policy: allow image source without set platform

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

build/opt.go

@@ -48,6 +48,7 @@ import (
 	"github.com/moby/buildkit/util/entitlements"
 	"github.com/moby/buildkit/util/gitutil"
 	"github.com/opencontainers/go-digest"
+	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/tonistiigi/fsutil"
@@ -457,6 +458,7 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt *O
 				Log:              logf,
 				FS:               opt.Inputs.policy.FS,
 				VerifierProvider: policy.SignatureVerifier(cfg),
+				DefaultPlatform:  defaultPlatform(bopts),
 			})
 			cbs = append(cbs, p.CheckPolicy)
 			if popt.Strict {
@@ -1233,3 +1235,12 @@ func parseOCILayoutPath(s string) (localPath, dgst, tag string) {
 	}
 	return
 }
+
+func defaultPlatform(bopts gateway.BuildOpts) *ocispecs.Platform {
+	pl := bopts.Workers[0].Platforms
+	if len(pl) == 0 {
+		return nil
+	}
+	p := platforms.Normalize(pl[0])
+	return &p
+}

commands/policy/eval.go

@@ -216,6 +216,7 @@ func runEval(ctx context.Context, dockerCli command.Cli, source string, opts eva
 		Env:              env,
 		FS:               fsProvider,
 		VerifierProvider: verifier,
+		DefaultPlatform:  &p,
 	})
 
 	srcReq := &gwpb.ResolveSourceMetaResponse{

policy/validate.go

@@ -59,6 +59,7 @@ type Opt struct {
 	Log              func(logrus.Level, string)
 	FS               func() (fs.StatFS, func() error, error)
 	VerifierProvider PolicyVerifierProvider
+	DefaultPlatform  *ocispecs.Platform
 }
 
 var _ policysession.PolicyCallback = (&Policy{}).CheckPolicy
@@ -100,6 +101,8 @@ func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicy
 		}
 		pl = platforms.Normalize(pl)
 		platform = &pl
+	} else {
+		platform = p.opt.DefaultPlatform
 	}
 
 	inp, unknowns, err := SourceToInputWithLogger(ctx, p.opt.VerifierProvider, src, platform, p.opt.Log)