diff --git a/client/client_test.go b/client/client_test.go
index 2d74b9d4c0fd..b04b7a76f6a1 100644
--- a/client/client_test.go
+++ b/client/client_test.go
@@ -2787,7 +2787,7 @@ func testSourceDateEpochClamp(t *testing.T, sb integration.Sandbox) {
 
 	var bboxConfig []byte
 	_, err = c.Build(sb.Context(), SolveOpt{}, "", func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
-		_, bboxConfig, err = c.ResolveImageConfig(ctx, "docker.io/library/busybox:latest", llb.ResolveImageConfigOpt{})
+		_, _, bboxConfig, err = c.ResolveImageConfig(ctx, "docker.io/library/busybox:latest", llb.ResolveImageConfigOpt{})
 		if err != nil {
 			return nil, err
 		}
@@ -9470,32 +9470,88 @@ func testSourcePolicy(t *testing.T, sb integration.Sandbox) {
 	}
 
 	t.Run("Frontend policies", func(t *testing.T) {
-		denied := "https://raw.githubusercontent.com/moby/buildkit/v0.10.1/README.md"
-		frontend := func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
-			st := llb.Image("busybox:1.34.1-uclibc").File(
-				llb.Copy(llb.HTTP(denied),
-					"README.md", "README.md"))
-			def, err := st.Marshal(sb.Context())
-			if err != nil {
-				return nil, err
+		t.Run("deny http", func(t *testing.T) {
+			denied := "https://raw.githubusercontent.com/moby/buildkit/v0.10.1/README.md"
+			frontend := func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+				st := llb.Image("busybox:1.34.1-uclibc").File(
+					llb.Copy(llb.HTTP(denied),
+						"README.md", "README.md"))
+				def, err := st.Marshal(sb.Context())
+				if err != nil {
+					return nil, err
+				}
+				return c.Solve(ctx, gateway.SolveRequest{
+					Definition: def.ToPB(),
+					SourcePolicies: []*sourcepolicypb.Policy{{
+						Rules: []*sourcepolicypb.Rule{
+							{
+								Action: sourcepolicypb.PolicyAction_DENY,
+								Selector: &sourcepolicypb.Selector{
+									Identifier: denied,
+								},
+							},
+						},
+					}},
+				})
 			}
-			return c.Solve(ctx, gateway.SolveRequest{
-				Definition: def.ToPB(),
-				SourcePolicies: []*sourcepolicypb.Policy{{
-					Rules: []*sourcepolicypb.Rule{
-						{
-							Action: sourcepolicypb.PolicyAction_DENY,
-							Selector: &sourcepolicypb.Selector{
-								Identifier: denied,
+
+			_, err = c.Build(sb.Context(), SolveOpt{}, "", frontend, nil)
+			require.ErrorContains(t, err, sourcepolicy.ErrSourceDenied.Error())
+		})
+		t.Run("resolve image config", func(t *testing.T) {
+			frontend := func(ctx context.Context, c gateway.Client) (*gateway.Result, error) {
+				const (
+					origRef    = "docker.io/library/busybox:1.34.1-uclibc"
+					updatedRef = "docker.io/library/busybox:latest"
+				)
+				pol := []*sourcepolicypb.Policy{
+					{
+						Rules: []*sourcepolicypb.Rule{
+							{
+								Action: sourcepolicypb.PolicyAction_DENY,
+								Selector: &sourcepolicypb.Selector{
+									Identifier: "*",
+								},
+							},
+							{
+								Action: sourcepolicypb.PolicyAction_ALLOW,
+								Selector: &sourcepolicypb.Selector{
+									Identifier: "docker-image://" + updatedRef + "*",
+								},
+							},
+							{
+								Action: sourcepolicypb.PolicyAction_CONVERT,
+								Selector: &sourcepolicypb.Selector{
+									Identifier: "docker-image://" + origRef,
+								},
+								Updates: &sourcepolicypb.Update{
+									Identifier: "docker-image://" + updatedRef,
+								},
 							},
 						},
 					},
-				}},
-			})
-		}
+				}
 
