Add --source-policy-file flag for BuildKit-compatible source policies

[tinovyatkin]

Summary

• Adds a new --source-policy-file flag to buildah build that enables users to control and transform source references during builds without modifying Dockerfiles
• Implements BuildKit-compatible source policy JSON schema with ALLOW, DENY, and CONVERT actions
• Supports EXACT and WILDCARD match types for flexible policy rules

Background

This implements support for the BuildKit source policy feature as documented in BuildKit's build reproducibility guide. Docker Buildx supports this via the EXPERIMENTAL_BUILDKIT_SOURCE_POLICY environment variable. The JSON schema is compatible with BuildKit's source policy format.

Motivation

This feature allows organizations to:

• Pin base image tags to specific digests at build time for reproducibility
• Deny specific sources from being used to enforce security policies
• Transform source references transparently without modifying Containerfiles

Changes

• pkg/sourcepolicy/: New package implementing policy parsing, validation, and matching
• define/build.go: Added SourcePolicyFile field to BuildOptions
• pkg/cli/common.go: Added --source-policy-file flag definition
• imagebuildah/executor.go: Policy loading in newExecutor()
• imagebuildah/stage_executor.go: Policy evaluation in prepare() function
• docs/buildah-build.1.md: Man page documentation with examples
• tests/source-policy.bats: Integration tests
• pkg/sourcepolicy/policy_test.go: Unit tests

Example Usage

Pin alpine:latest to a specific digest:

{
  "rules": [
    {
      "action": "CONVERT",
      "selector": {
        "identifier": "docker-image://docker.io/library/alpine:latest"
      },
      "updates": {
        "identifier": "docker-image://docker.io/library/alpine@sha256:abc123"
      }
    }
  ]
}

buildah build --source-policy-file policy.json -t myimage .

Test plan

• Unit tests for policy parsing, validation, and matching (pkg/sourcepolicy/policy_test.go)
• Integration tests covering DENY, ALLOW, CONVERT actions and WILDCARD matching (tests/source-policy.bats)
• Manual testing with real images

---

🤖 Generated with Claude Code

[TomSweeneyRedHat]

Couple small nits, otherwise LGTM. @nalind?

[nalind]

Overall, I rather like this. I'd be tempted to handle wildcard matching using filepath.Match(), but it looks like the implementation we're trying to be compatible with isn't as flexible as that. A couple of notes on the normalization of docker image names and the default matching method, but otherwise it looks pretty good to me.

[packit-as-a-service]

Ephemeral COPR build failed. @containers/packit-build please check.

[nalind]

LGTM, restarted a test run that failed due to a known flake.

[TomSweeneyRedHat]

LGTM