From 94e23700239913f71ab399b6148d1f9edf037474 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Sat, 24 Feb 2024 16:03:55 +0100
Subject: [PATCH] provenance: move types to a dedicated package

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 executor/resources/cpu.go                     |  12 +-
 executor/resources/cpu_test.go                |   8 +-
 executor/resources/io.go                      |   6 +-
 executor/resources/io_test.go                 |  10 +-
 executor/resources/memory.go                  |   6 +-
 executor/resources/memory_test.go             |  10 +-
 executor/resources/monitor.go                 |  22 ++--
 executor/resources/pids.go                    |   6 +-
 executor/resources/pids_test.go               |   4 +-
 executor/resources/sys.go                     |   6 +-
 executor/resources/sys_linux.go               |  16 +--
 executor/resources/sys_nolinux.go             |   4 +-
 .../dockerfile/dockerfile_provenance_test.go  |  20 +--
 solver/llbsolver/provenance.go                |  43 +++----
 solver/llbsolver/provenance/buildconfig.go    |  32 -----
 solver/llbsolver/provenance/capture.go        |  60 ++-------
 solver/llbsolver/provenance/predicate.go      |  67 ++--------
 solver/llbsolver/provenance/types/types.go    | 116 ++++++++++++++++++
 solver/llbsolver/solver.go                    |   6 +-
 source/containerimage/identifier.go           |   5 +-
 source/git/identifier.go                      |   9 +-
 source/http/identifier.go                     |   3 +-
 source/local/identifier.go                    |   3 +-
 23 files changed, 240 insertions(+), 234 deletions(-)
 delete mode 100644 solver/llbsolver/provenance/buildconfig.go
 create mode 100644 solver/llbsolver/provenance/types/types.go

diff --git a/executor/resources/cpu.go b/executor/resources/cpu.go
index 53d31f477fb3..c54f48c448dc 100644
--- a/executor/resources/cpu.go
+++ b/executor/resources/cpu.go
@@ -8,7 +8,7 @@ import (
 	"strings"
 	"syscall"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/pkg/errors"
 )
 
@@ -21,8 +21,8 @@ const (
 	cpuThrottledUsec = "throttled_usec"
 )
 
-func getCgroupCPUStat(cgroupPath string) (*types.CPUStat, error) {
-	cpuStat := &types.CPUStat{}
+func getCgroupCPUStat(cgroupPath string) (*resourcestypes.CPUStat, error) {
+	cpuStat := &resourcestypes.CPUStat{}
 
 	// Read cpu.stat file
 	cpuStatFile, err := os.Open(filepath.Join(cgroupPath, "cpu.stat"))
@@ -79,7 +79,7 @@ func getCgroupCPUStat(cgroupPath string) (*types.CPUStat, error) {
 
 	return cpuStat, nil
 }
-func parsePressureFile(filename string) (*types.Pressure, error) {
+func parsePressureFile(filename string) (*resourcestypes.Pressure, error) {
 	content, err := os.ReadFile(filename)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) || errors.Is(err, syscall.ENOTSUP) { // pressure file requires CONFIG_PSI
@@ -90,7 +90,7 @@ func parsePressureFile(filename string) (*types.Pressure, error) {
 
 	lines := strings.Split(string(content), "\n")
 
-	pressure := &types.Pressure{}
+	pressure := &resourcestypes.Pressure{}
 	for _, line := range lines {
 		// Skip empty lines
 		if len(strings.TrimSpace(line)) == 0 {
@@ -99,7 +99,7 @@ func parsePressureFile(filename string) (*types.Pressure, error) {
 
 		fields := strings.Fields(line)
 		prefix := fields[0]
-		pressureValues := &types.PressureValues{}
+		pressureValues := &resourcestypes.PressureValues{}
 
 		for i := 1; i < len(fields); i++ {
 			keyValue := strings.Split(fields[i], "=")
diff --git a/executor/resources/cpu_test.go b/executor/resources/cpu_test.go
index e85e2545cf3f..884bcdaad2d0 100644
--- a/executor/resources/cpu_test.go
+++ b/executor/resources/cpu_test.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/stretchr/testify/require"
 )
 
@@ -72,14 +72,14 @@ full avg10=0.12 avg60=0.34 avg300=0.56 total=9876`
 	full56 := 0.56
 	full9876 := uint64(9876)
 
-	expected := &types.Pressure{
-		Some: &types.PressureValues{
+	expected := &resourcestypes.Pressure{
+		Some: &resourcestypes.PressureValues{
 			Avg10:  &some123,
 			Avg60:  &some456,
 			Avg300: &some789,
 			Total:  &some3031,
 		},
-		Full: &types.PressureValues{
+		Full: &resourcestypes.PressureValues{
 			Avg10:  &full12,
 			Avg60:  &full34,
 			Avg300: &full56,
diff --git a/executor/resources/io.go b/executor/resources/io.go
index be56d7637535..05a3a7ff6c1b 100644
--- a/executor/resources/io.go
+++ b/executor/resources/io.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/pkg/errors"
 )
 
@@ -24,7 +24,7 @@ const (
 	ioDiscardIOs   = "dios"
 )
 
-func getCgroupIOStat(cgroupPath string) (*types.IOStat, error) {
+func getCgroupIOStat(cgroupPath string) (*resourcestypes.IOStat, error) {
 	ioStatPath := filepath.Join(cgroupPath, ioStatFile)
 	data, err := os.ReadFile(ioStatPath)
 	if err != nil {
@@ -34,7 +34,7 @@ func getCgroupIOStat(cgroupPath string) (*types.IOStat, error) {
 		return nil, errors.Wrapf(err, "failed to read %s", ioStatPath)
 	}
 
-	ioStat := &types.IOStat{}
+	ioStat := &resourcestypes.IOStat{}
 	lines := strings.Split(string(data), "\n")
 	for _, line := range lines {
 		parts := strings.Fields(line)
diff --git a/executor/resources/io_test.go b/executor/resources/io_test.go
index ef7989493503..4a6710c40d1e 100644
--- a/executor/resources/io_test.go
+++ b/executor/resources/io_test.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -25,14 +25,14 @@ full avg10=0.12 avg60=0.34 avg300=0.56 total=9876`
 	ioStat, err := getCgroupIOStat(testDir)
 	assert.NoError(t, err)
 
-	var expectedPressure = &types.Pressure{
-		Some: &types.PressureValues{
+	var expectedPressure = &resourcestypes.Pressure{
+		Some: &resourcestypes.PressureValues{
 			Avg10:  float64Ptr(1.23),
 			Avg60:  float64Ptr(4.56),
 			Avg300: float64Ptr(7.89),
 			Total:  uint64Ptr(3031),
 		},
-		Full: &types.PressureValues{
+		Full: &resourcestypes.PressureValues{
 			Avg10:  float64Ptr(0.12),
 			Avg60:  float64Ptr(0.34),
 			Avg300: float64Ptr(0.56),
@@ -40,7 +40,7 @@ full avg10=0.12 avg60=0.34 avg300=0.56 total=9876`
 		},
 	}
 
