Don't silently ignore failed wildcard expansion

This was letting mount-related errors slip by, and instead returning
an empty hash.

Signed-off-by: Paul "TBBle" Hampson <Paul.Hampson@Pobox.com>

cache/contenthash/checksum.go

@@ -386,7 +386,7 @@ func (cc *cacheContext) ChecksumWildcard(ctx context.Context, mountable cache.Mo
 
 	wildcards, err := cc.wildcards(ctx, m, p)
 	if err != nil {
-		return "", nil
+		return "", err
 	}
 
 	if followLinks {

cache/contenthash/checksum_test.go

@@ -202,6 +202,26 @@ func TestChecksumWildcard(t *testing.T) {
 	require.NoError(t, err)
 }
 
+func TestChecksumWildcardWithBadMountable(t *testing.T) {
+	t.Parallel()
+	tmpdir, err := ioutil.TempDir("", "buildkit-state")
+	require.NoError(t, err)
+	defer os.RemoveAll(tmpdir)
+
+	snapshotter, err := native.NewSnapshotter(filepath.Join(tmpdir, "snapshots"))
+	require.NoError(t, err)
+	cm, _ := setupCacheManager(t, tmpdir, "native", snapshotter)
+	defer cm.Close()
+
+	ref := createRef(t, cm, nil)
+
+	cc, err := newCacheContext(ref.Metadata(), nil)
+	require.NoError(t, err)
+
+	_, err = cc.ChecksumWildcard(context.TODO(), newBadMountable(), "*", false)
+	require.Error(t, err)
+}
+
 func TestSymlinksNoFollow(t *testing.T) {
 	t.Parallel()
 	tmpdir, err := ioutil.TempDir("", "buildkit-state")
@@ -913,6 +933,18 @@ func setupCacheManager(t *testing.T, tmpdir string, snapshotterName string, snap
 	}
 }
 
+type badMountable struct{}
+
+func (bm *badMountable) Mount(ctx context.Context, readonly bool) (snapshot.Mountable, error) {
+	return nil, errors.New("tried to mount bad mountable")
+}
+
+// newBadMountable returns a cache.Mountable that will fail to mount, for use in APIs
+// that require a Mountable, but which should never actually try to access the filesystem.
+func newBadMountable() cache.Mountable {
+	return &badMountable{}
+}
+
 // these test helpers are from tonistiigi/fsutil
 
 type change struct {