diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml
index e99b5ca8b..66a08ca45 100644
--- a/.github/workflows/.test.yml
+++ b/.github/workflows/.test.yml
@@ -91,6 +91,7 @@ jobs:
         name: Build
         uses: docker/bake-action@v4
         with:
+          provenance: false
           targets: integration-tests-base
           set: |
             *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
@@ -98,6 +99,7 @@ jobs:
 
   run:
     runs-on: ubuntu-22.04
+    continue-on-error: true
     needs:
       - prepare
     env:
@@ -147,6 +149,7 @@ jobs:
         name: Build test image
         uses: docker/bake-action@v4
         with:
+          provenance: false
           targets: integration-tests
           set: |
             *.cache-from=type=gha,scope=${{ inputs.cache_scope }}
@@ -164,11 +167,12 @@ jobs:
           if [ -n "${{ matrix.worker }}" ]; then
             export TESTFLAGS="${TESTFLAGS} --run=//worker=${{ matrix.worker }}$"
           fi
+          echo TESTFLAGS=$TESTFLAGS
           ./hack/test ${{ matrix.kind }}
         env:
           TEST_COVERAGE: 1
           TESTPKGS: ${{ matrix.pkg }}
-          SKIP_INTEGRATION_TESTS: ${{ matrix.skip-integration-tests }}
+          SKIP_INTEGRATION_TESTS: 1
           CACHE_FROM: type=gha,scope=${{ inputs.cache_scope }}
       -
         name: Send to Codecov
@@ -186,10 +190,11 @@ jobs:
       -
         name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: test-reports
           path: ./bin/testreports
+          overwrite: true
       -
         name: Dump context
         if: failure()
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index 3984b98d6..c5121a5a2 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -129,7 +129,7 @@ jobs:
           CACHE_TO: type=gha,scope=binaries-${{ env.PLATFORM_PAIR }}
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: buildkit
           path: ${{ env.DESTDIR }}/*
diff --git a/.github/workflows/dockerd.yml b/.github/workflows/dockerd.yml
index 4234b2254..ed913f269 100644
--- a/.github/workflows/dockerd.yml
+++ b/.github/workflows/dockerd.yml
@@ -63,7 +63,7 @@ jobs:
           wget -qO- "https://download.docker.com/linux/static/stable/x86_64/docker-${{ env.DOCKER_VERSION }}.tgz" | tar xvz --strip 1
       -
         name: Upload dockerd
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: dockerd
           path: /tmp/moby/dockerd
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index b6d192b08..6ed4ebcdb 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -33,8 +33,10 @@ jobs:
       pkgs: ./frontend/dockerfile
       kinds: |
         integration
-        dockerfile
       codecov_flags: dockerfile-frontend
+      includes: |
+        - pkg: ./...
+          skip-integration-tests: 1
 
   prepare:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/test-os.yml b/.github/workflows/test-os.yml
index 1df513ac5..4dae49b6a 100644
--- a/.github/workflows/test-os.yml
+++ b/.github/workflows/test-os.yml
@@ -81,7 +81,7 @@ jobs:
       -
         name: Upload test reports
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: test-reports
           path: ./bin/testreports
@@ -108,7 +108,7 @@ jobs:
             *.platform=freebsd/amd64
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: buildkit-freebsd-amd64
           path: ${{ env.DESTDIR }}/*
diff --git a/Earthfile b/Earthfile
index a459e6617..23fba1839 100644
--- a/Earthfile
+++ b/Earthfile
@@ -4,6 +4,7 @@ VERSION 0.6
 FROM alpine:3.13
 WORKDIR /buildkit
 
+# build buildkit image
 build:
     ARG RELEASE_VERSION=v0.0.0+earthlyunknown
     FROM DOCKERFILE --build-arg RELEASE_VERSION=$RELEASE_VERSION --target buildkit-linux .
diff --git a/api/services/registry/registry.proto b/api/services/registry/registry.proto
index f25f2a038..f9db96f59 100644
--- a/api/services/registry/registry.proto
+++ b/api/services/registry/registry.proto
@@ -3,9 +3,9 @@ syntax = "proto3";
 package earthly.registry.v1;
 
 message ByteMessage {
-  bytes data = 1;
+	bytes data = 1;
 }
 
 service Registry {
-  rpc Proxy(stream ByteMessage) returns (stream ByteMessage);
+	rpc Proxy(stream ByteMessage) returns (stream ByteMessage);
 }
diff --git a/api/services/registry/server.go b/api/services/registry/server.go
index eafc0abf7..0d7c8c118 100644
--- a/api/services/registry/server.go
+++ b/api/services/registry/server.go
@@ -81,10 +81,13 @@ func (s *Server) Proxy(stream Registry_ProxyServer) error {
 	addr := strings.ReplaceAll(s.addr, "0.0.0.0", "127.0.0.1")
 
 	conn, err := net.Dial("tcp", addr)
+	if err != nil {
+		return err
+	}
 	defer conn.Close()
 
 	ctx := stream.Context()
-	eg, ctx := errgroup.WithContext(ctx)
+	eg, _ := errgroup.WithContext(ctx)
 
 	eg.Go(func() error {
 		_, err = io.Copy(conn, rw)
diff --git a/client/info.go b/client/info.go
index 362b95cf2..7e5d57426 100644
--- a/client/info.go
+++ b/client/info.go
@@ -13,8 +13,8 @@ type Info struct {
 	BuildkitVersion BuildkitVersion `json:"buildkitVersion"`
 