-	expectedIOStat := &types.IOStat{
+	expectedIOStat := &resourcestypes.IOStat{
 		ReadBytes:    uint64Ptr(1024 + 512),
 		WriteBytes:   uint64Ptr(2048 + 1024),
 		DiscardBytes: uint64Ptr(4096 + 2048),
diff --git a/executor/resources/memory.go b/executor/resources/memory.go
index 775f0f8dae61..07c43c292c57 100644
--- a/executor/resources/memory.go
+++ b/executor/resources/memory.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/pkg/errors"
 )
 
@@ -41,8 +41,8 @@ const (
 	memoryOomKill = "oom_kill"
 )
 
-func getCgroupMemoryStat(path string) (*types.MemoryStat, error) {
-	memoryStat := &types.MemoryStat{}
+func getCgroupMemoryStat(path string) (*resourcestypes.MemoryStat, error) {
+	memoryStat := &resourcestypes.MemoryStat{}
 
 	// Parse memory.stat
 	err := parseKeyValueFile(filepath.Join(path, memoryStatFile), func(key string, value uint64) {
diff --git a/executor/resources/memory_test.go b/executor/resources/memory_test.go
index 2b68d66bb26d..a8afbcf5cdc6 100644
--- a/executor/resources/memory_test.go
+++ b/executor/resources/memory_test.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -51,14 +51,14 @@ oom_kill 5`
 	memoryStat, err := getCgroupMemoryStat(testDir)
 	assert.NoError(t, err)
 
-	var expectedPressure = &types.Pressure{
-		Some: &types.PressureValues{
+	var expectedPressure = &resourcestypes.Pressure{
+		Some: &resourcestypes.PressureValues{
 			Avg10:  float64Ptr(1.23),
 			Avg60:  float64Ptr(4.56),
 			Avg300: float64Ptr(7.89),
 			Total:  uint64Ptr(3031),
 		},
-		Full: &types.PressureValues{
+		Full: &resourcestypes.PressureValues{
 			Avg10:  float64Ptr(0.12),
 			Avg60:  float64Ptr(0.34),
 			Avg300: float64Ptr(0.56),
@@ -66,7 +66,7 @@ oom_kill 5`
 		},
 	}
 
-	expectedMemoryStat := &types.MemoryStat{
+	expectedMemoryStat := &resourcestypes.MemoryStat{
 		SwapBytes:     uint64Ptr(987654),
 		Anon:          uint64Ptr(24576),
 		File:          uint64Ptr(12791808),
diff --git a/executor/resources/monitor.go b/executor/resources/monitor.go
index 25a53f280671..aa8cf2f1bb4d 100644
--- a/executor/resources/monitor.go
+++ b/executor/resources/monitor.go
@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/moby/buildkit/util/bklog"
 	"github.com/moby/buildkit/util/network"
 	"github.com/prometheus/procfs"
@@ -30,15 +30,15 @@ var isCgroupV2 bool
 type cgroupRecord struct {
 	once         sync.Once
 	ns           string
-	sampler      *Sub[*types.Sample]
+	sampler      *Sub[*resourcestypes.Sample]
 	closeSampler func() error
-	samples      []*types.Sample
+	samples      []*resourcestypes.Sample
 	err          error
 	done         chan struct{}
 	monitor      *Monitor
 	netSampler   NetworkSampler
 	startCPUStat *procfs.CPUStat
-	sysCPUStat   *types.SysCPUStat
+	sysCPUStat   *resourcestypes.SysCPUStat
 }
 
 func (r *cgroupRecord) Wait() error {
@@ -90,7 +90,7 @@ func (r *cgroupRecord) close() {
 		if r.startCPUStat != nil {
 			stat, err := r.monitor.proc.Stat()
 			if err == nil {
-				cpu := &types.SysCPUStat{
+				cpu := &resourcestypes.SysCPUStat{
 					User:      stat.CPUTotal.User - r.startCPUStat.User,
 					Nice:      stat.CPUTotal.Nice - r.startCPUStat.Nice,
 					System:    stat.CPUTotal.System - r.startCPUStat.System,
@@ -108,7 +108,7 @@ func (r *cgroupRecord) close() {
 	})
 }
 
-func (r *cgroupRecord) sample(tm time.Time) (*types.Sample, error) {
+func (r *cgroupRecord) sample(tm time.Time) (*resourcestypes.Sample, error) {
 	cpu, err := getCgroupCPUStat(filepath.Join(defaultMountpoint, r.ns))
 	if err != nil {
 		return nil, err
@@ -125,7 +125,7 @@ func (r *cgroupRecord) sample(tm time.Time) (*types.Sample, error) {
 	if err != nil {
 		return nil, err
 	}
-	sample := &types.Sample{
+	sample := &resourcestypes.Sample{
 		Timestamp_: tm,
 		CPUStat:    cpu,
 		MemoryStat: memory,
@@ -142,12 +142,12 @@ func (r *cgroupRecord) sample(tm time.Time) (*types.Sample, error) {
 	return sample, nil
 }
 
-func (r *cgroupRecord) Samples() (*types.Samples, error) {
+func (r *cgroupRecord) Samples() (*resourcestypes.Samples, error) {
 	<-r.done
 	if r.err != nil {
 		return nil, r.err
 	}
-	return &types.Samples{
+	return &resourcestypes.Samples{
 		Samples:    r.samples,
 		SysCPUStat: r.sysCPUStat,
 	}, nil
@@ -160,7 +160,7 @@ func (r *nopRecord) Wait() error {
 	return nil
 }
 
-func (r *nopRecord) Samples() (*types.Samples, error) {
+func (r *nopRecord) Samples() (*resourcestypes.Samples, error) {
 	return nil, nil
 }
 
@@ -189,7 +189,7 @@ type RecordOpt struct {
 	NetworkSampler NetworkSampler
 }
 
-func (m *Monitor) RecordNamespace(ns string, opt RecordOpt) (types.Recorder, error) {
+func (m *Monitor) RecordNamespace(ns string, opt RecordOpt) (resourcestypes.Recorder, error) {
 	isClosed := false
 	select {
 	case <-m.closed:
diff --git a/executor/resources/pids.go b/executor/resources/pids.go
index 88493d805eb3..169ea0c3bc9e 100644
--- a/executor/resources/pids.go
+++ b/executor/resources/pids.go
@@ -6,7 +6,7 @@ import (
 	"strconv"
 	"strings"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/pkg/errors"
 )
 
