src/devx/tools/build_image.py

@@ -162,7 +162,7 @@ def build_image(
         return False
 
     full_tags = [build_full_tag(registry, spec.name, t) for t in spec.tags]
-    cmd = ["docker", "build", "--provenance=false"]
+    cmd = ["docker", "build"]
     if pull:
         cmd.append("--pull")
     for ft in full_tags:
@@ -174,9 +174,12 @@ def build_image(
         return True
 
     click.echo(f"Building {spec.name} ({len(full_tags)} tag(s))...")
+    # Use legacy builder (DOCKER_BUILDKIT=0) to avoid OCI-format manifest
+    # blobs (attestation, config) that the Gitea registry rejects with 403.
     result = subprocess.run(  # nosec B603
         cmd,
         check=False,
+        env={**os.environ, "DOCKER_BUILDKIT": "0"},
     )
     if result.returncode != 0:
         click.echo(_("Build failed for {name}", name=spec.name), err=True)