 	// Earthly-specific.
-	NumSessions int	`json:"numSessions"`
-	SecondsIdle int	`json:"secondsIdle"`
+	NumSessions int `json:"numSessions"`
+	SecondsIdle int `json:"secondsIdle"`
 }
 
 type BuildkitVersion struct {
diff --git a/client/llb/source.go b/client/llb/source.go
index c7fc10c60..343a5a2c0 100644
--- a/client/llb/source.go
+++ b/client/llb/source.go
@@ -314,7 +314,7 @@ func Git(url, ref string, opts ...GitOption) State {
 				attrs[pb.AttrKnownSSHHosts] = keyscan
 			} else {
 				// earthly-specific: panic in order to raise errors (should be caught by earthly cli)
-				panic(fmt.Sprintf("Git(%s,%s) failed to scan ssh keys: %v", remote, ref, err))
+				panic(fmt.Sprintf("Git(%s,%s) failed to scan ssh keys: %v", url, ref, err))
 			}
 			attrs[pb.AttrKnownSSHHosts] = keyscan
 		}
@@ -404,7 +404,7 @@ func MountSSHSock(sshID string) GitOption {
 }
 
 func SSHCommand(sshCommand string) GitOption {
-	return gitOptionFunc(func (gi *GitInfo) {
+	return gitOptionFunc(func(gi *GitInfo) {
 		gi.SSHCommand = sshCommand
 	})
 }
diff --git a/cmd/buildkitd/main.go b/cmd/buildkitd/main.go
index fd316b9fc..941fffbe2 100644
--- a/cmd/buildkitd/main.go
+++ b/cmd/buildkitd/main.go
@@ -338,7 +338,7 @@ func main() {
 		lrPort, ok := os.LookupEnv("BUILDKIT_LOCAL_REGISTRY_LISTEN_PORT")
 		lrAddr := fmt.Sprintf("0.0.0.0:%s", lrPort)
 		if ok {
-			logrus.Infof("Starting local registry for outputs on port %s", lrPort)
+			bklog.G(ctx).Infof("Starting local registry for outputs on port %s", lrPort)
 			serveErr := registry.Serve(ctxReg, lrAddr)
 			go func() {
 				for {
@@ -347,7 +347,7 @@ func main() {
 						cancelReg()
 					case err := <-serveErr:
 						if err != nil {
-							logrus.Errorf("Registry serve error: %s\n", err.Error())
+							bklog.G(ctx).Errorf("Registry serve error: %s\n", err.Error())
 						}
 						return
 					case <-ctxReg.Done():
diff --git a/cmd/buildkitd/timeout_interceptor.go b/cmd/buildkitd/timeout_interceptor.go
index e15da3e34..3345c1002 100644
--- a/cmd/buildkitd/timeout_interceptor.go
+++ b/cmd/buildkitd/timeout_interceptor.go
@@ -64,7 +64,7 @@ func streamTimeoutInterceptor() grpc.StreamServerInterceptor {
 			defer close(done)
 			go handleTimeout(done, cancel)
 			// End of TODO
-			err := handler(srv, newWrappedStream(stream, ctx))
+			err := handler(srv, newWrappedStream(ctx, stream))
 			if errors.Is(err, context.Canceled) && context.Cause(ctx) == errSessionTimeout {
 				return errors.Errorf("build exceeded max duration of %s", sessionTimeout.String())
 			}
@@ -114,6 +114,6 @@ func (w *wrappedStream) SetTrailer(m metadata.MD) {
 	w.s.SetTrailer(m)
 }
 
-func newWrappedStream(s grpc.ServerStream, ctx context.Context) grpc.ServerStream {
+func newWrappedStream(ctx context.Context, s grpc.ServerStream) grpc.ServerStream {
 	return &wrappedStream{s: s, ctx: ctx}
 }
diff --git a/executor/oci/hooks.go b/executor/oci/hooks.go
index 946b6ec76..334d8fc2d 100644
--- a/executor/oci/hooks.go
+++ b/executor/oci/hooks.go
@@ -2,11 +2,11 @@ package oci
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
 )
 
 type OciHook struct {
@@ -45,7 +45,7 @@ func WithHook(hook OciHook) oci.SpecOpts {
 		case "poststop":
 			s.Hooks.Poststop = append(s.Hooks.Poststop, h)
 		default:
-			return fmt.Errorf("%s is not a valid lifecycle hook", hook.Phase)
+			return errors.Errorf("%s is not a valid lifecycle hook", hook.Phase)
 		}
 
 		return nil
diff --git a/exporter/earthlyoutputs/export.go b/exporter/earthlyoutputs/export.go
index 06c74cb8a..3e9e233ed 100644
--- a/exporter/earthlyoutputs/export.go
+++ b/exporter/earthlyoutputs/export.go
@@ -457,7 +457,7 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 			md[safeGrpcMetaKey(mdK)] = string(mdV)
 		}
 		if expSrc.Ref == nil {
-			return nil, nil, fmt.Errorf("dirExpSrcs got nil ref")
+			return nil, nil, errors.New("dirExpSrcs got nil ref")
 		}
 		dirEG.Go(exportDirFunc(egCtx, md, caller, expSrc.Ref, sessionID))
 	}
@@ -508,7 +508,7 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 		}
 		if img.expSrc.Ref != nil { // This is a copy and paste of the above code
 			if len(img.platforms) != 0 {
-				return nil, nil, fmt.Errorf("img.platforms should not be set when a single ref is used")
+				return nil, nil, errors.New("img.platforms should not be set when a single ref is used")
 			}
 
 			var ref cache.ImmutableRef
@@ -518,7 +518,7 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 				if r, ok := img.expSrc.FindRef(p.ID); ok {
 					ref = r
 				} else {
-					return nil, nil, fmt.Errorf("img.expSrc.FindRef failed on %s", p.ID)
+					return nil, nil, errors.Errorf("img.expSrc.FindRef failed on %s", p.ID)
 				}
 			} else {
 				ref = img.expSrc.Ref
@@ -559,7 +559,7 @@ func (e *imageExporterInstance) Export(ctx context.Context, src *exporter.Source
 				var errStatus remoteserrors.ErrUnexpectedStatus
 				if errors.As(err, &errStatus) {
 					// TODO body might be json, e.g. `{"errors":[{"code":"DENIED","message":"The repository with name 'my-cool-image' in registry with id '123456789' already has the maximum allowed number of images which is '10000'"}]}`, we should attempt to parse this
-					return nil, nil, fmt.Errorf("failed to push %s: %w body=%s", imgName, errStatus, errStatus.Body)
+					return nil, nil, errors.Wrapf(err, "failed to push %s: body=%s", imgName, errStatus.Body)
 				}
 				return nil, nil, err
 			}
diff --git a/exporter/earthlyoutputs/registry/eodriver/eodriver.go b/exporter/earthlyoutputs/registry/eodriver/eodriver.go
index ee1256876..7928290ca 100644
--- a/exporter/earthlyoutputs/registry/eodriver/eodriver.go
+++ b/exporter/earthlyoutputs/registry/eodriver/eodriver.go
@@ -79,7 +79,7 @@ func fromParametersImpl(parameters map[string]interface{}) (*DriverParameters, e
 	if parameters != nil {
 		maxThreads, err = base.GetLimitFromParameter(parameters["maxthreads"], minThreads, defaultMaxThreads)
 		if err != nil {
-			return nil, fmt.Errorf("maxthreads config error: %s", err.Error())
+			return nil, errors.Errorf("maxthreads config error: %s", err.Error())
 		}
 	}
 
diff --git a/exporter/earthlyoutputs/registry/eodriver/multimultiprovider.go b/exporter/earthlyoutputs/registry/eodriver/multimultiprovider.go
index f0b3c668c..45f36b3ec 100644
--- a/exporter/earthlyoutputs/registry/eodriver/multimultiprovider.go
+++ b/exporter/earthlyoutputs/registry/eodriver/multimultiprovider.go
@@ -3,7 +3,6 @@ package eodriver
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"sync"
 
 	"github.com/containerd/containerd/content"
@@ -90,7 +89,7 @@ func (mmp *MultiMultiProvider) AddImgSub(imgName string, dgst digest.Digest, p c
 // AddImg adds a new child image. The image is removed from the collection when the context is canceled.
 func (mmp *MultiMultiProvider) AddImg(ctx context.Context, imgName string, base content.Provider, baseDigest digest.Digest) error {
 	if baseDigest == "" {
-		return fmt.Errorf("baseDigest cant be empty")
+		return errors.Errorf("baseDigest cant be empty")
 	}
 
 	// The config digest needs to be mapped manually - read out the manifest
@@ -110,12 +109,12 @@ func (mmp *MultiMultiProvider) AddImg(ctx context.Context, imgName string, base
 		return err
 	}
 	if mfst.Config.Digest == "" {
-		return fmt.Errorf("manifest config digest is missing")
+		return errors.Errorf("manifest config digest is missing")
 	}
 
 	configDgst := digest.Digest(mfst.Config.Digest)
 	if configDgst == "" {
-		return fmt.Errorf("configDgst cant be empty")
+		return errors.Errorf("configDgst cant be empty")
 	}
 
 	mmp.mu.Lock()
diff --git a/exporter/earthlyoutputs/registry/registry.go b/exporter/earthlyoutputs/registry/registry.go
index d6bab94a6..db1f7b578 100644
--- a/exporter/earthlyoutputs/registry/registry.go
+++ b/exporter/earthlyoutputs/registry/registry.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"strings"
+	"time"
 
 	"github.com/docker/distribution/configuration"
 	"github.com/docker/distribution/registry/handlers"
@@ -31,7 +32,8 @@ storage:
 	}
 	app := handlers.NewApp(ctx, config)
 	server := &http.Server{
-		Handler: app,
+		Handler:           app,
+		ReadHeaderTimeout: 30 * time.Second,
 	}
 	ctx2, cancel := context.WithCancel(ctx)
 	go func() {
diff --git a/frontend/gateway/forwarder/forward.go b/frontend/gateway/forwarder/forward.go
index ec73554ed..1ca5af9c2 100644
--- a/frontend/gateway/forwarder/forward.go
+++ b/frontend/gateway/forwarder/forward.go
@@ -2,7 +2,6 @@ package forwarder
 
 import (
 	"context"
-	"fmt"
 	"sync"
 
 	cacheutil "github.com/moby/buildkit/cache/util"
@@ -95,7 +94,7 @@ func (c *BridgeClient) Solve(ctx context.Context, req client.SolveRequest) (*cli
 
