Tonis Tiigi 0e50635195 policy: add builtin default source policy ...

Embed an opt-in default source policy for Docker-managed frontend images.
Load it ahead of user policies when enabled, and cover behavior with table-
driven policy tests for signed, unsigned, floating, and labs tags.

Makes sure if there is any attack against the docker/dockerfile
releases, or they accidentally point to worng images, these are automatically detected.

In a future release these should become opt-out.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

2026-04-20 16:32:39 -07:00

..

resolver

tests: replace aaa/bbb node names with descriptive builder names

2026-02-09 16:41:11 +01:00

build.go

imagetools: support oci-layout refs

2026-03-12 22:45:01 -07:00

dial.go

build: split out node resolver

2025-12-04 09:48:36 +00:00

git_test.go

lint: modernize fix

2025-05-13 20:44:57 +02:00

git.go

gitutil: migrate to BuildKit GitCLI API

2026-04-09 14:57:38 +02:00

invoke.go

dap: fix the check to determine whether exec will succeed

2026-03-17 10:31:11 -05:00

localstate.go

history: don't import build package

2026-02-11 10:29:47 +01:00

opt_test.go

imagetools: support oci-layout refs

2026-03-12 22:45:01 -07:00

opt.go

policy: add builtin default source policy

2026-04-20 16:32:39 -07:00

policy_loader_test.go

build: ref-count policy FS lifecycle

2026-02-26 18:48:38 -08:00

policy_loader.go

build: ref-count policy FS lifecycle

2026-02-26 18:48:38 -08:00

policy_test.go

build: resolve policy files from context state and unified FS

2026-02-23 16:22:19 -08:00

provenance.go

fix empty provenance metadata for multi-platform builds

2025-11-25 17:39:46 +01:00

replicatedstream_test.go

use "#nosec" instead of "nolint:gosec" to be more specific

2025-07-03 13:31:06 +02:00

replicatedstream.go

build: allow builds from stdin for multi-node builders

2024-08-14 13:13:18 +03:00

result.go

dap: fix the check to determine whether exec will succeed

2026-03-17 10:31:11 -05:00

url.go

build: raise maximum size limit for dockerfile and fix size check

2024-10-03 12:12:40 -05:00

utils_test.go

bake: multi ips support for extra hosts

2025-06-16 11:55:17 +02:00

utils.go

history: don't import build package

2026-02-11 10:29:47 +01:00