@@ -14,8 +14,8 @@ const (
 	pidsCurrentFile = "pids.current"
 )
 
-func getCgroupPIDsStat(path string) (*types.PIDsStat, error) {
-	pidsStat := &types.PIDsStat{}
+func getCgroupPIDsStat(path string) (*resourcestypes.PIDsStat, error) {
+	pidsStat := &resourcestypes.PIDsStat{}
 
 	v, err := parseSingleValueFile(filepath.Join(path, pidsCurrentFile))
 	if err != nil {
diff --git a/executor/resources/pids_test.go b/executor/resources/pids_test.go
index 928be80798e1..ded667e74112 100644
--- a/executor/resources/pids_test.go
+++ b/executor/resources/pids_test.go
@@ -5,7 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -16,7 +16,7 @@ func TestParsePidsStat(t *testing.T) {
 	err := os.WriteFile(filepath.Join(testDir, "pids.current"), []byte("123"), 0644)
 	assert.NoError(t, err)
 
-	expectedPidsStat := &types.PIDsStat{
+	expectedPidsStat := &resourcestypes.PIDsStat{
 		Current: uint64Ptr(123),
 	}
 	stats, err := getCgroupPIDsStat(filepath.Join(testDir))
diff --git a/executor/resources/sys.go b/executor/resources/sys.go
index 7082517adce5..30fb3509b34d 100644
--- a/executor/resources/sys.go
+++ b/executor/resources/sys.go
@@ -1,9 +1,9 @@
 package resources
 
-import "github.com/moby/buildkit/executor/resources/types"
+import resourcestypes "github.com/moby/buildkit/executor/resources/types"
 
-type SysSampler = Sub[*types.SysSample]
+type SysSampler = Sub[*resourcestypes.SysSample]
 
-func NewSysSampler() (*Sampler[*types.SysSample], error) {
+func NewSysSampler() (*Sampler[*resourcestypes.SysSample], error) {
 	return newSysSampler()
 }
diff --git a/executor/resources/sys_linux.go b/executor/resources/sys_linux.go
index d7835137baa2..c0f83760c1d7 100644
--- a/executor/resources/sys_linux.go
+++ b/executor/resources/sys_linux.go
@@ -4,32 +4,32 @@ import (
 	"os"
 	"time"
 
-	"github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/prometheus/procfs"
 )
 
-func newSysSampler() (*Sampler[*types.SysSample], error) {
+func newSysSampler() (*Sampler[*resourcestypes.SysSample], error) {
 	pfs, err := procfs.NewDefaultFS()
 	if err != nil {
 		return nil, err
 	}
 
-	return NewSampler(2*time.Second, 20, func(tm time.Time) (*types.SysSample, error) {
+	return NewSampler(2*time.Second, 20, func(tm time.Time) (*resourcestypes.SysSample, error) {
 		return sampleSys(pfs, tm)
 	}), nil
 }
 
-func sampleSys(proc procfs.FS, tm time.Time) (*types.SysSample, error) {
+func sampleSys(proc procfs.FS, tm time.Time) (*resourcestypes.SysSample, error) {
 	stat, err := proc.Stat()
 	if err != nil {
 		return nil, err
 	}
 
-	s := &types.SysSample{
+	s := &resourcestypes.SysSample{
 		Timestamp_: tm,
 	}
 
-	s.CPUStat = &types.SysCPUStat{
+	s.CPUStat = &resourcestypes.SysCPUStat{
 		User:      stat.CPUTotal.User,
 		Nice:      stat.CPUTotal.Nice,
 		System:    stat.CPUTotal.System,
@@ -42,7 +42,7 @@ func sampleSys(proc procfs.FS, tm time.Time) (*types.SysSample, error) {
 		GuestNice: stat.CPUTotal.GuestNice,
 	}
 
-	s.ProcStat = &types.ProcStat{
+	s.ProcStat = &resourcestypes.ProcStat{
 		ContextSwitches:  stat.ContextSwitches,
 		ProcessCreated:   stat.ProcessCreated,
 		ProcessesRunning: stat.ProcessesRunning,
@@ -53,7 +53,7 @@ func sampleSys(proc procfs.FS, tm time.Time) (*types.SysSample, error) {
 		return nil, err
 	}
 
-	s.MemoryStat = &types.SysMemoryStat{
+	s.MemoryStat = &resourcestypes.SysMemoryStat{
 		Total:     mem.MemTotal,
 		Free:      mem.MemFree,
 		Buffers:   mem.Buffers,
diff --git a/executor/resources/sys_nolinux.go b/executor/resources/sys_nolinux.go
index dd0da8582e3d..23c68ac865a1 100644
--- a/executor/resources/sys_nolinux.go
+++ b/executor/resources/sys_nolinux.go
@@ -2,8 +2,8 @@
 
 package resources
 
-import "github.com/moby/buildkit/executor/resources/types"
+import resourcestypes "github.com/moby/buildkit/executor/resources/types"
 
-func newSysSampler() (*Sampler[*types.SysSample], error) {
+func newSysSampler() (*Sampler[*resourcestypes.SysSample], error) {
 	return nil, nil
 }
diff --git a/frontend/dockerfile/dockerfile_provenance_test.go b/frontend/dockerfile/dockerfile_provenance_test.go
index 185515a05ef2..602d38ae9602 100644
--- a/frontend/dockerfile/dockerfile_provenance_test.go
+++ b/frontend/dockerfile/dockerfile_provenance_test.go
@@ -29,7 +29,7 @@ import (
 	"github.com/moby/buildkit/frontend/dockerui"
 	gateway "github.com/moby/buildkit/frontend/gateway/client"
 	"github.com/moby/buildkit/identity"
-	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/solver/pb"
 	"github.com/moby/buildkit/util/contentutil"
 	"github.com/moby/buildkit/util/testutil"
@@ -126,7 +126,7 @@ RUN echo "ok" > /foo
 			require.Equal(t, "https://slsa.dev/provenance/v0.2", attest.PredicateType) // intentionally not const
 
 			type stmtT struct {
-				Predicate provenance.ProvenancePredicate `json:"predicate"`
+				Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 			}
 			var stmt stmtT
 			require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -323,7 +323,7 @@ COPY myapp.Dockerfile /
 	require.Equal(t, "https://slsa.dev/provenance/v0.2", attest.PredicateType) // intentionally not const
 
 	type stmtT struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	var stmt stmtT
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -459,7 +459,7 @@ RUN echo "ok-$TARGETARCH" > /foo
 		require.Equal(t, "https://slsa.dev/provenance/v0.2", attest.PredicateType) // intentionally not const
 
 		type stmtT struct {
-			Predicate provenance.ProvenancePredicate `json:"predicate"`
+			Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 		}
 		var stmt stmtT
 		require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -641,7 +641,7 @@ func testClientFrontendProvenance(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, "https://slsa.dev/provenance/v0.2", attest.PredicateType) // intentionally not const
 
 	type stmtT struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	var stmt stmtT
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -787,7 +787,7 @@ func testClientLLBProvenance(t *testing.T, sb integration.Sandbox) {
 	require.Equal(t, "https://slsa.dev/provenance/v0.2", attest.PredicateType) // intentionally not const
 
 	type stmtT struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	var stmt stmtT
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -867,7 +867,7 @@ RUN --mount=type=secret,id=mysecret --mount=type=secret,id=othersecret --mount=t
 
 	att := imgs.FindAttestation(expPlatform)
 	type stmtT struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	var stmt stmtT
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -994,7 +994,7 @@ EOF
 
 	att := imgs.FindAttestation(expPlatform)
 	type stmtT struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	var stmt stmtT
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
@@ -1268,7 +1268,7 @@ COPY bar bar2
 
 	require.NotEqual(t, len(provDt), 0)
 
-	var pred provenance.ProvenancePredicate
+	var pred provenancetypes.ProvenancePredicate
 	require.NoError(t, json.Unmarshal(provDt, &pred))
 
 	sources := pred.Metadata.BuildKitMetadata.Source.Infos
@@ -1349,7 +1349,7 @@ RUN date +%s > /b.txt
 	require.NotNil(t, att)
 
 	var stmt struct {
-		Predicate provenance.ProvenancePredicate `json:"predicate"`
+		Predicate provenancetypes.ProvenancePredicate `json:"predicate"`
 	}
 	require.NoError(t, json.Unmarshal(att.LayersRaw[0], &stmt))
 	pred := stmt.Predicate
diff --git a/solver/llbsolver/provenance.go b/solver/llbsolver/provenance.go
index eb6163e49234..9467da40b0b5 100644
--- a/solver/llbsolver/provenance.go
+++ b/solver/llbsolver/provenance.go
@@ -19,6 +19,7 @@ import (
 	"github.com/moby/buildkit/solver"
 	"github.com/moby/buildkit/solver/llbsolver/ops"
 	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/solver/pb"
 	"github.com/moby/buildkit/worker"
 	digest "github.com/opencontainers/go-digest"
@@ -37,7 +38,7 @@ type provenanceBridge struct {
 	mu  sync.Mutex
 	req *frontend.SolveRequest
 
-	images     []provenance.ImageSource
+	images     []provenancetypes.ImageSource
 	builds     []resultWithBridge
 	subBridges []*provenanceBridge
 }
@@ -56,8 +57,8 @@ func (b *provenanceBridge) eachRef(f func(r solver.ResultProxy) error) error {
 	return nil
 }
 
-func (b *provenanceBridge) allImages() []provenance.ImageSource {
-	res := make([]provenance.ImageSource, 0, len(b.images))
+func (b *provenanceBridge) allImages() []provenancetypes.ImageSource {
+	res := make([]provenancetypes.ImageSource, 0, len(b.images))
 	res = append(res, b.images...)
 	for _, sb := range b.subBridges {
 		res = append(res, sb.allImages()...)
@@ -143,7 +144,7 @@ func (b *provenanceBridge) ResolveSourceMetadata(ctx context.Context, op *pb.Sou
 		ref := strings.TrimPrefix(resp.Op.Identifier, "docker-image://")
 		ref = strings.TrimPrefix(ref, "oci-layout://")
 		b.mu.Lock()
-		b.images = append(b.images, provenance.ImageSource{
+		b.images = append(b.images, provenancetypes.ImageSource{
 			Ref:      ref,
 			Platform: opt.Platform,
 			Digest:   img.Digest,
@@ -199,7 +200,7 @@ type resultRequests struct {
 }
 
 // filterImagePlatforms filter out images that not for the current platform if an image exists for every platform in a result
-func (reqs *resultRequests) filterImagePlatforms(k string, imgs []provenance.ImageSource) []provenance.ImageSource {
+func (reqs *resultRequests) filterImagePlatforms(k string, imgs []provenancetypes.ImageSource) []provenancetypes.ImageSource {
 	if len(reqs.platforms) == 0 {
 		return imgs
 	}
@@ -237,7 +238,7 @@ func (reqs *resultRequests) filterImagePlatforms(k string, imgs []provenance.Ima
 		}
 	}
 
-	out := make([]provenance.ImageSource, 0, len(imgs))
+	out := make([]provenancetypes.ImageSource, 0, len(imgs))
 	for _, img := range imgs {
 		if _, ok := m[img.Ref]; ok && img.Platform != nil {
 			if current.OS == img.Platform.OS && current.Architecture == img.Platform.Architecture {
@@ -284,20 +285,20 @@ func captureProvenance(ctx context.Context, res solver.CachedResultWithProvenanc
 			pr := op.Proto()
 			for _, m := range pr.Mounts {
 				if m.MountType == pb.MountType_SECRET {
-					c.AddSecret(provenance.Secret{
+					c.AddSecret(provenancetypes.Secret{
 						ID:       m.SecretOpt.GetID(),
 						Optional: m.SecretOpt.GetOptional(),
 					})
 				}
 				if m.MountType == pb.MountType_SSH {
-					c.AddSSH(provenance.SSH{
+					c.AddSSH(provenancetypes.SSH{
 						ID:       m.SSHOpt.GetID(),
 						Optional: m.SSHOpt.GetOptional(),
 					})
 				}
 			}
 			for _, se := range pr.Secretenv {
-				c.AddSecret(provenance.Secret{
+				c.AddSecret(provenancetypes.Secret{
 					ID:       se.GetID(),
 					Optional: se.GetOptional(),
 				})
@@ -324,7 +325,7 @@ func captureProvenance(ctx context.Context, res solver.CachedResultWithProvenanc
 }
 
 type ProvenanceCreator struct {
-	pr        *provenance.ProvenancePredicate
+	pr        *provenancetypes.ProvenancePredicate
 	j         *solver.Job
 	sampler   *resources.SysSampler
 	addLayers func() error
@@ -430,7 +431,7 @@ func NewProvenanceCreator(ctx context.Context, cp *provenance.Capture, res solve
 
 			if len(m) != 0 {
 				if pr.Metadata == nil {
-					pr.Metadata = &provenance.ProvenanceMetadata{}
+					pr.Metadata = &provenancetypes.ProvenanceMetadata{}
 				}
 
 				pr.Metadata.BuildKitMetadata.Layers = m
@@ -453,7 +454,7 @@ func NewProvenanceCreator(ctx context.Context, cp *provenance.Capture, res solve
 	return pc, nil
 }
 
-func (p *ProvenanceCreator) Predicate() (*provenance.ProvenancePredicate, error) {
+func (p *ProvenanceCreator) Predicate() (*provenancetypes.ProvenancePredicate, error) {
 	end := p.j.RegisterCompleteTime()
 	p.pr.Metadata.BuildFinishedOn = &end
 
@@ -546,14 +547,14 @@ func resolveRemotes(ctx context.Context, res solver.Result) ([]*solver.Remote, e
 	return remotes, nil
 }
 
-func AddBuildConfig(ctx context.Context, p *provenance.ProvenancePredicate, c *provenance.Capture, rp solver.ResultProxy, withUsage bool) (map[digest.Digest]int, error) {
+func AddBuildConfig(ctx context.Context, p *provenancetypes.ProvenancePredicate, c *provenance.Capture, rp solver.ResultProxy, withUsage bool) (map[digest.Digest]int, error) {
 	def := rp.Definition()
 	steps, indexes, err := toBuildSteps(def, c, withUsage)
 	if err != nil {
 		return nil, err
 	}
 
-	bc := &provenance.BuildConfig{
+	bc := &provenancetypes.BuildConfig{
 		Definition:    steps,
 		DigestMapping: digestMap(indexes),
 	}
@@ -561,13 +562,13 @@ func AddBuildConfig(ctx context.Context, p *provenance.ProvenancePredicate, c *p
 	p.BuildConfig = bc
 
 	if def.Source != nil {
-		sis := make([]provenance.SourceInfo, len(def.Source.Infos))
+		sis := make([]provenancetypes.SourceInfo, len(def.Source.Infos))
 		for i, si := range def.Source.Infos {
 			steps, indexes, err := toBuildSteps(si.Definition, c, withUsage)
 			if err != nil {
 				return nil, err
 			}
-			s := provenance.SourceInfo{
+			s := provenancetypes.SourceInfo{
 				Filename:      si.Filename,
 				Data:          si.Data,
 				Language:      si.Language,
@@ -588,9 +589,9 @@ func AddBuildConfig(ctx context.Context, p *provenance.ProvenancePredicate, c *p
 			}
 
 			if p.Metadata == nil {
-				p.Metadata = &provenance.ProvenanceMetadata{}
+				p.Metadata = &provenancetypes.ProvenanceMetadata{}
 			}
-			p.Metadata.BuildKitMetadata.Source = &provenance.Source{
+			p.Metadata.BuildKitMetadata.Source = &provenancetypes.Source{
 				Infos:     sis,
 				Locations: locs,
 			}
@@ -608,7 +609,7 @@ func digestMap(idx map[digest.Digest]int) map[digest.Digest]string {
 	return m
 }
 
-func toBuildSteps(def *pb.Definition, c *provenance.Capture, withUsage bool) ([]provenance.BuildStep, map[digest.Digest]int, error) {
+func toBuildSteps(def *pb.Definition, c *provenance.Capture, withUsage bool) ([]provenancetypes.BuildStep, map[digest.Digest]int, error) {
 	if def == nil || len(def.Def) == 0 {
 		return nil, nil, nil
 	}
@@ -660,7 +661,7 @@ func toBuildSteps(def *pb.Definition, c *provenance.Capture, withUsage bool) ([]
 		indexes[dgst] = i
 	}
 
-	out := make([]provenance.BuildStep, 0, len(dgsts))
+	out := make([]provenancetypes.BuildStep, 0, len(dgsts))
 	for i, dgst := range dgsts {
 		op := *ops[dgst]
 		inputs := make([]string, len(op.Inputs))
@@ -668,7 +669,7 @@ func toBuildSteps(def *pb.Definition, c *provenance.Capture, withUsage bool) ([]
 			inputs[i] = fmt.Sprintf("step%d:%d", indexes[inp.Digest], inp.Index)
 		}
 		op.Inputs = nil
-		s := provenance.BuildStep{
+		s := provenancetypes.BuildStep{
 			ID:     fmt.Sprintf("step%d", i),
 			Inputs: inputs,
 			Op:     op,
diff --git a/solver/llbsolver/provenance/buildconfig.go b/solver/llbsolver/provenance/buildconfig.go
deleted file mode 100644
index 362273029832..000000000000
--- a/solver/llbsolver/provenance/buildconfig.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package provenance
-
-import (
-	resourcestypes "github.com/moby/buildkit/executor/resources/types"
-	"github.com/moby/buildkit/solver/pb"
-	digest "github.com/opencontainers/go-digest"
-)
-
-type BuildConfig struct {
-	Definition    []BuildStep              `json:"llbDefinition,omitempty"`
-	DigestMapping map[digest.Digest]string `json:"digestMapping,omitempty"`
-}
-
-type BuildStep struct {
-	ID            string                  `json:"id,omitempty"`
-	Op            pb.Op                   `json:"op,omitempty"`
-	Inputs        []string                `json:"inputs,omitempty"`
-	ResourceUsage *resourcestypes.Samples `json:"resourceUsage,omitempty"`
-}
-
-type Source struct {
-	Locations map[string]*pb.Locations `json:"locations,omitempty"`
-	Infos     []SourceInfo             `json:"infos,omitempty"`
-}
-
-type SourceInfo struct {
-	Filename      string                   `json:"filename,omitempty"`
-	Language      string                   `json:"language,omitempty"`
-	Data          []byte                   `json:"data,omitempty"`
-	Definition    []BuildStep              `json:"llbDefinition,omitempty"`
-	DigestMapping map[digest.Digest]string `json:"digestMapping,omitempty"`
-}
diff --git a/solver/llbsolver/provenance/capture.go b/solver/llbsolver/provenance/capture.go
index 54645eb61a9d..760d948913d5 100644
--- a/solver/llbsolver/provenance/capture.go
+++ b/solver/llbsolver/provenance/capture.go
@@ -5,58 +5,20 @@ import (
 
 	distreference "github.com/distribution/reference"
 	resourcestypes "github.com/moby/buildkit/executor/resources/types"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/solver/result"
 	"github.com/moby/buildkit/util/urlutil"
 	digest "github.com/opencontainers/go-digest"
-	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 type Result = result.Result[*Capture]
 
-type ImageSource struct {
-	Ref      string
-	Platform *ocispecs.Platform
-	Digest   digest.Digest
-	Local    bool
-}
-
-type GitSource struct {
-	URL    string
-	Commit string
-}
-
-type HTTPSource struct {
-	URL    string
-	Digest digest.Digest
-}
-
-type LocalSource struct {
-	Name string `json:"name"`
-}
-
-type Secret struct {
-	ID       string `json:"id"`
-	Optional bool   `json:"optional,omitempty"`
-}
-
-type SSH struct {
-	ID       string `json:"id"`
-	Optional bool   `json:"optional,omitempty"`
-}
-
-type Sources struct {
-	Images []ImageSource
-	Git    []GitSource
-	HTTP   []HTTPSource
-	Local  []LocalSource
-}
-
 type Capture struct {
 	Frontend            string
 	Args                map[string]string
-	Sources             Sources
-	Secrets             []Secret
-	SSH                 []SSH
+	Sources             provenancetypes.Sources
+	Secrets             []provenancetypes.Secret
+	SSH                 []provenancetypes.SSH
 	NetworkAccess       bool
 	IncompleteMaterials bool
 	Samples             map[digest.Digest]*resourcestypes.Samples
@@ -128,7 +90,7 @@ func (c *Capture) OptimizeImageSources() error {
 		}
 	}
 
-	images := make([]ImageSource, 0, len(c.Sources.Images))
+	images := make([]provenancetypes.ImageSource, 0, len(c.Sources.Images))
 	for _, i := range c.Sources.Images {
 		ref, nameTag, err := parseRefName(i.Ref)
 		if err != nil {
@@ -145,7 +107,7 @@ func (c *Capture) OptimizeImageSources() error {
 	return nil
 }
 
-func (c *Capture) AddImage(i ImageSource) {
+func (c *Capture) AddImage(i provenancetypes.ImageSource) {
 	for _, v := range c.Sources.Images {
 		if v.Ref == i.Ref && v.Local == i.Local {
 			if v.Platform == i.Platform {
@@ -163,7 +125,7 @@ func (c *Capture) AddImage(i ImageSource) {
 	c.Sources.Images = append(c.Sources.Images, i)
 }
 
-func (c *Capture) AddLocal(l LocalSource) {
+func (c *Capture) AddLocal(l provenancetypes.LocalSource) {
 	for _, v := range c.Sources.Local {
 		if v.Name == l.Name {
 			return
@@ -172,7 +134,7 @@ func (c *Capture) AddLocal(l LocalSource) {
 	c.Sources.Local = append(c.Sources.Local, l)
 }
 
-func (c *Capture) AddGit(g GitSource) {
+func (c *Capture) AddGit(g provenancetypes.GitSource) {
 	g.URL = urlutil.RedactCredentials(g.URL)
 	for _, v := range c.Sources.Git {
 		if v.URL == g.URL {
@@ -182,7 +144,7 @@ func (c *Capture) AddGit(g GitSource) {
 	c.Sources.Git = append(c.Sources.Git, g)
 }
 
-func (c *Capture) AddHTTP(h HTTPSource) {
+func (c *Capture) AddHTTP(h provenancetypes.HTTPSource) {
 	h.URL = urlutil.RedactCredentials(h.URL)
 	for _, v := range c.Sources.HTTP {
 		if v.URL == h.URL {
@@ -192,7 +154,7 @@ func (c *Capture) AddHTTP(h HTTPSource) {
 	c.Sources.HTTP = append(c.Sources.HTTP, h)
 }
 
-func (c *Capture) AddSecret(s Secret) {
+func (c *Capture) AddSecret(s provenancetypes.Secret) {
 	for i, v := range c.Secrets {
 		if v.ID == s.ID {
 			if !s.Optional {
@@ -204,7 +166,7 @@ func (c *Capture) AddSecret(s Secret) {
 	c.Secrets = append(c.Secrets, s)
 }
 
-func (c *Capture) AddSSH(s SSH) {
+func (c *Capture) AddSSH(s provenancetypes.SSH) {
 	if s.ID == "" {
 		s.ID = "default"
 	}
diff --git a/solver/llbsolver/provenance/predicate.go b/solver/llbsolver/provenance/predicate.go
index f07ce879d7d6..bdc15ee619a9 100644
--- a/solver/llbsolver/provenance/predicate.go
+++ b/solver/llbsolver/provenance/predicate.go
@@ -6,58 +6,13 @@ import (
 	"github.com/containerd/containerd/platforms"
 	slsa "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/common"
 	slsa02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
-	resourcetypes "github.com/moby/buildkit/executor/resources/types"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/util/purl"
 	"github.com/moby/buildkit/util/urlutil"
-	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/package-url/packageurl-go"
 )
 
-const (
-	BuildKitBuildType = "https://mobyproject.org/buildkit@v1"
-)
-
-type ProvenancePredicate struct {
-	slsa02.ProvenancePredicate
-	Invocation  ProvenanceInvocation `json:"invocation,omitempty"`
-	BuildConfig *BuildConfig         `json:"buildConfig,omitempty"`
-	Metadata    *ProvenanceMetadata  `json:"metadata,omitempty"`
-}
-
-type ProvenanceInvocation struct {
-	ConfigSource slsa02.ConfigSource `json:"configSource,omitempty"`
-	Parameters   Parameters          `json:"parameters,omitempty"`
-	Environment  Environment         `json:"environment,omitempty"`
-}
-
-type Parameters struct {
-	Frontend string            `json:"frontend,omitempty"`
-	Args     map[string]string `json:"args,omitempty"`
-	Secrets  []*Secret         `json:"secrets,omitempty"`
-	SSH      []*SSH            `json:"ssh,omitempty"`
-	Locals   []*LocalSource    `json:"locals,omitempty"`
-	// TODO: select export attributes
-	// TODO: frontend inputs
-}
-
-type Environment struct {
-	Platform string `json:"platform"`
-}
-
-type ProvenanceMetadata struct {
-	slsa02.ProvenanceMetadata
-	BuildKitMetadata BuildKitMetadata `json:"https://mobyproject.org/buildkit@v1#metadata,omitempty"`
-	Hermetic         bool             `json:"https://mobyproject.org/buildkit@v1#hermetic,omitempty"`
-}
-
-type BuildKitMetadata struct {
-	VCS      map[string]string                  `json:"vcs,omitempty"`
-	Source   *Source                            `json:"source,omitempty"`
-	Layers   map[string][][]ocispecs.Descriptor `json:"layers,omitempty"`
-	SysUsage []*resourcetypes.SysSample         `json:"sysUsage,omitempty"`
-}
-
-func slsaMaterials(srcs Sources) ([]slsa.ProvenanceMaterial, error) {
+func slsaMaterials(srcs provenancetypes.Sources) ([]slsa.ProvenanceMaterial, error) {
 	count := len(srcs.Images) + len(srcs.Git) + len(srcs.HTTP)
 	out := make([]slsa.ProvenanceMaterial, 0, count)
 
