Commit 9232220004 for qemu.org

commit 9232220004434db1f3be5b2c8b1bba935b043acd
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date:   Tue Aug 4 12:54:14 2026 -0400

    gitlab: disable provenance attestations to work around CI bug

    QEMU's CI pipeline involves building container images that will be used
    to run builds and tests. A recent Docker change triggered the following
    error:

      $ docker push "$TAG"
      ...
      error from registry: blob unknown to registry - sha256:4401f6f779caf8841cafd5f483e642fcac56a23a4e4a59523231e101c890dad9

    https://gitlab.com/qemu-project/qemu/-/jobs/15701875927#L2372

    This happens because Docker now pushes out-of-order and the GitLab
    Container Registry rejects due to an unknown reference:
    https://forum.gitlab.com/t/started-yesterday-docker-push-error-from-registry-blob-unknown-to-registry/134733/5

    It is unclear at this point whether GitLab will modify the behavior of
    Container Registry or whether Docker will ship a fix.

    The current workaround is to disable the provenance attestation that is
    involved in this issue. QEMU's CI pipeline container images are used
    internally for testing and are not widely distributed. Provenance
    attestation can be disabled as there are no external consumers of these
    images. Expect to revert this commit in the future when GitLab or Docker
    have released their own fixes.

    Cc: Alex Bennée <alex.bennee@linaro.org>
    Cc: Daniel P. Berrangé <berrange@redhat.com>
    Cc: Thomas Huth <thuth@redhat.com>
    Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
    Message-ID: <20260804165414.480435-1-stefanha@redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

diff --git a/.gitlab-ci.d/container-template.yml b/.gitlab-ci.d/container-template.yml
index 8c7311cca5..88317d650e 100644
--- a/.gitlab-ci.d/container-template.yml
+++ b/.gitlab-ci.d/container-template.yml
@@ -14,7 +14,7 @@
     - echo "TAG:$TAG"
     - echo "COMMON_TAG:$COMMON_TAG"
     - docker build --tag "$TAG" --cache-from "$TAG" --cache-from "$COMMON_TAG"
-      --build-arg BUILDKIT_INLINE_CACHE=1
+      --build-arg BUILDKIT_INLINE_CACHE=1 --provenance=false
       -f "tests/docker/dockerfiles/$NAME.docker" "."
     - docker push "$TAG"
   after_script: