From 61843e00316cb02d1aa4bd4a6d32039823ba36fa Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Tue, 6 Jan 2026 20:51:42 -0800
Subject: [PATCH] policy: add strict policy config support

Strict policy will fail if remote daemon doesn't support policy
verification.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 build/opt.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/build/opt.go b/build/opt.go
index 4ec2e7f66..efaec8bd6 100644
--- a/build/opt.go
+++ b/build/opt.go
@@ -359,6 +359,11 @@ func toSolveOpt(ctx context.Context, node builder.Node, multiDriver bool, opt *O
 				Config: cfg,
 			})
 			cbs = append(cbs, p.CheckPolicy)
+			if popt.Strict {
+				if bopts.LLBCaps.Supports(pb.CapSourcePolicySession) != nil {
+					return nil, nil, errors.New("strict policy is not supported by the current BuildKit daemon, please upgrade to version v0.27+")
+				}
+			}
 		}
 		so.SourcePolicyProvider = policysession.NewPolicyProvider(policy.MultiPolicyCallback(cbs...))
 	}