git url: support query form + support specifying checksum in query

client/llb/source.go

@@ -249,45 +249,62 @@ const (
 //
 // By default the git repository is cloned with `--depth=1` to reduce the amount of data downloaded.
 // Additionally the ".git" directory is removed after the clone, you can keep ith with the [KeepGitDir] [GitOption].
+//
+// Git is planned to be deprecated. Use [Git2] instead whenever possible.
 func Git(url, ref string, opts ...GitOption) State {
+	// The logic is complicated for compatibility reason.
 	remote, err := gitutil.ParseURL(url)
 	if errors.Is(err, gitutil.ErrUnknownProtocol) {
 		url = "https://" + url
 		remote, err = gitutil.ParseURL(url)
 	}
 	if remote != nil {
 		url = remote.Remote
+		if remote.Opts != nil {
+			opts = append(opts, GitChecksum(remote.Opts.Checksum))
+		}
+	}
+	if url != "" {
+		opts = append(opts, GitFullURL(url))
 	}
 
-	var id string
 	if err != nil {
 		// If we can't parse the URL, just use the full URL as the ID. The git
 		// operation will fail later on.
-		id = url
-	} else {
-		// We construct the ID manually here, so that we can create the same ID
-		// for different protocols (e.g. https and ssh) that have the same
-		// host/path/fragment combination.
-		id = remote.Host + path.Join("/", remote.Path)
-		if ref != "" {
-			id += "#" + ref
-		}
+		return git(url, nil, opts...)
 	}
 
+	opts = append(opts, GitIDSuffix(ref))
+	return Git2(remote.GitURLBase, opts...)
+}
+
+// Git2 is similar to Git but takes [gitutil.GitURLBase] as the argument.
+func Git2(remote gitutil.GitURLBase, opts ...GitOption) State {
+	// We construct the ID manually here, so that we can create the same ID
+	// for different protocols (e.g. https and ssh) that have the same
+	// host/path/fragment combination.
+	id := remote.Host + path.Join("/", remote.Path)
+	return git(id, &remote, opts...)
+}
+
+func git(id string, remote *gitutil.GitURLBase, opts ...GitOption) State {
 	gi := &GitInfo{
 		AuthHeaderSecret: GitAuthHeaderKey,
 		AuthTokenSecret:  GitAuthTokenKey,
 	}
 	for _, o := range opts {
 		o.SetGitOption(gi)
 	}
+	if gi.IDSuffix != "" {
+		id += "#" + gi.IDSuffix
+	}
 	attrs := map[string]string{}
 	if gi.KeepGitDir {
 		attrs[pb.AttrKeepGitDir] = "true"
 		addCap(&gi.Constraints, pb.CapSourceGitKeepDir)
 	}
-	if url != "" {
-		attrs[pb.AttrFullRemoteURL] = url
+	if gi.FullURL != "" {
+		attrs[pb.AttrFullRemoteURL] = gi.FullURL
 		addCap(&gi.Constraints, pb.CapSourceGitFullURL)
 	}
 	if gi.AuthTokenSecret != "" {
@@ -352,6 +369,8 @@ type GitInfo struct {
 	KnownSSHHosts    string
 	MountSSHSock     string
 	Checksum         string
+	FullURL          string
+	IDSuffix         string // Appended after '#'. Exists only for sake of compatibility.
 }
 
 func KeepGitDir() GitOption {
@@ -386,6 +405,18 @@ func GitChecksum(v string) GitOption {
 	})
 }
 
+func GitFullURL(v string) GitOption {
+	return gitOptionFunc(func(gi *GitInfo) {
+		gi.FullURL = v
+	})
+}
+
+func GitIDSuffix(v string) GitOption {
+	return gitOptionFunc(func(gi *GitInfo) {
+		gi.IDSuffix = v
+	})
+}
+
 // AuthOption can be used with either HTTP or Git sources.
 type AuthOption interface {
 	GitOption

frontend/dockerfile/dfgitutil/git_ref.go

@@ -27,6 +27,10 @@ type GitRef struct {
 	// Commit is optional.
 	Commit string
 
+	// Checksum verifies the Commit if specified.
+	// Checksum is optional.
+	Checksum string
+
 	// SubDir is a directory path inside the repo.
 	// SubDir is optional.
 	SubDir string
@@ -46,6 +50,12 @@ type GitRef struct {
 	// Discouraged, although not deprecated.
 	// Instead, consider using an encrypted TCP connection such as "[email protected]/foo/bar.git" or "https://github.com/foo/bar.git".
 	UnencryptedTCP bool
+
+	gitURL *gitutil.GitURL
+}
+
+func (r *GitRef) GitURL() *gitutil.GitURL {
+	return r.gitURL
 }
 
 // var gitURLPathWithFragmentSuffix = regexp.MustCompile(`\.git(?:#.+)?$`)
@@ -63,11 +73,14 @@ func ParseGitRef(ref string) (*GitRef, error) {
 		return nil, cerrdefs.ErrInvalidArgument
 	} else if strings.HasPrefix(ref, "github.com/") {
 		res.IndistinguishableFromLocal = true // Deprecated
-		remote = gitutil.FromURL(&url.URL{
+		remote, err = gitutil.FromURL(&url.URL{
 			Scheme: "https",
 			Host:   "github.com",
 			Path:   strings.TrimPrefix(ref, "github.com/"),
 		})
+		if err != nil {
+			return nil, err
+		}
 	} else {
 		remote, err = gitutil.ParseURL(ref)
 		if errors.Is(err, gitutil.ErrUnknownProtocol) {
@@ -96,11 +109,12 @@ func ParseGitRef(ref string) (*GitRef, error) {
 		_, res.Remote, _ = strings.Cut(res.Remote, "://")
 	}
 	if remote.Opts != nil {
-		res.Commit, res.SubDir = remote.Opts.Ref, remote.Opts.Subdir
+		res.Commit, res.Checksum, res.SubDir = remote.Opts.Ref, remote.Opts.Checksum, remote.Opts.Subdir
 	}
 
 	repoSplitBySlash := strings.Split(res.Remote, "/")
 	res.ShortName = strings.TrimSuffix(repoSplitBySlash[len(repoSplitBySlash)-1], ".git")
+	res.gitURL = remote
 
 	return res, nil
 }

frontend/dockerfile/dfgitutil/git_ref_test.go

@@ -138,6 +138,15 @@ func TestParseGitRef(t *testing.T) {
 			ref:      ".git",
 			expected: nil,
 		},
+		{
+			ref: "https://github.com/docker/docker.git?ref=v1.0.0&subdir=/subdir",
+			expected: &GitRef{
+				Remote:    "https://github.com/docker/docker.git",
+				ShortName: "docker",
+				Commit:    "v1.0.0",
+				SubDir:    "/subdir",
+			},
+		},
 	}
 	for _, tt := range cases {
 		t.Run(tt.ref, func(t *testing.T) {
@@ -147,7 +156,7 @@ func TestParseGitRef(t *testing.T) {
 				require.Error(t, err)
 			} else {
 				require.NoError(t, err)
-				require.Equal(t, tt.expected, got)
+				require.EqualExportedValues(t, tt.expected, got)
 			}
 		})
 	}