build args in FROM do not work with content trust about buildkit

[thaJeztah]

Should we add a check for now; ie if a dockerfile with ARG is detected and DCT is enabled, error out with a proper error?

[dciancu]

Hello, just wanted to add that it would be amazing if this error message can be improved. I just spent precious time debugging for this issue as the error message really does not point to an authorization issue as it should. When replacing the ARG variable in the FROM instruction with the actual image I wanted to alias, I received the right error message 401 (you are not authorized...), but when using the ARG variable it returns this invalid reference format error.
IMHO the API should return the same 401 unauthorized error no matter what value it has in the FROM instruction (ARG variable or actual string) as long as the resulting image from the value is unsigned or has an untrusted signature.

[justincormack]

cc @tonistiigi

reported in LinuxKit linuxkit/linuxkit#2244

[tonistiigi]

I remember this came up as a conflicting feature on the original proposal issue for this feature. We should at least improve the docs. There was a discussion 3-4 months ago to move the trust validation to the daemon. I think that is the correct solution for these types of problems.

cc @dnephin

[thaJeztah]

/cc @endophage

[endophage]

Seconded on moving (or more likely, duplicating) trust verification on the daemon. It's the desired experience for Ops people. There's probably a shorter term and still useful fix we can make for this though. We're starting work on a docker trust subcommand for the CLI, I'll add this as a use case and make sure we have a plan for it.

[arm64b]

@endophage @thaJeztah @tonistiigi

Is there a temp workaround here to resolve this problem? If the solution is not finalized yet, I would like to see using the default value of the ARG in Dockerfile when no '--build-arg' provided, like this:
$cat Dockerfile
ARG BASE=alpine:3.6
FROM $BASE AS mirror
...

$docker build --no-cache -t alpine:build .

expected behavior above is the build can run smoothly using the default BASE image: alpine:3.6 without hurting the security