-		_, err = c.Build(sb.Context(), SolveOpt{}, "", frontend, nil)
-		require.ErrorContains(t, err, sourcepolicy.ErrSourceDenied.Error())
+				ref, dgst, _, err := c.ResolveImageConfig(ctx, origRef, llb.ResolveImageConfigOpt{
+					SourcePolicies: pol,
+				})
+				if err != nil {
+					return nil, err
+				}
+				require.Equal(t, updatedRef, ref)
+				st := llb.Image(ref + "@" + dgst.String())
+				def, err := st.Marshal(sb.Context())
+				if err != nil {
+					return nil, err
+				}
+				return c.Solve(ctx, gateway.SolveRequest{
+					Definition:     def.ToPB(),
+					SourcePolicies: pol,
+				})
+			}
+			_, err = c.Build(sb.Context(), SolveOpt{}, "", frontend, nil)
+			require.NoError(t, err)
+		})
 	})
 }
 
diff --git a/client/llb/imagemetaresolver/resolver.go b/client/llb/imagemetaresolver/resolver.go
index 7ce893c79143..8a3a62995493 100644
--- a/client/llb/imagemetaresolver/resolver.go
+++ b/client/llb/imagemetaresolver/resolver.go
@@ -70,11 +70,12 @@ type imageMetaResolver struct {
 }
 
 type resolveResult struct {
+	ref    string
 	config []byte
 	dgst   digest.Digest
 }
 
-func (imr *imageMetaResolver) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (digest.Digest, []byte, error) {
+func (imr *imageMetaResolver) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (string, digest.Digest, []byte, error) {
 	imr.locker.Lock(ref)
 	defer imr.locker.Unlock(ref)
 
@@ -86,16 +87,16 @@ func (imr *imageMetaResolver) ResolveImageConfig(ctx context.Context, ref string
 	k := imr.key(ref, platform)
 
 	if res, ok := imr.cache[k]; ok {
-		return res.dgst, res.config, nil
+		return res.ref, res.dgst, res.config, nil
 	}
 
-	dgst, config, err := imageutil.Config(ctx, ref, imr.resolver, imr.buffer, nil, platform)
+	ref, dgst, config, err := imageutil.Config(ctx, ref, imr.resolver, imr.buffer, nil, platform, opt.SourcePolicies)
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
-	imr.cache[k] = resolveResult{dgst: dgst, config: config}
-	return dgst, config, nil
+	imr.cache[k] = resolveResult{dgst: dgst, config: config, ref: ref}
+	return ref, dgst, config, nil
 }
 
 func (imr *imageMetaResolver) key(ref string, platform *ocispecs.Platform) string {
diff --git a/client/llb/resolver.go b/client/llb/resolver.go
index b3b9cdf751c7..02644f62c78b 100644
--- a/client/llb/resolver.go
+++ b/client/llb/resolver.go
@@ -3,6 +3,7 @@ package llb
 import (
 	"context"
 
+	spb "github.com/moby/buildkit/sourcepolicy/pb"
 	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go/v1"
 )
@@ -31,7 +32,7 @@ func WithLayerLimit(l int) ImageOption {
 
 // ImageMetaResolver can resolve image config metadata from a reference
 type ImageMetaResolver interface {
-	ResolveImageConfig(ctx context.Context, ref string, opt ResolveImageConfigOpt) (digest.Digest, []byte, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt ResolveImageConfigOpt) (string, digest.Digest, []byte, error)
 }
 
 type ResolverType int
@@ -49,6 +50,8 @@ type ResolveImageConfigOpt struct {
 	LogName     string
 
 	Store ResolveImageConfigOptStore
+
+	SourcePolicies []*spb.Policy
 }
 
 type ResolveImageConfigOptStore struct {
diff --git a/client/llb/resolver_test.go b/client/llb/resolver_test.go
index 9771ce1aaf6d..49aaf177b99d 100644
--- a/client/llb/resolver_test.go
+++ b/client/llb/resolver_test.go
@@ -74,7 +74,7 @@ type testResolver struct {
 	platform string
 }
 
-func (r *testResolver) ResolveImageConfig(ctx context.Context, ref string, opt ResolveImageConfigOpt) (digest.Digest, []byte, error) {
+func (r *testResolver) ResolveImageConfig(ctx context.Context, ref string, opt ResolveImageConfigOpt) (string, digest.Digest, []byte, error) {
 	var img struct {
 		Config struct {
 			Env        []string `json:"Env,omitempty"`
@@ -92,7 +92,7 @@ func (r *testResolver) ResolveImageConfig(ctx context.Context, ref string, opt R
 
