *CacheChains) computeIDs() {

+	for it := range c.leaves() {

+		it.computeID()

 	}

-

-	it := &item{dgst: dgst, backlinks: map[*item]struct{}{}}

-	c.items = append(c.items, it)

-	return it

 }

-func (c *CacheChains) Visit(target any) {

-	c.visited[target] = struct{}{}

+func (c *CacheChains) leaves() map[*item]struct{} {

+	leafs := map[*item]struct{}{}

+	visited := map[*item]struct{}{}

+	for _, it := range c.roots {

+		it.walkChildren(func(i *item) error {

+			if len(i.children) == 0 {

+				leafs[i] = struct{}{}

+			}

+			return nil

+		}, visited)

+	}

+	return leafs

 }

-func (c *CacheChains) Visited(target any) bool {

-	_, ok := c.visited[target]

-	return ok

-}

+func (c *CacheChains) Add(dgst digest.Digest, deps [][]solver.CacheLink, results []solver.CacheExportResult) (solver.CacheExporterRecord, bool, error) {

+	if strings.HasPrefix(dgst.String(), "random:") {

+		return nil, false, nil

+	}

+	r := &item{

+		dgst:    dgst,

+		results: results,

+		cc:      c,

+	}

-func (c *CacheChains) normalize(ctx context.Context) error {

-	st := &normalizeState{

-		added: map[*item]*item{},

-		links: map[*item]map[nlink]map[digest.Digest]struct{}{},

-		byKey: map[digest.Digest]*item{},

+	if len(deps) == 0 {

+		if prev, ok := c.roots[dgst]; ok {

+			r = prev

+		}

+		for _, rr := range results {

+			r.addResult(rr)

+		}

+		c.roots[dgst] = r

+		return r, true, nil

 	}

-	validated := make([]*item, 0, len(c.items))

-	for _, it := range c.items {

-		it.backlinksMu.Lock()

-		it.validate()

-		it.backlinksMu.Unlock()

+	matchDeps := make([]func() map[*item]struct{}, len(deps))

+	for i, dd := range deps {

+		if len(dd) == 0 {

+			return nil, false, errors.Errorf("empty dependency for %s", dgst)

+		}

+		type itemWithSelector struct {

+			Src      *item

+			Selector string

+		}

+		items := make([]itemWithSelector, len(dd))

+		for ii, d := range dd {

+			it, ok := d.Src.(*item)

+			if !ok {

+				return nil, false, errors.Errorf("invalid dependency type %T for %s", d.Src, dgst)

+			}

+			if it.cc != c {

+				return nil, false, errors.Errorf("dependency %s is not part of the same cache chain", it.dgst)

+			}

+			items[ii] = itemWithSelector{

+				Src:      it,

+				Selector: d.Selector,

+			}

+		}

+		matchDeps[i] = func() map[*item]struct{} {

+			candidates := map[*item]struct{}{}

+			for _, it := range items {

+				maps.Copy(candidates, it.Src.children[unique.Make(linkv2{

+					selector: it.Selector,

+					index:    i,

+					digest:   dgst,

+				})])

+			}

+			return candidates

+		}

 	}

-	for _, it := range c.items {

-		if !it.invalid {

-			validated = append(validated, it)

+	items := IntersectAll(matchDeps)

+

+	if len(items) > 1 {

+		var main *item

+		for it := range items {

+			main = it

+			break

 		}

+		for it := range items {

+			if it == main {

+				continue

+			}

+			for l, m := range it.children {

+				if main.children == nil {

+					main.children = map[unique.Handle[linkv2]]map[*item]struct{}{}

+				}

+				if _, ok := main.children[l]; !ok {

+					main.children[l] = map[*item]struct{}{}

+				}

+				for ch := range m {

+					main.children[l][ch] = struct{}{}

+					for i, links := range ch.parents {

+						newlinks := map[link]struct{}{}

+						for l := range links {

+							if l.src == it {

+								l.src = main

+							}

+							newlinks[l] = struct{}{}

+						}

+						ch.parents[i] = newlinks

+					}

+				}

+			}

+			for _, rr := range it.results {

+				main.addResult(rr)

+			}

+		}

+		items = map[*item]struct{}{main: {}}

 	}

-	c.items = validated

-	for _, it := range c.items {

-		_, err := normalizeItem(it, st)

-		if err != nil {

-			return err

+	for it := range items {

+		r = it

+		for _, rr := range results {

+			r.addResult(rr)

