tests: add http policy integration tests

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

policy/validate.go

@@ -236,7 +236,7 @@ func (p *Policy) CheckPolicy(ctx context.Context, req *policysession.CheckPolicy
 			if err := AddUnknownsWithLogger(p.opt.Log, next, unk); err != nil {
 				return nil, nil, err
 			}
-			if next.Image != nil || next.Git != nil {
+			if next.Image != nil || next.Git != nil || hasHTTPUnknowns(unk) {
 				p.log(logrus.InfoLevel, "policy decision for source %s: resolve missing fields %+v", src.Source.Identifier, summarizeUnknownsForLog(unk))
 				return nil, next, nil
 			}
@@ -347,14 +347,15 @@ func SourceToInputWithLogger(ctx context.Context, getVerifier PolicyVerifierProv
 			Path:   u.Path,
 			Query:  u.Query(),
 		}
+		if src.HTTP != nil {
+			inp.HTTP.Checksum = src.HTTP.Checksum
+		}
+		if inp.HTTP.Checksum == "" {
+			unknowns = append(unknowns, "input.http.checksum")
+		}
 		if _, ok := src.Source.Attrs[pb.AttrHTTPAuthHeaderSecret]; ok {
 			inp.HTTP.HasAuth = true
 		}
-		if src.Image == nil {
-			unknowns = append(unknowns, "input.http.checksum")
-		} else {
-			inp.HTTP.Checksum = src.Image.Digest
-		}
 	case "git":
 		if !gitutil.IsGitTransport(refstr) {
 			refstr = "https://" + refstr
@@ -625,6 +626,9 @@ func AddUnknownsWithLogger(logf func(logrus.Level, string), req *gwpb.ResolveSou
 			}
 			req.Image.AttestationChain = true
 
+		case "http.checksum":
+			// HTTP checksums are resolved by BuildKit for the HTTP source itself.
+
 		case "git.ref", "git.checksum", "git.commitChecksum", "git.isAnnotatedTag", "git.isSHA256", "git.tagName", "git.branch":
 
 		case "git.commit", "git.tag":
@@ -678,6 +682,15 @@ func summarizeUnknownsForLog(unk []string) []string {
 	return out
 }
 
+func hasHTTPUnknowns(unk []string) bool {
+	for _, u := range unk {
+		if strings.HasPrefix(u, "input.http.") {
+			return true
+		}
+	}
+	return false
+}
+
 func trimKey(s string) string {
 	const (
 		dot = '.'