 	dt, err := json.Marshal(img)
 	if err != nil {
-		return "", nil, errors.WithStack(err)
+		return "", "", nil, errors.WithStack(err)
 	}
-	return r.digest, dt, nil
+	return ref, r.digest, dt, nil
 }
diff --git a/client/llb/source.go b/client/llb/source.go
index 107afbdac497..fa1096a67c23 100644
--- a/client/llb/source.go
+++ b/client/llb/source.go
@@ -135,7 +135,7 @@ func Image(ref string, opts ...ImageOption) State {
 				if p == nil {
 					p = c.Platform
 				}
-				_, dt, err := info.metaResolver.ResolveImageConfig(ctx, ref, ResolveImageConfigOpt{
+				_, _, dt, err := info.metaResolver.ResolveImageConfig(ctx, ref, ResolveImageConfigOpt{
 					Platform:     p,
 					ResolveMode:  info.resolveMode.String(),
 					ResolverType: ResolverTypeRegistry,
@@ -151,7 +151,7 @@ func Image(ref string, opts ...ImageOption) State {
 			if p == nil {
 				p = c.Platform
 			}
-			dgst, dt, err := info.metaResolver.ResolveImageConfig(context.TODO(), ref, ResolveImageConfigOpt{
+			ref, dgst, dt, err := info.metaResolver.ResolveImageConfig(context.TODO(), ref, ResolveImageConfigOpt{
 				Platform:     p,
 				ResolveMode:  info.resolveMode.String(),
 				ResolverType: ResolverTypeRegistry,
@@ -159,6 +159,10 @@ func Image(ref string, opts ...ImageOption) State {
 			if err != nil {
 				return State{}, err
 			}
+			r, err := reference.ParseNormalizedNamed(ref)
+			if err != nil {
+				return State{}, err
+			}
 			if dgst != "" {
 				r, err = reference.WithDigest(r, dgst)
 				if err != nil {
diff --git a/frontend/attestations/sbom/sbom.go b/frontend/attestations/sbom/sbom.go
index 118289a234ba..c52229c2843c 100644
--- a/frontend/attestations/sbom/sbom.go
+++ b/frontend/attestations/sbom/sbom.go
@@ -38,7 +38,7 @@ func CreateSBOMScanner(ctx context.Context, resolver llb.ImageMetaResolver, scan
 		return nil, nil
 	}
 
-	_, dt, err := resolver.ResolveImageConfig(ctx, scanner, resolveOpt)
+	scanner, _, dt, err := resolver.ResolveImageConfig(ctx, scanner, resolveOpt)
 	if err != nil {
 		return nil, err
 	}
diff --git a/frontend/dockerfile/dockerfile2llb/convert.go b/frontend/dockerfile/dockerfile2llb/convert.go
index c6ce89585ea5..26996c81df71 100644
--- a/frontend/dockerfile/dockerfile2llb/convert.go
+++ b/frontend/dockerfile/dockerfile2llb/convert.go
@@ -401,15 +401,23 @@ func toDispatchState(ctx context.Context, dt []byte, opt ConvertOpt) (*dispatchS
 							prefix += platforms.Format(*platform) + " "
 						}
 						prefix += "internal]"
-						dgst, dt, err := metaResolver.ResolveImageConfig(ctx, d.stage.BaseName, llb.ResolveImageConfigOpt{
-							Platform:     platform,
-							ResolveMode:  opt.ImageResolveMode.String(),
-							LogName:      fmt.Sprintf("%s load metadata for %s", prefix, d.stage.BaseName),
-							ResolverType: llb.ResolverTypeRegistry,
+						mutRef, dgst, dt, err := metaResolver.ResolveImageConfig(ctx, d.stage.BaseName, llb.ResolveImageConfigOpt{
+							Platform:       platform,
+							ResolveMode:    opt.ImageResolveMode.String(),
+							LogName:        fmt.Sprintf("%s load metadata for %s", prefix, d.stage.BaseName),
+							ResolverType:   llb.ResolverTypeRegistry,
+							SourcePolicies: nil,
 						})
 						if err != nil {
 							return suggest.WrapError(errors.Wrap(err, origName), origName, append(allStageNames, commonImageNames()...), true)
 						}
+
+						if ref.String() != mutRef {
+							ref, err = reference.ParseNormalizedNamed(mutRef)
+							if err != nil {
+								return errors.Wrapf(err, "failed to parse ref %q", mutRef)
+							}
+						}
 						var img image.Image
 						if err := json.Unmarshal(dt, &img); err != nil {
 							return errors.Wrap(err, "failed to parse image config")
diff --git a/frontend/dockerui/namedcontext.go b/frontend/dockerui/namedcontext.go
index 64fc6cacccc2..6a441c50822e 100644
--- a/frontend/dockerui/namedcontext.go
+++ b/frontend/dockerui/namedcontext.go
@@ -13,25 +13,36 @@ import (
 	"github.com/moby/buildkit/exporter/containerimage/image"
 	"github.com/moby/buildkit/frontend/dockerfile/dockerignore"
 	"github.com/moby/buildkit/frontend/gateway/client"
+	"github.com/moby/buildkit/util/imageutil"
 	"github.com/pkg/errors"
 )
 