 // Export is only used by earthly via the grpcclient implementation
 func (c *BridgeClient) Export(ctx context.Context, req client.ExportRequest) error {
-	return fmt.Errorf("forwarder.bridgeClient does not support Export")
+	return errors.Errorf("forwarder.bridgeClient does not support Export")
 }
 
 func (c *BridgeClient) loadBuildOpts() client.BuildOpts {
diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile
index 577bd2b17..44a5dec7e 100644
--- a/hack/dockerfiles/lint.Dockerfile
+++ b/hack/dockerfiles/lint.Dockerfile
@@ -15,19 +15,19 @@ RUN wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/master
 COPY --link --from=protolint-base /usr/local/bin/protolint /usr/local/bin/protolint
 WORKDIR /go/src/github.com/moby/buildkit
 
-FROM base as golangci-lint
+FROM base AS golangci-lint
 ARG BUILDTAGS
 RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache,sharing=locked \
   GOARCH=amd64 golangci-lint run --build-tags "${BUILDTAGS}" && \
   GOARCH=arm64 golangci-lint run --build-tags "${BUILDTAGS}" && \
   touch /golangci-lint.done
 
-FROM base as yamllint
+FROM base AS yamllint
 RUN --mount=target=/go/src/github.com/moby/buildkit --mount=target=/root/.cache,type=cache \
   yamllint -c .yamllint.yml --strict . && \
   touch /yamllint.done
 
-FROM base as protolint
+FROM base AS protolint
 RUN --mount=target=/go/src/github.com/moby/buildkit \
   protolint lint . && \
   touch /protolint.done
diff --git a/hack/images b/hack/images
index a323e77e1..ed6ca995b 100755
--- a/hack/images
+++ b/hack/images
@@ -98,5 +98,5 @@ if [[ "$RELEASE" = "true" ]] && [[ "$GITHUB_ACTIONS" = "true" ]]; then
   nocacheFilterFlag="--no-cache-filter=git,buildkit-export,gobuild-base"
 fi
 
-buildxCmd build --build-arg BUILDKIT_DEBUG $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag $nocacheFilterFlag $attestFlags \
+buildxCmd build --build-arg BUILDKIT_DEBUG $platformFlag $targetFlag $importCacheFlags $exportCacheFlags $tagFlags $outputFlag $nocacheFilterFlag \
   $currentcontext
diff --git a/hack/release b/hack/release
index 20416b789..0e1fe8444 100755
--- a/hack/release
+++ b/hack/release
@@ -27,12 +27,12 @@ if [ -n "$PLATFORMS" ]; then
   setFlags+=(--set "*.platform=$PLATFORMS")
 fi
 if ${BUILDX_CMD} build --help 2>&1 | grep -- '--attest' >/dev/null; then
-  prvattrs="mode=max"
-  if [ "$GITHUB_ACTIONS" = "true" ]; then
-    prvattrs="$prvattrs,builder-id=https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-  fi
-  setFlags+=(--set "*.attest=type=sbom")
-  setFlags+=(--set "*.attest=type=provenance,$prvattrs")
+  prvattrs="false"
+  # if [ "$GITHUB_ACTIONS" = "true" ]; then
+  #   prvattrs="$prvattrs,builder-id=https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+  # fi
+  # setFlags+=(--set "*.attest=type=sbom")
+  # setFlags+=(--set "*.attest=type=provenance,$prvattrs")
 fi
 if [[ "$RELEASE" = "true" ]] && [[ "$GITHUB_ACTIONS" = "true" ]]; then
   setFlags+=(--set "*.no-cache-filter=git,gobuild-base")
diff --git a/hack/util b/hack/util
index 2c917d604..8a7d79b26 100755
--- a/hack/util
+++ b/hack/util
@@ -26,13 +26,14 @@ buildxCmd() {
 }
 
 buildAttestFlags() {
-  if ${BUILDX_CMD} build --help 2>&1 | grep -- '--attest' >/dev/null; then
-    prvattrs="mode=max"
-    if [ "$GITHUB_ACTIONS" = "true" ]; then
-      prvattrs="$prvattrs,builder-id=https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
-    fi
-    echo "--attest=type=sbom --attest=type=provenance,$prvattrs"
-  fi
+  : # no-op
+  # if ${BUILDX_CMD} build --help 2>&1 | grep -- '--attest' >/dev/null; then
+  # prvattrs="mode=max"
+  # if [ "$GITHUB_ACTIONS" = "true" ]; then
+  #   prvattrs="$prvattrs,builder-id=https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+  # fi
+  # echo "--attest=type=sbom --attest=type=provenance,$prvattrs"
+  # fi
 }
 
 currentref=""
diff --git a/session/auth/auth.proto b/session/auth/auth.proto
index f40bbc59c..0552ce142 100644
--- a/session/auth/auth.proto
+++ b/session/auth/auth.proto
@@ -5,48 +5,48 @@ package moby.filesync.v1;
 option go_package = "auth";
 
