From 20405112c25c8c13dd3985d8e8faed374cce7848 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Thu, 15 Jan 2026 18:42:29 -0800
Subject: [PATCH] policy: allow image source without set platform

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 build/opt.go            | 11 +++++++++++
 commands/policy/eval.go |  1 +
 policy/validate.go      |  3 +++
 3 files changed, 15 insertions(+)

diff --git a/build/opt.go b/build/opt.go
index a1c48a837..4d4a6b293 100644
--- a/build/opt.go
+++ b/build/opt.go
@@ -48,6 +48,7 @@ import (
 	"github.com/moby/buildkit/util/entitlements"
 	"github.com/moby/buildkit/util/gitutil"
 	"github.com/opencontainers/go-digest"
+	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/tonistiigi/fsutil"
@@ -457,6 +458,7 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt *O
 				Log:              logf,
 				FS:               opt.Inputs.policy.FS,
 				VerifierProvider: policy.SignatureVerifier(cfg),
+				DefaultPlatform:  defaultPlatform(bopts),
 			})
 			cbs = append(cbs, p.CheckPolicy)
 			if popt.Strict {
@@ -1233,3 +1235,12 @@ func parseOCILayoutPath(s string) (localPath, dgst, tag string) {
 	}
 	return
 }
+
+func defaultPlatform(bopts gateway.BuildOpts) *ocispecs.Platform {
+	pl := bopts.Workers[0].Platforms
+	if len(pl) == 0 {
+		return nil
+	}
+	p := platforms.Normalize(pl[0])
+	return &p
+}
diff --git a/commands/policy/eval.go b/commands/policy/eval.go
index bdad0d08e..77a84d07e 100644
--- a/commands/policy/eval.go
+++ b/commands/policy/eval.go
@@ -216,6 +216,7 @@ func runEval(ctx context.Context, dockerCli command.Cli, source string, opts eva
 		Env:              env,
 		FS:               fsProvider,
 		VerifierProvider: verifier,
+		DefaultPlatform:  &p,
 	})
 
 	srcReq := &gwpb.ResolveSourceMetaResponse{
diff --git a/policy/validate.go b/policy/validate.go
index 0c83da3cd..9bcf2e4f8 100644
--- a/policy/validate.go
+++ b/policy/validate.go
@@ -59,6 +59,7 @@ type Opt struct {
 	Log              func(logrus.Level, string)
 	FS               func() (fs.StatFS, func() error, error)
 	VerifierProvider PolicyVerifierProvider
+	DefaultPlatform  *ocispecs.Platform
 }
 
 var _ policysession.PolicyCallback = (&Policy{}).CheckPolicy
@@ -100,6 +101,8 @@ func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicy
 		}
 		pl = platforms.Normalize(pl)
 		platform = &pl
+	} else {
+		platform = p.opt.DefaultPlatform
 	}
 
 	inp, unknowns, err := SourceToInputWithLogger(ctx, p.opt.VerifierProvider, src, platform, p.opt.Log)