@@ -104,7 +59,7 @@ func slsaMaterials(srcs Sources) ([]slsa.ProvenanceMaterial, error) {
 	return out, nil
 }
 
-func findMaterial(srcs Sources, uri string) (*slsa.ProvenanceMaterial, bool) {
+func findMaterial(srcs provenancetypes.Sources, uri string) (*slsa.ProvenanceMaterial, bool) {
 	for _, s := range srcs.Git {
 		if s.URL == uri {
 			return &slsa.ProvenanceMaterial{
@@ -128,12 +83,12 @@ func findMaterial(srcs Sources, uri string) (*slsa.ProvenanceMaterial, bool) {
 	return nil, false
 }
 
-func NewPredicate(c *Capture) (*ProvenancePredicate, error) {
+func NewPredicate(c *Capture) (*provenancetypes.ProvenancePredicate, error) {
 	materials, err := slsaMaterials(c.Sources)
 	if err != nil {
 		return nil, err
 	}
-	inv := ProvenanceInvocation{}
+	inv := provenancetypes.ProvenanceInvocation{}
 
 	contextKey := "context"
 	if v, ok := c.Args["contextkey"]; ok && v != "" {
@@ -175,19 +130,19 @@ func NewPredicate(c *Capture) (*ProvenancePredicate, error) {
 	inv.Parameters.Args = c.Args
 
 	for _, s := range c.Secrets {
-		inv.Parameters.Secrets = append(inv.Parameters.Secrets, &Secret{
+		inv.Parameters.Secrets = append(inv.Parameters.Secrets, &provenancetypes.Secret{
 			ID:       s.ID,
 			Optional: s.Optional,
 		})
 	}
 	for _, s := range c.SSH {
-		inv.Parameters.SSH = append(inv.Parameters.SSH, &SSH{
+		inv.Parameters.SSH = append(inv.Parameters.SSH, &provenancetypes.SSH{
 			ID:       s.ID,
 			Optional: s.Optional,
 		})
 	}
 	for _, s := range c.Sources.Local {
-		inv.Parameters.Locals = append(inv.Parameters.Locals, &LocalSource{
+		inv.Parameters.Locals = append(inv.Parameters.Locals, &provenancetypes.LocalSource{
 			Name: s.Name,
 		})
 	}
@@ -199,13 +154,13 @@ func NewPredicate(c *Capture) (*ProvenancePredicate, error) {
 		}
 	}
 
-	pr := &ProvenancePredicate{
+	pr := &provenancetypes.ProvenancePredicate{
 		Invocation: inv,
 		ProvenancePredicate: slsa02.ProvenancePredicate{
-			BuildType: BuildKitBuildType,
+			BuildType: provenancetypes.BuildKitBuildType,
 			Materials: materials,
 		},
-		Metadata: &ProvenanceMetadata{
+		Metadata: &provenancetypes.ProvenanceMetadata{
 			ProvenanceMetadata: slsa02.ProvenanceMetadata{
 				Completeness: slsa02.ProvenanceComplete{
 					Parameters:  c.Frontend != "",
diff --git a/solver/llbsolver/provenance/types/types.go b/solver/llbsolver/provenance/types/types.go
new file mode 100644
index 000000000000..65a5598afbab
--- /dev/null
+++ b/solver/llbsolver/provenance/types/types.go
@@ -0,0 +1,116 @@
+package types
+
+import (
+	slsa02 "github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v0.2"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
+	"github.com/moby/buildkit/solver/pb"
+	digest "github.com/opencontainers/go-digest"
+	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
+)
+
+const (
+	BuildKitBuildType = "https://mobyproject.org/buildkit@v1"
+)
+
+type BuildConfig struct {
+	Definition    []BuildStep              `json:"llbDefinition,omitempty"`
+	DigestMapping map[digest.Digest]string `json:"digestMapping,omitempty"`
+}
+
+type BuildStep struct {
+	ID            string                  `json:"id,omitempty"`
+	Op            pb.Op                   `json:"op,omitempty"`
+	Inputs        []string                `json:"inputs,omitempty"`
+	ResourceUsage *resourcestypes.Samples `json:"resourceUsage,omitempty"`
+}
+
+type Source struct {
+	Locations map[string]*pb.Locations `json:"locations,omitempty"`
+	Infos     []SourceInfo             `json:"infos,omitempty"`
+}
+
+type SourceInfo struct {
+	Filename      string                   `json:"filename,omitempty"`
+	Language      string                   `json:"language,omitempty"`
+	Data          []byte                   `json:"data,omitempty"`
+	Definition    []BuildStep              `json:"llbDefinition,omitempty"`
+	DigestMapping map[digest.Digest]string `json:"digestMapping,omitempty"`
+}
+
+type ImageSource struct {
+	Ref      string
+	Platform *ocispecs.Platform
+	Digest   digest.Digest
+	Local    bool
+}
+
+type GitSource struct {
+	URL    string
+	Commit string
+}
+
+type HTTPSource struct {
+	URL    string
+	Digest digest.Digest
+}
+
+type LocalSource struct {
+	Name string `json:"name"`
+}
+
+type Secret struct {
+	ID       string `json:"id"`
+	Optional bool   `json:"optional,omitempty"`
+}
+
+type SSH struct {
+	ID       string `json:"id"`
+	Optional bool   `json:"optional,omitempty"`
+}
+
+type Sources struct {
+	Images []ImageSource
+	Git    []GitSource
+	HTTP   []HTTPSource
+	Local  []LocalSource
+}
+
+type ProvenancePredicate struct {
+	slsa02.ProvenancePredicate
+	Invocation  ProvenanceInvocation `json:"invocation,omitempty"`
+	BuildConfig *BuildConfig         `json:"buildConfig,omitempty"`
+	Metadata    *ProvenanceMetadata  `json:"metadata,omitempty"`
+}
+
+type ProvenanceInvocation struct {
+	ConfigSource slsa02.ConfigSource `json:"configSource,omitempty"`
+	Parameters   Parameters          `json:"parameters,omitempty"`
+	Environment  Environment         `json:"environment,omitempty"`
+}
+
+type Parameters struct {
+	Frontend string            `json:"frontend,omitempty"`
+	Args     map[string]string `json:"args,omitempty"`
+	Secrets  []*Secret         `json:"secrets,omitempty"`
+	SSH      []*SSH            `json:"ssh,omitempty"`
+	Locals   []*LocalSource    `json:"locals,omitempty"`
+	// TODO: select export attributes
+	// TODO: frontend inputs
+}
+
+type Environment struct {
+	Platform string `json:"platform"`
+}
+
+type ProvenanceMetadata struct {
+	slsa02.ProvenanceMetadata
+	BuildKitMetadata BuildKitMetadata `json:"https://mobyproject.org/buildkit@v1#metadata,omitempty"`
+	Hermetic         bool             `json:"https://mobyproject.org/buildkit@v1#hermetic,omitempty"`
+}
+
+type BuildKitMetadata struct {
+	VCS      map[string]string                  `json:"vcs,omitempty"`
+	Source   *Source                            `json:"source,omitempty"`
+	Layers   map[string][][]ocispecs.Descriptor `json:"layers,omitempty"`
+	SysUsage []*resourcestypes.SysSample        `json:"sysUsage,omitempty"`
+}
diff --git a/solver/llbsolver/solver.go b/solver/llbsolver/solver.go
index 7e33be3b4886..3e806387a68d 100644
--- a/solver/llbsolver/solver.go
+++ b/solver/llbsolver/solver.go
@@ -18,7 +18,7 @@ import (
 	"github.com/moby/buildkit/client"
 	controlgateway "github.com/moby/buildkit/control/gateway"
 	"github.com/moby/buildkit/executor/resources"
-	resourcetypes "github.com/moby/buildkit/executor/resources/types"
+	resourcestypes "github.com/moby/buildkit/executor/resources/types"
 	"github.com/moby/buildkit/exporter"
 	"github.com/moby/buildkit/exporter/containerimage/exptypes"
 	"github.com/moby/buildkit/frontend"
@@ -90,7 +90,7 @@ type Solver struct {
 	sm                        *session.Manager
 	entitlements              []string
 	history                   *HistoryQueue
-	sysSampler                *resources.Sampler[*resourcetypes.SysSample]
+	sysSampler                *resources.Sampler[*resourcestypes.SysSample]
 }
 