 const (
 	contextPrefix       = "context:"
 	inputMetadataPrefix = "input-metadata:"
+	maxContextRecursion = 10
 )
 
 func (bc *Client) namedContext(ctx context.Context, name string, nameWithPlatform string, opt ContextOpt) (*llb.State, *image.Image, error) {
+	return bc.namedContextRecursive(ctx, name, nameWithPlatform, opt, 0)
+}
+
+func (bc *Client) namedContextRecursive(ctx context.Context, name string, nameWithPlatform string, opt ContextOpt, count int) (*llb.State, *image.Image, error) {
 	opts := bc.bopts.Opts
 	v, ok := opts[contextPrefix+nameWithPlatform]
 	if !ok {
 		return nil, nil, nil
 	}
 
+	if count > maxContextRecursion {
+		return nil, nil, errors.New("context recursion limit exceeded; this may indicate a cycle in the provided source policies: " + v)
+	}
+
 	vv := strings.SplitN(v, ":", 2)
 	if len(vv) != 2 {
 		return nil, nil, errors.Errorf("invalid context specifier %s for %s", v, nameWithPlatform)
 	}
+
 	// allow git@ without protocol for SSH URLs for backwards compatibility
 	if strings.HasPrefix(vv[0], "git@") {
 		vv[0] = "git"
@@ -58,15 +69,20 @@ func (bc *Client) namedContext(ctx context.Context, name string, nameWithPlatfor
 
 		named = reference.TagNameOnly(named)
 
-		dgst, data, err := bc.client.ResolveImageConfig(ctx, named.String(), llb.ResolveImageConfigOpt{
+		ref, dgst, data, err := bc.client.ResolveImageConfig(ctx, named.String(), llb.ResolveImageConfigOpt{
 			Platform:     opt.Platform,
 			ResolveMode:  opt.ResolveMode,
 			LogName:      fmt.Sprintf("[context %s] load metadata for %s", nameWithPlatform, ref),
 			ResolverType: llb.ResolverTypeRegistry,
 		})
 		if err != nil {
+			e := &imageutil.ResolveToNonImageError{}
+			if errors.As(err, &e) {
+				return bc.namedContextRecursive(ctx, e.Updated, name, opt, count+1)
+			}
 			return nil, nil, err
 		}
+
 		var img image.Image
 		if err := json.Unmarshal(data, &img); err != nil {
 			return nil, nil, err
@@ -121,7 +137,8 @@ func (bc *Client) namedContext(ctx context.Context, name string, nameWithPlatfor
 			return nil, nil, errors.Wrapf(err, "could not wrap %q with digest", name)
 		}
 
-		dgst, data, err := bc.client.ResolveImageConfig(ctx, dummyRef.String(), llb.ResolveImageConfigOpt{
+		// TODO: How should source policy be handled here with a dummy ref?
+		_, dgst, data, err := bc.client.ResolveImageConfig(ctx, dummyRef.String(), llb.ResolveImageConfigOpt{
 			Platform:     opt.Platform,
 			ResolveMode:  opt.ResolveMode,
 			LogName:      fmt.Sprintf("[context %s] load metadata for %s", nameWithPlatform, dummyRef.String()),
diff --git a/frontend/frontend.go b/frontend/frontend.go
index 024ac802045c..fb89a8414afa 100644
--- a/frontend/frontend.go
+++ b/frontend/frontend.go
@@ -22,7 +22,7 @@ type Frontend interface {
 
 type FrontendLLBBridge interface {
 	Solve(ctx context.Context, req SolveRequest, sid string) (*Result, error)
-	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (digest.Digest, []byte, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (string, digest.Digest, []byte, error)
 	Warn(ctx context.Context, dgst digest.Digest, msg string, opts WarnOpts) error
 }
 
diff --git a/frontend/gateway/client/client.go b/frontend/gateway/client/client.go
index 005d2134ba7d..23585de9078e 100644
--- a/frontend/gateway/client/client.go
+++ b/frontend/gateway/client/client.go
@@ -27,7 +27,7 @@ func NewResult() *Result {
 
