From af8ba7429425ea0027ae5adfb393e071d59a2f55 Mon Sep 17 00:00:00 2001
From: Alex Pyrgiotis <alex.p@freedom.press>
Date: Mon, 10 Mar 2025 14:05:50 +0200
Subject: [PATCH] FIXUP: Move buildkit image alongw with other envvars

---
 .github/workflows/build-push-image.yml | 7 +++----
 Dockerfile.env                         | 4 ++++
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-push-image.yml b/.github/workflows/build-push-image.yml
index e58ccf6..df1619c 100644
--- a/.github/workflows/build-push-image.yml
+++ b/.github/workflows/build-push-image.yml
@@ -20,9 +20,6 @@ on:
         required: true
 
 
-env:
-  BUILDKIT_IMAGE: "docker.io/moby/buildkit:v19.0@sha256:14aa1b4dd92ea0a4cd03a54d0c6079046ea98cd0c0ae6176bdd7036ba370cbbe"
-
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -55,6 +52,7 @@ jobs:
       - name: Compute image parameters
         id: params
         run: |
+          source Dockerfile.env
           DEBIAN_ARCHIVE_DATE=$(date -u +'%Y%m%d')
           SOURCE_DATE_EPOCH=$(date -u -d ${DEBIAN_ARCHIVE_DATE} +"%s")
           TAG=${DEBIAN_ARCHIVE_DATE}-$(git describe --long --first-parent | tail -c +2)
@@ -64,6 +62,7 @@ jobs:
           echo "source_date_epoch=${SOURCE_DATE_EPOCH}" >> $GITHUB_OUTPUT
           echo "tag=${DEBIAN_ARCHIVE_DATE}-${TAG}" >> $GITHUB_OUTPUT
           echo "full_image_name=${FULL_IMAGE_NAME}" >> $GITHUB_OUTPUT
+          echo "buildkit_image=${BUILDKIT_IMAGE}" >> $GITHUB_OUTPUT
 
   build:
     name: Build ${{ matrix.platform.name }} image
@@ -98,7 +97,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          driver-opts: image=${{ env.BUILDKIT_IMAGE }}
+          driver-opts: image=${{ needs.prepare.outputs.buildkit_image }}
 
       - name: Build and push by digest
         id: build
diff --git a/Dockerfile.env b/Dockerfile.env
index 4b98bf9..ac3fcd1 100644
--- a/Dockerfile.env
+++ b/Dockerfile.env
@@ -7,3 +7,7 @@ GVISOR_ARCHIVE_DATE=20250217
 # Can be bumped to the latest version and checksum from https://github.com/ebandal/H2Orestart/releases
 H2ORESTART_CHECKSUM=452331f8603ef456264bd72db6fa8a11ca72b392019a8135c0b2f3095037d7b1
 H2ORESTART_VERSION=v0.7.1
+
+# Buildkit image (taken from freedomofpress/repro-build)
+BUILDKIT_IMAGE="docker.io/moby/buildkit:v19.0@sha256:14aa1b4dd92ea0a4cd03a54d0c6079046ea98cd0c0ae6176bdd7036ba370cbbe"
+BUILDKIT_IMAGE_ROOTLESS="docker.io/moby/buildkit:v0.19.0-rootless@sha256:e901cffdad753892a7c3afb8b9972549fca02c73888cf340c91ed801fdd96d71"