From 88cba2c3675506aeeb2521548cadc61e369878f0 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Wed, 25 Feb 2026 14:02:12 -0800
Subject: [PATCH] policy: avoid stale invalid field warnings in eval

Track fields reloaded during eval --print resolution loops and filter
final invalid-field warnings against that set.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 commands/policy/eval.go      | 19 +++++++++++++++++++
 commands/policy/eval_test.go | 13 +++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/commands/policy/eval.go b/commands/policy/eval.go
index 7a17734c6..9cd484cdd 100644
--- a/commands/policy/eval.go
+++ b/commands/policy/eval.go
@@ -118,6 +118,7 @@ func runEval(ctx context.Context, dockerCli command.Cli, source string, opts eva
 		var lastUnknowns []string
 		var trimmedUnknowns []string
 		var invalidFields []string
+		reloadedFields := map[string]struct{}{}
 		for {
 			maxAttempts--
 			if maxAttempts <= 0 {
@@ -133,6 +134,9 @@ func runEval(ctx context.Context, dockerCli command.Cli, source string, opts eva
 			}
 			lastUnknowns = slices.Clone(trimmedUnknowns)
 			toReload, invalid := selectReloadFields(opts.fields, trimmedUnknowns)
+			for _, f := range toReload {
+				reloadedFields[f] = struct{}{}
+			}
 			invalidFields = invalid
 			if len(toReload) > 0 {
 				retry, next, err := policy.ResolveInputUnknowns(ctx, &input, srcReq.Source, toReload, platform, &p, metaResolver, verifier, nil)
@@ -157,6 +161,7 @@ func runEval(ctx context.Context, dockerCli command.Cli, source string, opts eva
 			}
 			break
 		}
+		invalidFields = filterInvalidFields(invalidFields, reloadedFields)
 
 		if len(invalidFields) > 0 {
 			logrus.Warnf("invalid fields: %v", strings.Join(invalidFields, ", "))
@@ -292,6 +297,20 @@ func selectReloadFields(fields []string, unknowns []string) ([]string, []string)
 	return slices.Collect(maps.Keys(reload)), invalid
 }
 
+func filterInvalidFields(invalid []string, reloadedFields map[string]struct{}) []string {
+	if len(invalid) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(invalid))
+	for _, field := range invalid {
+		if _, ok := reloadedFields[field]; ok {
+			continue
+		}
+		out = append(out, field)
+	}
+	return out
+}
+
 func findUnknownAncestor(field string, unknowns []string) string {
 	var best string
 	for _, unknown := range unknowns {
diff --git a/commands/policy/eval_test.go b/commands/policy/eval_test.go
index 75df88b32..77522a5b3 100644
--- a/commands/policy/eval_test.go
+++ b/commands/policy/eval_test.go
@@ -127,6 +127,19 @@ func TestSelectReloadFields(t *testing.T) {
 	})
 }
 
+func TestFilterInvalidFields(t *testing.T) {
+	out := filterInvalidFields([]string{
+		"git.tag",
+		"image.checksum",
+	}, map[string]struct{}{
+		"git.tag": {},
+	})
+	require.Equal(t, []string{"image.checksum"}, out)
+
+	out = filterInvalidFields([]string{"foo.bar"}, nil)
+	require.Equal(t, []string{"foo.bar"}, out)
+}
+
 func TestMaterialFieldPrerequisites(t *testing.T) {
 	t.Run("non material field", func(t *testing.T) {
 		prereq, ok := materialFieldPrerequisites("image.provenance")