 service Auth {
-  rpc Credentials(CredentialsRequest) returns (CredentialsResponse);
-  rpc FetchToken(FetchTokenRequest) returns (FetchTokenResponse);
-  rpc GetTokenAuthority(GetTokenAuthorityRequest)
-      returns (GetTokenAuthorityResponse);
-  rpc VerifyTokenAuthority(VerifyTokenAuthorityRequest)
-      returns (VerifyTokenAuthorityResponse);
+	rpc Credentials(CredentialsRequest) returns (CredentialsResponse);
+	rpc FetchToken(FetchTokenRequest) returns (FetchTokenResponse);
+	rpc GetTokenAuthority(GetTokenAuthorityRequest)
+			returns (GetTokenAuthorityResponse);
+	rpc VerifyTokenAuthority(VerifyTokenAuthorityRequest)
+			returns (VerifyTokenAuthorityResponse);
 }
 
 message CredentialsRequest { string Host = 1; }
 
 message CredentialsResponse {
-  string Username = 1;
-  string Secret = 2;
+	string Username = 1;
+	string Secret = 2;
 }
 
 message FetchTokenRequest {
-  string ClientID = 1;
-  string Host = 2;
-  string Realm = 3;
-  string Service = 4;
-  repeated string Scopes = 5;
+	string ClientID = 1;
+	string Host = 2;
+	string Realm = 3;
+	string Service = 4;
+	repeated string Scopes = 5;
 }
 
 message FetchTokenResponse {
-  string Token = 1;
-  int64 ExpiresIn = 2; // seconds
-  int64 IssuedAt = 3;  // timestamp
+	string Token = 1;
+	int64 ExpiresIn = 2; // seconds
+	int64 IssuedAt = 3;  // timestamp
 
-  bool Anonymous = 99; // earthly-specific
+	bool Anonymous = 99; // earthly-specific
 }
 
 message GetTokenAuthorityRequest {
-  string Host = 1;
-  bytes Salt = 2;
+	string Host = 1;
+	bytes Salt = 2;
 }
 
 message GetTokenAuthorityResponse { bytes PublicKey = 1; }
 
 message VerifyTokenAuthorityRequest {
-  string Host = 1;
-  bytes Payload = 2;
-  bytes Salt = 3;
+	string Host = 1;
+	bytes Payload = 2;
+	bytes Salt = 3;
 }
 
 message VerifyTokenAuthorityResponse { bytes Signed = 1; }
diff --git a/session/grpc.go b/session/grpc.go
index a5a33d707..815d33125 100644
--- a/session/grpc.go
+++ b/session/grpc.go
@@ -2,23 +2,19 @@ package session
 
 import (
 	"context"
-	"math"
 	"net"
 	"sync/atomic"
-	"time"
 
 	"github.com/containerd/containerd/defaults"
 	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
 	"github.com/moby/buildkit/util/bklog"
 	"github.com/moby/buildkit/util/grpcerrors"
 	"github.com/pkg/errors"
-	"github.com/sirupsen/logrus"
 	"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/net/http2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/health/grpc_health_v1"
 )
 
 func serve(ctx context.Context, grpcServer *grpc.Server, conn net.Conn) {
@@ -82,64 +78,64 @@ func grpcClientConn(ctx context.Context, conn net.Conn, healthCfg ManagerHealthC
 	return ctx, cc, nil
 }
 