+		}

+

+		// make sure that none of the deps are children of r

+		allChildren := map[*item]struct{}{}

+		if err := r.walkChildren(func(i *item) error {

+			allChildren[i] = struct{}{}

+			return nil

+		}, map[*item]struct{}{}); err != nil {

+			return nil, false, errors.Wrapf(err, "failed to walk children of %s", dgst)

+		}

+		for i, dd := range deps {

+			for j, d := range dd {

+				if _, ok := allChildren[d.Src.(*item)]; ok {

+					deps[i][j].Src = nil

+				}

+			}

+		}

+		break

+	}

+	for i, dd := range deps {

+		for _, d := range dd {

+			if d.Src == nil {

+				continue

+			}

+			d.Src.(*item).addChild(r, i, d.Selector)

 		}

 	}

+	return r, true, nil

+}

+

+func IntersectAll[T comparable](

+	funcs []func() map[T]struct{},

+) map[T]struct{} {

+	if len(funcs) == 0 {

+		return nil

+	}

-	st.removeLoops(ctx)

+	intersection := funcs[0]()

-	items := make([]*item, 0, len(st.byKey))

-	for _, it := range st.byKey {

-		items = append(items, it)

+	for _, f := range funcs[1:] {

+		next := f()

+		for k := range intersection {

+			if _, ok := next[k]; !ok {

+				delete(intersection, k)

+			}

+		}

+		if len(intersection) == 0 {

+			return nil

+		}

 	}

-	c.items = items

-	return nil

+

+	return intersection

 }

 // Marshal converts the cache chains structure into a cache config and a

@@ -90,17 +208,13 @@ func (c *CacheChains) normalize(ctx context.Context) error {

 // consistent digest (since cache configs are typically uploaded and stored in

 // content-addressable OCI registries).

 func (c *CacheChains) Marshal(ctx context.Context) (*CacheConfig, DescriptorProvider, error) {

-	if err := c.normalize(ctx); err != nil {

-		return nil, nil, err

-	}

-

 	st := &marshalState{

 		chainsByID:    map[string]int{},

 		descriptors:   DescriptorProvider{},

 		recordsByItem: map[*item]int{},

 	}

-	for _, it := range c.items {

+	for it := range c.leaves() {

 		if err := marshalItem(ctx, it, st); err != nil {

 			return nil, nil, err

 		}

@@ -160,34 +274,33 @@ func (p DescriptorProviderPair) SnapshotLabels(descs []ocispecs.Descriptor, inde

 	return nil

 }

+type linkv2 struct {

+	selector string

+	index    int

+	digest   digest.Digest

+}

+

 // item is an implementation of a record in the cache chain. After validation,

 // normalization and marshalling into the cache config, the item results form

 // into the "layers", while the digests and the links form into the "records".

 type item struct {

+	solver.CacheExporterRecordBase

+

+	id string

+

 	// dgst is the unique identifier for each record.

 	// This *roughly* corresponds to an edge (vertex cachekey + index) in the

 	// solver - however, a single vertex can produce multiple unique cache keys

 	// (e.g. fast/slow), so it's a one-to-many relation.

 	dgst digest.Digest

-	// links are what connect records to each other (with an optional selector),

-	// organized by input index (which correspond to vertex inputs).

-	// We can have multiple links for each index, since *any* of these could be

-	// used to get to this item (e.g. we could retrieve by fast/slow key).

-	links []map[link]struct{}

+	children map[unique.Handle[linkv2]]map[*item]struct{}

-	// backlinks are the inverse of a link - these don't actually get directly

-	// exported, but they're internally used to help efficiently navigate the

-	// graph.

-	backlinks   map[*item]struct{}

-	backlinksMu sync.Mutex

+	parents []map[link]struct{}

-	// result is the result of computing the edge - this is the target of the

-	// data we actually want to store in the cache chain.

-	result     *solver.Remote

-	resultTime time.Time

+	results []solver.CacheExportResult

-	invalid bool

+	cc *CacheChains

 }

 // link is a pointer to an item, with an optional selector.