 // Processor defines a processing function to be applied after solving, but
@@ -441,7 +441,7 @@ func (s *Solver) Solve(ctx context.Context, id string, sessionID string, req fro
 
 	defer j.Discard()
 
-	var usage *resources.Sub[*resourcetypes.SysSample]
+	var usage *resources.Sub[*resourcestypes.SysSample]
 	if s.sysSampler != nil {
 		usage = s.sysSampler.Record()
 		defer usage.Close(false)
diff --git a/source/containerimage/identifier.go b/source/containerimage/identifier.go
index 08db503a38be..eb38d6093b2a 100644
--- a/source/containerimage/identifier.go
+++ b/source/containerimage/identifier.go
@@ -4,6 +4,7 @@ import (
 	"github.com/containerd/containerd/reference"
 	"github.com/moby/buildkit/client"
 	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/source"
 	srctypes "github.com/moby/buildkit/source/types"
 	"github.com/moby/buildkit/util/resolver"
@@ -43,7 +44,7 @@ func (id *ImageIdentifier) Capture(c *provenance.Capture, pin string) error {
 	if err != nil {
 		return errors.Wrapf(err, "failed to parse image digest %s", pin)
 	}
-	c.AddImage(provenance.ImageSource{
+	c.AddImage(provenancetypes.ImageSource{
 		Ref:      id.Reference.String(),
 		Platform: id.Platform,
 		Digest:   dgst,
@@ -82,7 +83,7 @@ func (id *OCIIdentifier) Capture(c *provenance.Capture, pin string) error {
 	if err != nil {
 		return errors.Wrapf(err, "failed to parse OCI digest %s", pin)
 	}
-	c.AddImage(provenance.ImageSource{
+	c.AddImage(provenancetypes.ImageSource{
 		Ref:      id.Reference.String(),
 		Platform: id.Platform,
 		Digest:   dgst,
diff --git a/source/git/identifier.go b/source/git/identifier.go
index 1726fb9a7acf..77951399b08a 100644
--- a/source/git/identifier.go
+++ b/source/git/identifier.go
@@ -4,6 +4,7 @@ import (
 	"path"
 
 	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/source"
 	srctypes "github.com/moby/buildkit/source/types"
 	"github.com/moby/buildkit/util/gitutil"
@@ -51,24 +52,24 @@ func (id *GitIdentifier) Capture(c *provenance.Capture, pin string) error {
 	if id.Ref != "" {
 		url += "#" + id.Ref
 	}
-	c.AddGit(provenance.GitSource{
+	c.AddGit(provenancetypes.GitSource{
 		URL:    url,
 		Commit: pin,
 	})
 	if id.AuthTokenSecret != "" {
-		c.AddSecret(provenance.Secret{
+		c.AddSecret(provenancetypes.Secret{
 			ID:       id.AuthTokenSecret,
 			Optional: true,
 		})
 	}
 	if id.AuthHeaderSecret != "" {
-		c.AddSecret(provenance.Secret{
+		c.AddSecret(provenancetypes.Secret{
 			ID:       id.AuthHeaderSecret,
 			Optional: true,
 		})
 	}
 	if id.MountSSHSock != "" {
-		c.AddSSH(provenance.SSH{
+		c.AddSSH(provenancetypes.SSH{
 			ID:       id.MountSSHSock,
 			Optional: true,
 		})
diff --git a/source/http/identifier.go b/source/http/identifier.go
index f560321047fa..7e79a1812c34 100644
--- a/source/http/identifier.go
+++ b/source/http/identifier.go
@@ -2,6 +2,7 @@ package http
 
 import (
 	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/source"
 	srctypes "github.com/moby/buildkit/source/types"
 	digest "github.com/opencontainers/go-digest"
@@ -40,7 +41,7 @@ func (id *HTTPIdentifier) Capture(c *provenance.Capture, pin string) error {
 	if err != nil {
 		return errors.Wrapf(err, "failed to parse HTTP digest %s", pin)
 	}
-	c.AddHTTP(provenance.HTTPSource{
+	c.AddHTTP(provenancetypes.HTTPSource{
 		URL:    id.URL,
 		Digest: dgst,
 	})
diff --git a/source/local/identifier.go b/source/local/identifier.go
index 703d66890fc3..5bc63206bc26 100644
--- a/source/local/identifier.go
+++ b/source/local/identifier.go
@@ -2,6 +2,7 @@ package local
 
 import (
 	"github.com/moby/buildkit/solver/llbsolver/provenance"
+	provenancetypes "github.com/moby/buildkit/solver/llbsolver/provenance/types"
 	"github.com/moby/buildkit/source"
 	srctypes "github.com/moby/buildkit/source/types"
 	"github.com/tonistiigi/fsutil"
@@ -28,7 +29,7 @@ func (*LocalIdentifier) Scheme() string {
 var _ source.Identifier = (*LocalIdentifier)(nil)
 
 func (id *LocalIdentifier) Capture(c *provenance.Capture, pin string) error {
-	c.AddLocal(provenance.LocalSource{
+	c.AddLocal(provenancetypes.LocalSource{
 		Name: id.Name,
 	})
 	return nil