-func monitorHealth(ctx context.Context, cc *grpc.ClientConn, cancelConn func()) {
-	defer cancelConn()
-	defer cc.Close()
-
-	ticker := time.NewTicker(5 * time.Second)
-	defer ticker.Stop()
-	healthClient := grpc_health_v1.NewHealthClient(cc)
-
-	failedBefore := false
-	consecutiveSuccessful := 0
-	defaultHealthcheckDuration := 30 * time.Second
-	lastHealthcheckDuration := time.Duration(0)
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-			// This healthcheck can erroneously fail in some instances, such as receiving lots of data in a low-bandwidth scenario or too many concurrent builds.
-			// So, this healthcheck is purposely long, and can tolerate some failures on purpose.
-
-			healthcheckStart := time.Now()
-
-			timeout := time.Duration(math.Max(float64(defaultHealthcheckDuration), float64(lastHealthcheckDuration)*1.5))
-			ctx, cancel := context.WithTimeout(ctx, timeout)
-			_, err := healthClient.Check(ctx, &grpc_health_v1.HealthCheckRequest{})
-			cancel()
-
-			lastHealthcheckDuration = time.Since(healthcheckStart)
-			logFields := logrus.Fields{
-				"timeout":        timeout,
-				"actualDuration": lastHealthcheckDuration,
-			}
-
-			if err != nil {
-				select {
-				case <-ctx.Done():
-					return
-				default:
-				}
-				if failedBefore {
-					bklog.G(ctx).Error("healthcheck failed fatally")
-					return
-				}
-
-				failedBefore = true
-				consecutiveSuccessful = 0
-				bklog.G(ctx).WithFields(logFields).Warn("healthcheck failed")
-			} else {
-				consecutiveSuccessful++
-
-				if consecutiveSuccessful >= 5 && failedBefore {
-					failedBefore = false
-					bklog.G(ctx).WithFields(logFields).Debug("reset healthcheck failure")
-				}
-			}
-
-			bklog.G(ctx).WithFields(logFields).Trace("healthcheck completed")
-		}
-	}
-}
+// func monitorHealth(ctx context.Context, cc *grpc.ClientConn, cancelConn func()) {
+// 	defer cancelConn()
+// 	defer cc.Close()
+
+// 	ticker := time.NewTicker(5 * time.Second)
+// 	defer ticker.Stop()
+// 	healthClient := grpc_health_v1.NewHealthClient(cc)
+
+// 	failedBefore := false
+// 	consecutiveSuccessful := 0
+// 	defaultHealthcheckDuration := 30 * time.Second
+// 	lastHealthcheckDuration := time.Duration(0)
+
+// 	for {
+// 		select {
+// 		case <-ctx.Done():
+// 			return
+// 		case <-ticker.C:
+// 			// This healthcheck can erroneously fail in some instances, such as receiving lots of data in a low-bandwidth scenario or too many concurrent builds.
+// 			// So, this healthcheck is purposely long, and can tolerate some failures on purpose.
+
+// 			healthcheckStart := time.Now()
+
+// 			timeout := time.Duration(math.Max(float64(defaultHealthcheckDuration), float64(lastHealthcheckDuration)*1.5))
+// 			ctx, cancel := context.WithTimeout(ctx, timeout)
+// 			_, err := healthClient.Check(ctx, &grpc_health_v1.HealthCheckRequest{})
+// 			cancel()
+
+// 			lastHealthcheckDuration = time.Since(healthcheckStart)
+// 			logFields := logrus.Fields{
+// 				"timeout":        timeout,
+// 				"actualDuration": lastHealthcheckDuration,
+// 			}
+
+// 			if err != nil {
+// 				select {
+// 				case <-ctx.Done():
+// 					return
+// 				default:
+// 				}
+// 				if failedBefore {
+// 					bklog.G(ctx).Error("healthcheck failed fatally")
+// 					return
+// 				}
+
+// 				failedBefore = true
+// 				consecutiveSuccessful = 0
+// 				bklog.G(ctx).WithFields(logFields).Warn("healthcheck failed")
+// 			} else {
+// 				consecutiveSuccessful++
+
+// 				if consecutiveSuccessful >= 5 && failedBefore {
+// 					failedBefore = false
+// 					bklog.G(ctx).WithFields(logFields).Debug("reset healthcheck failure")
+// 				}
+// 			}
+
+// 			bklog.G(ctx).WithFields(logFields).Trace("healthcheck completed")
+// 		}
+// 	}
+// }
diff --git a/session/localhost/localhost.go b/session/localhost/localhost.go
index 8eafbb68e..32a9628e1 100644
--- a/session/localhost/localhost.go
+++ b/session/localhost/localhost.go
@@ -73,12 +73,12 @@ func LocalhostExec(ctx context.Context, c session.Caller, args []string, dir str
 			exitCode = int(msg.ExitCode)
 			exitCodeSet = true
 		default:
-			return fmt.Errorf("unhandled exit status: %d", msg.Status)
+			return errors.Errorf("unhandled exit status: %d", msg.Status)
 		}
 	}
 
 	if exitCode != 0 {
-		return fmt.Errorf("exit code: %d", exitCode)
+		return errors.Errorf("exit code: %d", exitCode)
 	}
 
 	return nil
diff --git a/session/localhost/localhostprovider/localhostprovider.go b/session/localhost/localhostprovider/localhostprovider.go
index 9c593daac..2517e0b3c 100644
--- a/session/localhost/localhostprovider/localhostprovider.go
+++ b/session/localhost/localhostprovider/localhostprovider.go
@@ -45,7 +45,7 @@ func (lp *localhostProvider) Exec(stream localhost.Localhost_ExecServer) error {
 	}
 
 	if len(msg.Command) == 0 {
-		return fmt.Errorf("command is empty")
+		return errors.Errorf("command is empty")
 	}
 	cmdStr := msg.Command[0]
 	args := msg.Command[1:]
diff --git a/session/manager.go b/session/manager.go
index 60610f11e..b349491da 100644
--- a/session/manager.go
+++ b/session/manager.go
@@ -96,7 +96,7 @@ func (sm *Manager) NumSessions() (sessions int, durationIdle time.Duration) {
 	defer sm.mu.Unlock()
 	sessions = len(sm.sessions)
 	if sessions == 0 {
-		durationIdle = time.Now().Sub(sm.idleAt)
+		durationIdle = time.Since(sm.idleAt)
 	}
 	return sessions, durationIdle
 }
diff --git a/session/pullping/pullping.proto b/session/pullping/pullping.proto
index 681d4a7fb..98d414dfc 100644
--- a/session/pullping/pullping.proto
+++ b/session/pullping/pullping.proto
@@ -5,12 +5,12 @@ package moby.pullping.v1;
 option go_package = "pullping";
 
 service PullPing {
-    rpc Pull(PullRequest) returns (stream PullResponse);
+	rpc Pull(PullRequest) returns (stream PullResponse);
 }
 
 message PullRequest {
-    repeated string images = 1;
-    map<string, string> resp = 2;
+	repeated string images = 1;
+	map<string, string> resp = 2;
 }
 
