From 89fdef17e668d0b94651cf97746a6f4042a91c0f Mon Sep 17 00:00:00 2001 From: Tonis Tiigi Date: Fri, 16 Jan 2026 12:12:41 -0800 Subject: [PATCH] policy: fixes for image source handling - Make sure tag is added to image reference as containerd reference parser refuses to parse otherwise. - When attestation is asked from non-index, return nil instead of error. This is for consistency as likely to fail in BuildKit before that is fixed separately. Signed-off-by: Tonis Tiigi --- commands/policy/eval.go | 1 + policy/signatures.go | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/commands/policy/eval.go b/commands/policy/eval.go index 77a84d07e..2d516215c 100644 --- a/commands/policy/eval.go +++ b/commands/policy/eval.go @@ -388,6 +388,7 @@ func parseSource(input string) (*pb.SourceOp, error) { if err != nil { return nil, errors.Wrapf(err, "failed to parse image source reference") } + ref = reference.TagNameOnly(ref) return &pb.SourceOp{Identifier: "docker-image://" + ref.String()}, nil } if strings.HasPrefix(input, "git://") { diff --git a/policy/signatures.go b/policy/signatures.go index 5c87b2c2c..daa0178d2 100644 --- a/policy/signatures.go +++ b/policy/signatures.go @@ -89,6 +89,10 @@ func parseSignatures(ctx context.Context, getVerifier PolicyVerifierProvider, ac } desc := toOCIDescriptor(rootBlob.Descriptor_) + if desc.MediaType != ocispecs.MediaTypeImageIndex { + return nil, nil + } + sc, err := policyimage.ResolveSignatureChain(ctx, acp, desc, platform) if err != nil { return nil, errors.Wrapf(err, "resolving signature chain for image %s", desc.Digest)