Disable provenance, which results in extra artifacts in quay

[jmontleon]

No description provided.

[jmontleon]

@kaovilai, IIUC this should get rid of the extra artifacts we are seeing.

docker/setup-buildx-action#187

As a temporary workaround, instead of pinning to a lower buildx version (once pinned, things often stay pinned ), I can recommend setting --provenance=false on the buildx cli, or provenance: false if using the docker/build-push-action. This will disable the attestation that's causing that change to the multi-platform image.

[jmontleon]

In the log for one of the builds with the extra artifacts in quay (listed as unknown on unknown, rather than linux on aarch64) the SHA matched the attestation manifest

2023-01-26T18:09:30.1608722Z #64 exporting manifest sha256:881334ffb38f96ebbb107ded2230b51c6ae746922c9a8de2429953b0fd9c7233 done
2023-01-26T18:09:30.1609153Z #64 exporting config sha256:cd7493aa493810d4fe531297fe6b31734e1f13b04d9bf311d5f537e36d11b97c done
2023-01-26T18:09:30.1609602Z #64 exporting attestation manifest sha256:78c2acc1e56a268dcb40764ef2a3fb53d325097f42c63dde5d3b2e728b0a7e0e done

[jmontleon]