 message PullResponse {
diff --git a/session/socketforward/socket.go b/session/socketforward/socket.go
index ceef8bf6f..7838e51be 100644
--- a/session/socketforward/socket.go
+++ b/session/socketforward/socket.go
@@ -1,7 +1,6 @@
 package socketforward
 
 import (
-	"fmt"
 	"net"
 	"os"
 	"path/filepath"
@@ -96,7 +95,7 @@ func MountSocket(ctx context.Context, c session.Caller, opt SocketOpt) (sockPath
 
 	id := opt.ID
 	if id == "" {
-		return "", nil, fmt.Errorf("socket ID is missing")
+		return "", nil, errors.Errorf("socket ID is missing")
 	}
 
 	go s.run(ctx, l, id) // erroring per connection allowed
diff --git a/session/socketforward/socketprovider/socketprovider.go b/session/socketforward/socketprovider/socketprovider.go
index 281546784..5d966f984 100644
--- a/session/socketforward/socketprovider/socketprovider.go
+++ b/session/socketforward/socketprovider/socketprovider.go
@@ -2,11 +2,11 @@ package socketprovider
 
 import (
 	"context"
-	"fmt"
 	"io"
 
 	"github.com/moby/buildkit/session"
 	socketforward "github.com/moby/buildkit/session/socketforward"
+	"github.com/pkg/errors"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
@@ -37,7 +37,7 @@ func (sp *socketProvider) Proxy(stream socketforward.Socket_ProxyServer) error {
 
 	cb, ok := sp.m[id]
 	if !ok {
-		return fmt.Errorf("no callback registered for socket ID: %s", id)
+		return errors.Errorf("no callback registered for socket ID: %s", id)
 	}
 
 	s1, s2 := sockPair()
diff --git a/snapshot/diffapply_unix.go b/snapshot/diffapply_unix.go
index 5aa73dd0a..2cd9e9b34 100644
--- a/snapshot/diffapply_unix.go
+++ b/snapshot/diffapply_unix.go
@@ -128,7 +128,7 @@ func statInode(stat *syscall.Stat_t) inode {
 	}
 	return inode{
 		ino: stat.Ino,
-		dev: stat.Dev,
+		dev: uint64(stat.Dev),
 	}
 }
 
@@ -297,7 +297,7 @@ func (a *applier) applyDelete(ctx context.Context, ca *changeApply) (bool, error
 			if ca.srcStat == nil {
 				ca.srcStat = &syscall.Stat_t{
 					Mode: syscall.S_IFCHR,
-					Rdev: unix.Mkdev(0, 0),
+					Rdev: 0,
 				}
 				ca.srcPath = ""
 			}
diff --git a/solver/inconsistent_graph_state_error_tracker.go b/solver/inconsistent_graph_state_error_tracker.go
index 93a7e37ca..8c8cd05a7 100644
--- a/solver/inconsistent_graph_state_error_tracker.go
+++ b/solver/inconsistent_graph_state_error_tracker.go
@@ -31,7 +31,7 @@ func newDgstTracker() *dgstTracker {
 }
 
 func (d *dgstTracker) add(dgst digest.Digest, action string) {
-	d.head += 1
+	d.head++
 	if d.head >= len(d.records) {
 		d.head = 0
 	}
diff --git a/solver/llbsolver/bridge.go b/solver/llbsolver/bridge.go
index 8bfd96e46..e6427e30c 100644
--- a/solver/llbsolver/bridge.go
+++ b/solver/llbsolver/bridge.go
@@ -184,7 +184,7 @@ func (b *llbBridge) getExporter(ctx context.Context) (*ExporterRequest, error) {
 		return nil
 	})
 	if numExporters != 1 {
-		return nil, fmt.Errorf("Export found %d exporters (should have been 1)", numExporters) // shouldn't happen
+		return nil, errors.Errorf("Export found %d exporters (should have been 1)", numExporters) // shouldn't happen
 	}
 	return exp, nil
 }
@@ -207,13 +207,13 @@ func (b *llbBridge) Export(ctx context.Context, refs map[string]cache.ImmutableR
 		return err
 	}
 	if exp.Exporter == nil {
-		return fmt.Errorf("Export had no exporter configured")
+		return errors.Errorf("Export had no exporter configured")
 	}
 
 	return inBuilderContext(ctx, b.builder, exp.Exporter.Name(), id, func(ctx context.Context, g session.Group) error {
 		sessionIDs := session.AllSessionIDs(g)
 		if len(sessionIDs) == 0 {
-			return fmt.Errorf("group has no session IDs") // shouldnt happen
+			return errors.Errorf("group has no session IDs") // shouldnt happen
 		}
 		sessionID := sessionIDs[0]
 		var err error
diff --git a/solver/llbsolver/ops/exec.go b/solver/llbsolver/ops/exec.go
index 1751f78f7..b63d086e0 100644
--- a/solver/llbsolver/ops/exec.go
+++ b/solver/llbsolver/ops/exec.go
@@ -481,7 +481,7 @@ func (e *ExecOp) doFromLocalHack(ctx context.Context, root executor.Mount, mount
 