@@ -196,88 +309,110 @@ type link struct {

 	selector string

 }

-func (c *item) removeLink(src *item) bool {

-	found := false

-	for idx := range c.links {

-		for l := range c.links[idx] {

-			if l.src == src {

-				delete(c.links[idx], l)

-				found = true

-			}

-		}

-	}

-	for idx := range c.links {

-		if len(c.links[idx]) == 0 {

-			c.links = nil

-			break

-		}

+func (c *item) addChild(src *item, index int, selector string) {

+	if c.children == nil {

+		c.children = map[unique.Handle[linkv2]]map[*item]struct{}{}

 	}

-	return found

-}

-

-func (c *item) AddResult(_ digest.Digest, _ int, createdAt time.Time, result *solver.Remote) {

-	c.resultTime = createdAt

-	c.result = result

-}

-

-func (c *item) LinkFrom(rec solver.CacheExporterRecord, index int, selector string) {

-	src, ok := rec.(*item)

+	h := unique.Make(linkv2{

+		selector: selector,

+		index:    index,

+		digest:   src.dgst,

+	})

+	m, ok := c.children[h]

 	if !ok {

+		m = map[*item]struct{}{}

+		c.children[h] = m

+	}

+	if _, ok := m[src]; ok {

 		return

 	}

+	m[src] = struct{}{}

-	for index >= len(c.links) {

-		c.links = append(c.links, map[link]struct{}{})

+	for index >= len(src.parents) {

+		src.parents = append(src.parents, map[link]struct{}{})

 	}

+	src.parents[index][link{src: c, selector: selector}] = struct{}{}

+}

-	c.links[index][link{src: src, selector: selector}] = struct{}{}

-	src.backlinksMu.Lock()

-	src.backlinks[c] = struct{}{}

-	src.backlinksMu.Unlock()

+func (c *item) addResult(r solver.CacheExportResult) {

+	var exists bool

+	for _, rr := range c.results {

+		if !rr.CreatedAt.Equal(r.CreatedAt) {

+			continue

+		}

+		if len(rr.Result.Descriptors) != len(r.Result.Descriptors) {

+			continue

+		}

+		for i, d := range rr.Result.Descriptors {

+			if d.Digest != r.Result.Descriptors[i].Digest {

+				continue

+			}

+		}

+		exists = true

+		break

+	}

+	if !exists {

+		c.results = append(c.results, r)

+	}

 }

-// validate checks if an item is valid (i.e. each index has at least one link)

-// and marks it as such.

-//

-// Essentially, if an index has no links, it means that this cache record is

-// unreachable by the cache importer, so we should remove it. Once we've marked

-// an item as invalid, we remove it from it's backlinks and check it's

-// validity again - since now this linked item may be unreachable too.

-func (c *item) validate() {

-	if c.invalid {

-		// early exit, if the item is already invalid, we've already gone

-		// through the backlinks

+func (c *item) computeID() {

+	if c.id != "" {

 		return

 	}

-	for _, m := range c.links {

-		// if an index has no links, there's no way to access this record, so

-		// mark it as invalid

-		if len(m) == 0 {

-			c.invalid = true

-			break

-		}

+	if len(c.parents) == 0 {

+		c.id = c.dgst.String()

+		return

 	}

-	if c.invalid {

-		for bl := range c.backlinks {

-			// remove ourselves from the backlinked item

-			changed := false

-			for _, m := range bl.links {

-				for l := range m {

-					if l.src == c {

-						delete(m, l)

-						changed = true

-					}

-				}

+	// deterministic ID

+	h := xxhash.New()

+	h.Write([]byte(c.dgst.String()))

+	h.Write([]byte{0})

+

+	for idx, m := range c.parents {

+		binary.Write(h, binary.LittleEndian, uint32(idx))

+		h.Write([]byte{0})

+		for l := range m {

+			if l.src.id == "" {

+				l.src.computeID()

 			}

+			h.Write([]byte(l.src.id))

+			h.Write([]byte{0})

+			h.Write([]byte(l.selector))

+			h.Write([]byte{0})

+		}

+	}

+	c.id = string(h.Sum(nil))

+}

+

+func (c *item) bestResult() *solver.CacheExportResult {

+	if len(c.results) == 0 {

+		return nil

+	}

+	slices.SortFunc(c.results, func(a, b solver.CacheExportResult) int {

+		return b.CreatedAt.Compare(a.CreatedAt)

+	})

+	return &c.results[0]

+}

-			// if we've removed ourselves, we need to check it again

-			if changed {

-				bl.validate()

+func (c *item) walkChildren(fn func(i *item) error, visited map[*item]struct{}) error {

+	if _, ok := visited[c]; ok {

+		return nil

+	}

+	visited[c] = struct{}{}

+	if err := fn(c); err != nil {

+		return err

+	}

+	for _, ch := range c.children {