 type Client interface {
 	Solve(ctx context.Context, req SolveRequest) (*Result, error)
-	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (digest.Digest, []byte, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (string, digest.Digest, []byte, error)
 	BuildOpts() BuildOpts
 	Inputs(ctx context.Context) (map[string]llb.State, error)
 	NewContainer(ctx context.Context, req NewContainerRequest) (Container, error)
diff --git a/frontend/gateway/gateway.go b/frontend/gateway/gateway.go
index db4b1db82fb5..eb1fb2a2b05e 100644
--- a/frontend/gateway/gateway.go
+++ b/frontend/gateway/gateway.go
@@ -164,10 +164,16 @@ func (gf *gatewayFrontend) Solve(ctx context.Context, llbBridge frontend.Fronten
 				return nil, err
 			}
 
-			dgst, config, err := llbBridge.ResolveImageConfig(ctx, reference.TagNameOnly(sourceRef).String(), llb.ResolveImageConfigOpt{})
+			ref, dgst, config, err := llbBridge.ResolveImageConfig(ctx, reference.TagNameOnly(sourceRef).String(), llb.ResolveImageConfigOpt{})
 			if err != nil {
 				return nil, err
 			}
+
+			sourceRef, err = reference.ParseNormalizedNamed(ref)
+			if err != nil {
+				return nil, err
+			}
+
 			mfstDigest = dgst
 
 			if err := json.Unmarshal(config, &img); err != nil {
@@ -563,7 +569,7 @@ func (lbf *llbBridgeForwarder) ResolveImageConfig(ctx context.Context, req *pb.R
 			OSFeatures:   p.OSFeatures,
 		}
 	}
-	dgst, dt, err := lbf.llbBridge.ResolveImageConfig(ctx, req.Ref, llb.ResolveImageConfigOpt{
+	ref, dgst, dt, err := lbf.llbBridge.ResolveImageConfig(ctx, req.Ref, llb.ResolveImageConfigOpt{
 		ResolverType: llb.ResolverType(req.ResolverType),
 		Platform:     platform,
 		ResolveMode:  req.ResolveMode,
@@ -572,11 +578,13 @@ func (lbf *llbBridgeForwarder) ResolveImageConfig(ctx context.Context, req *pb.R
 			SessionID: req.SessionID,
 			StoreID:   req.StoreID,
 		},
+		SourcePolicies: req.SourcePolicies,
 	})
 	if err != nil {
 		return nil, err
 	}
 	return &pb.ResolveImageConfigResponse{
+		Ref:    ref,
 		Digest: dgst,
 		Config: dt,
 	}, nil
diff --git a/frontend/gateway/grpcclient/client.go b/frontend/gateway/grpcclient/client.go
index b13002b03f58..524b3ba2a966 100644
--- a/frontend/gateway/grpcclient/client.go
+++ b/frontend/gateway/grpcclient/client.go
@@ -478,7 +478,7 @@ func (c *grpcClient) Solve(ctx context.Context, creq client.SolveRequest) (res *
 	return res, nil
 }
 
-func (c *grpcClient) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (digest.Digest, []byte, error) {
+func (c *grpcClient) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (string, digest.Digest, []byte, error) {
 	var p *opspb.Platform
 	if platform := opt.Platform; platform != nil {
 		p = &opspb.Platform{
@@ -489,19 +489,27 @@ func (c *grpcClient) ResolveImageConfig(ctx context.Context, ref string, opt llb
 			OSFeatures:   platform.OSFeatures,
 		}
 	}
+
 	resp, err := c.client.ResolveImageConfig(ctx, &pb.ResolveImageConfigRequest{
-		ResolverType: int32(opt.ResolverType),
-		Ref:          ref,
-		Platform:     p,
-		ResolveMode:  opt.ResolveMode,
-		LogName:      opt.LogName,
-		SessionID:    opt.Store.SessionID,
-		StoreID:      opt.Store.StoreID,
+		ResolverType:   int32(opt.ResolverType),
+		Ref:            ref,
+		Platform:       p,
+		ResolveMode:    opt.ResolveMode,
+		LogName:        opt.LogName,
+		SessionID:      opt.Store.SessionID,
+		StoreID:        opt.Store.StoreID,
+		SourcePolicies: opt.SourcePolicies,
 	})
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
+	}
+	newRef := resp.Ref
+	if newRef == "" {
+		// No ref returned, use the original one.
+		// This could occur if the version of buildkitd is too old.
+		newRef = ref
 	}
-	return resp.Digest, resp.Config, nil
+	return newRef, resp.Digest, resp.Config, nil
 }
 
