buildx policy evaluation verifies HTTP sources with PGP signatures
Introduced 2026-03-31 · score 0.97
HOW TO USE IT
When evaluating an HTTP source against a build policy, use `docker buildx policy eval` with the source URL. Buildx v0.33.0 adds the `verify_http_pgp_signature` policy builtin; its documented arguments and invocation were not found.
docker buildx policy eval <HTTP-source-URL>WHY THIS HELPS
Evaluate a build policy that verifies an HTTP source using a PGP signature.
REQUIREMENTS AND LIMITATIONS
- Version: v0.33.0
- source (required): Source to evaluate; the docs show an HTTP URL as an example.
- verify_http_pgp_signature: Release note names this policy builtin for verifying HTTP sources with PGP signatures; its arguments and parameters were not found in the official documentation searched.
- -f, --file: Policy filename to evaluate; defaults to `Dockerfile`.
- Prerequisite: Buildx 0.31.0 or later and BuildKit 0.26.0 or later.
FIRST-PARTY EVIDENCE
- https://github.com/docker/buildx/releases/tag/v0.33.0
- https://docs.docker.com/build/policies/usage/
- https://docs.docker.com/reference/cli/docker/buildx/policy/eval/
Check the installed version and the source before using it. Entry JSON