 func (e *ExecOp) copyLocally(ctx context.Context, root executor.Mount, g session.Group, meta executor.Meta, stdout, stderr io.WriteCloser) error {
 	if len(meta.Args) != 3 {
-		return fmt.Errorf("CopyFileMagicStr takes exactly 2 args")
+		return errors.Errorf("CopyFileMagicStr takes exactly 2 args")
 	}
 	if meta.Args[0] != localhost.CopyFileMagicStr {
 		panic("arg[0] must be CopyFileMagicStr; this should not have happened")
@@ -494,7 +494,7 @@ func (e *ExecOp) copyLocally(ctx context.Context, root executor.Mount, g session
 	dst := meta.Args[2]
 
 	if src == "/" {
-		return fmt.Errorf("copyLocally does not support copying the entire root filesystem")
+		return errors.Errorf("copyLocally does not support copying the entire root filesystem")
 	}
 
 	if strings.HasSuffix(dst, ".") || strings.HasSuffix(dst, "/") {
@@ -531,7 +531,7 @@ func (e *ExecOp) copyLocally(ctx context.Context, root executor.Mount, g session
 	})
 }
 
-var errSendFileMagicStrMissingArgs = fmt.Errorf("SendFileMagicStr args missing; should be SendFileMagicStr [--dir] [--] <src> [<src> ...] <dst>")
+var errSendFileMagicStrMissingArgs = errors.Errorf("SendFileMagicStr args missing; should be SendFileMagicStr [--dir] [--] <src> [<src> ...] <dst>")
 
 func (e *ExecOp) sendLocally(ctx context.Context, root executor.Mount, mounts []executor.Mount, g session.Group, meta executor.Meta, stdout, stderr io.WriteCloser) error {
 	i := 0
@@ -563,13 +563,13 @@ func (e *ExecOp) sendLocally(ctx context.Context, root executor.Mount, mounts []
 	dstIndex := len(meta.Args) - 1
 	numFiles := dstIndex - i
 	if numFiles <= 0 {
-		return fmt.Errorf("SendFileMagicStr args missing; should be SendFileMagicStr [--dir] [--] <src> [<src> ...] <dst>")
+		return errors.Errorf("SendFileMagicStr args missing; should be SendFileMagicStr [--dir] [--] <src> [<src> ...] <dst>")
 	}
 	files := meta.Args[i:dstIndex]
 	dst := meta.Args[dstIndex]
 
 	if len(mounts) != 1 {
-		return fmt.Errorf("SendFileMagicStr must be given a mount with the artifacts to copy from")
+		return errors.Errorf("SendFileMagicStr must be given a mount with the artifacts to copy from")
 	}
 
 	return e.sm.Any(ctx, g, func(ctx context.Context, _ string, caller session.Caller) error {
diff --git a/solver/pb/caps.go b/solver/pb/caps.go
index b731b6f6d..06e41c735 100644
--- a/solver/pb/caps.go
+++ b/solver/pb/caps.go
@@ -220,7 +220,7 @@ func init() {
 		Enabled: true,
 		Status:  apicaps.CapStatusExperimental,
 	})
-	
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapSourceHTTP,
 		Enabled: true,
diff --git a/util/gitutil/git_cli.go b/util/gitutil/git_cli.go
index f87ffdfa0..df58ca593 100644
--- a/util/gitutil/git_cli.go
+++ b/util/gitutil/git_cli.go
@@ -15,8 +15,10 @@ import (
 	"github.com/pkg/errors"
 )
 
-// arthlyCtxDebugLevelKey is earthly-specific and is used to pass along the debug level
-const EarthlyCtxDebugLevelKey = "EARTHLY_DEBUG_LEVEL" // earthly-specific
+type ctxEarthlyDebugLevelKey string // earthly-specific
+
+// earthlyCtxDebugLevelKey is earthly-specific and is used to pass along the debug level
+const EarthlyCtxDebugLevelKey ctxEarthlyDebugLevelKey = "EARTHLY_DEBUG_LEVEL" // earthly-specific
 
 // GitLogLevel is earthly-specific
 type GitLogLevel int
diff --git a/util/urlutil/redact.go b/util/urlutil/redact.go
index cdc9c30f0..9f4b4931b 100644
--- a/util/urlutil/redact.go
+++ b/util/urlutil/redact.go
@@ -46,6 +46,6 @@ func RedactAllCredentials(s string) string {
 		sb.WriteString(RedactCredentials(s[m[0]:m[1]]))
 		i = m[1]
 	}
-	sb.WriteString(s[i:len(s)])
+	sb.WriteString(s[i:])
 	return sb.String()
 }
diff --git a/worker/runc/runc_test.go b/worker/runc/runc_test.go
index 2617cb18a..7c65077f8 100644
--- a/worker/runc/runc_test.go
+++ b/worker/runc/runc_test.go
@@ -38,7 +38,7 @@ func newWorkerOpt(t *testing.T, processMode oci.ProcessMode) base.WorkerOpt {
 		},
 	}
 	rootless := false
-	workerOpt, err := NewWorkerOpt(tmpdir, snFactory, rootless, processMode, nil, nil, netproviders.Opt{Mode: "host"}, nil, "", "", false, nil, "", "", []oci.OciHook{})
+	workerOpt, err := NewWorkerOpt(tmpdir, snFactory, rootless, processMode, nil, nil, netproviders.Opt{Mode: "host"}, nil, "", "", false, nil, "", "", []oci.OciHook{}, 0)
 	require.NoError(t, err)
 
 	return workerOpt