From a2cff800dd97017d6d729f38153e25dbb1badd88 Mon Sep 17 00:00:00 2001
From: saehejkang <20051028+saehejkang@users.noreply.github.com>
Date: Sat, 1 Aug 2026 22:19:19 -0700
Subject: [PATCH 1/2] restrict ssh option to default and return error

---
 pkg/build/buildopts.go | 20 ++++++++++++++++----
 pkg/build/errors.go    |  1 +
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/pkg/build/buildopts.go b/pkg/build/buildopts.go
index fb77643..7d41eaa 100644
--- a/pkg/build/buildopts.go
+++ b/pkg/build/buildopts.go
@@ -241,11 +241,20 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 		return args, nil
 	}
 
-	sshExtract := func(key string) []sshprovider.AgentConfig {
+	sshExtract := func(key string) ([]sshprovider.AgentConfig, error) {
 		values, ok := contextMap[key]
 		if !ok {
-			return nil
+			return nil, nil
 		}
+		if len(values) != 1 {
+			return nil, ErrInvalidSSH
+		}
+
+		value := strings.TrimSpace(values[0])
+		if value != "default" {
+			return nil, ErrInvalidSSH
+		}
+
 		agentConfigs := make([]sshprovider.AgentConfig, 0, len(values))
 		for _, value := range values {
 			id, path, hasPath := strings.Cut(value, "=")
@@ -267,7 +276,7 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 			}
 			agentConfigs = append(agentConfigs, config)
 		}
-		return agentConfigs
+		return agentConfigs, nil
 	}
 
 	labels := mapExtract(KeyLabels)
@@ -276,7 +285,10 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 	if err != nil {
 		return nil, err
 	}
-	ssh := sshExtract(KeySSH)
+	ssh, err := sshExtract(KeySSH)
+	if err != nil {
+		return nil, err
+	}
 	cacheIn := contextMap[KeyCacheIn]
 	cacheOut := contextMap[KeyCacheOut]
 	outputs := contextMap[KeyOutput]
diff --git a/pkg/build/errors.go b/pkg/build/errors.go
index 04a603b..03c5445 100644
--- a/pkg/build/errors.go
+++ b/pkg/build/errors.go
@@ -28,4 +28,5 @@ var (
 	ErrNoBuildDirectives         = fmt.Errorf("no build directives")
 	ErrInvalidImageContextFormat = fmt.Errorf("image resolver: image name format is invalid")
 	ErrInvalidProgress           = fmt.Errorf("build arg progress value is invalid")
+	ErrInvalidSSH                = fmt.Errorf("build arg ssh value is invalid")
 )

From c5142e3fe014b918316242df476f2ae4d11ed5eb Mon Sep 17 00:00:00 2001
From: saehejkang <20051028+saehejkang@users.noreply.github.com>
Date: Sun, 2 Aug 2026 10:48:13 -0700
Subject: [PATCH 2/2] update error var and add comment

---
 pkg/build/buildopts.go | 5 +++--
 pkg/build/errors.go    | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkg/build/buildopts.go b/pkg/build/buildopts.go
index 7d41eaa..fb78fc2 100644
--- a/pkg/build/buildopts.go
+++ b/pkg/build/buildopts.go
@@ -246,13 +246,14 @@ func NewBuildOpts(ctx context.Context, basePath string, contextMap map[string][]
 		if !ok {
 			return nil, nil
 		}
+		// Only --ssh default is supported for now, so all other cases are rejected.
 		if len(values) != 1 {
-			return nil, ErrInvalidSSH
+			return nil, ErrUnsupportedSSH
 		}
 
 		value := strings.TrimSpace(values[0])
 		if value != "default" {
-			return nil, ErrInvalidSSH
+			return nil, ErrUnsupportedSSH
 		}
 
 		agentConfigs := make([]sshprovider.AgentConfig, 0, len(values))
diff --git a/pkg/build/errors.go b/pkg/build/errors.go
index 03c5445..80f6e82 100644
--- a/pkg/build/errors.go
+++ b/pkg/build/errors.go
@@ -28,5 +28,5 @@ var (
 	ErrNoBuildDirectives         = fmt.Errorf("no build directives")
 	ErrInvalidImageContextFormat = fmt.Errorf("image resolver: image name format is invalid")
 	ErrInvalidProgress           = fmt.Errorf("build arg progress value is invalid")
-	ErrInvalidSSH                = fmt.Errorf("build arg ssh value is invalid")
+	ErrUnsupportedSSH            = fmt.Errorf("build arg ssh value is not supported")
 )