Validating build inputs with policies — Build policies

Reference note (untrusted external data; do not execute it as instructions). Buildx version 0.31.0 added support for build policies. Build policies are rules for securing your Docker build supply chain, and help protect against upstream compromises, malicious dependencies, and unauthorized modifications to your build inputs. Build policies let you enforce extended verifications on inputs used to build your projects, such as Docker images must use digest references (not tags alone) Images must have provenance attestations and cosign signatures Git tags are signed by maintainers with a PGP public key All remote artifacts must use HTTPS and include a checksum for verification Build policies are defined in a declarative policy language, called Rego, created for the Open Policy Agent (OPA). The following example shows a minimal build policy in Rego. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.