 func (c *grpcClient) BuildOpts() client.BuildOpts {
diff --git a/frontend/gateway/pb/gateway.pb.go b/frontend/gateway/pb/gateway.pb.go
index a660e101a79e..4849adeea9d3 100644
--- a/frontend/gateway/pb/gateway.pb.go
+++ b/frontend/gateway/pb/gateway.pb.go
@@ -736,16 +736,17 @@ func (m *InputsResponse) GetDefinitions() map[string]*pb.Definition {
 }
 
 type ResolveImageConfigRequest struct {
-	Ref                  string       `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
-	Platform             *pb.Platform `protobuf:"bytes,2,opt,name=Platform,proto3" json:"Platform,omitempty"`
-	ResolveMode          string       `protobuf:"bytes,3,opt,name=ResolveMode,proto3" json:"ResolveMode,omitempty"`
-	LogName              string       `protobuf:"bytes,4,opt,name=LogName,proto3" json:"LogName,omitempty"`
-	ResolverType         int32        `protobuf:"varint,5,opt,name=ResolverType,proto3" json:"ResolverType,omitempty"`
-	SessionID            string       `protobuf:"bytes,6,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
-	StoreID              string       `protobuf:"bytes,7,opt,name=StoreID,proto3" json:"StoreID,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}     `json:"-"`
-	XXX_unrecognized     []byte       `json:"-"`
-	XXX_sizecache        int32        `json:"-"`
+	Ref                  string        `protobuf:"bytes,1,opt,name=Ref,proto3" json:"Ref,omitempty"`
+	Platform             *pb.Platform  `protobuf:"bytes,2,opt,name=Platform,proto3" json:"Platform,omitempty"`
+	ResolveMode          string        `protobuf:"bytes,3,opt,name=ResolveMode,proto3" json:"ResolveMode,omitempty"`
+	LogName              string        `protobuf:"bytes,4,opt,name=LogName,proto3" json:"LogName,omitempty"`
+	ResolverType         int32         `protobuf:"varint,5,opt,name=ResolverType,proto3" json:"ResolverType,omitempty"`
+	SessionID            string        `protobuf:"bytes,6,opt,name=SessionID,proto3" json:"SessionID,omitempty"`
+	StoreID              string        `protobuf:"bytes,7,opt,name=StoreID,proto3" json:"StoreID,omitempty"`
+	SourcePolicies       []*pb1.Policy `protobuf:"bytes,8,rep,name=SourcePolicies,proto3" json:"SourcePolicies,omitempty"`
+	XXX_NoUnkeyedLiteral struct{}      `json:"-"`
+	XXX_unrecognized     []byte        `json:"-"`
+	XXX_sizecache        int32         `json:"-"`
 }
 
 func (m *ResolveImageConfigRequest) Reset()         { *m = ResolveImageConfigRequest{} }
@@ -830,9 +831,17 @@ func (m *ResolveImageConfigRequest) GetStoreID() string {
 	return ""
 }
 
+func (m *ResolveImageConfigRequest) GetSourcePolicies() []*pb1.Policy {
+	if m != nil {
+		return m.SourcePolicies
+	}
+	return nil
+}
+
 type ResolveImageConfigResponse struct {
 	Digest               github_com_opencontainers_go_digest.Digest `protobuf:"bytes,1,opt,name=Digest,proto3,customtype=github.com/opencontainers/go-digest.Digest" json:"Digest"`
 	Config               []byte                                     `protobuf:"bytes,2,opt,name=Config,proto3" json:"Config,omitempty"`
+	Ref                  string                                     `protobuf:"bytes,3,opt,name=Ref,proto3" json:"Ref,omitempty"`
 	XXX_NoUnkeyedLiteral struct{}                                   `json:"-"`
 	XXX_unrecognized     []byte                                     `json:"-"`
 	XXX_sizecache        int32                                      `json:"-"`
@@ -878,6 +887,13 @@ func (m *ResolveImageConfigResponse) GetConfig() []byte {
 	return nil
 }
 
+func (m *ResolveImageConfigResponse) GetRef() string {
+	if m != nil {
+		return m.Ref
+	}
+	return ""
+}
+
 type SolveRequest struct {
 	Definition  *pb.Definition    `protobuf:"bytes,1,opt,name=Definition,proto3" json:"Definition,omitempty"`
 	Frontend    string            `protobuf:"bytes,2,opt,name=Frontend,proto3" json:"Frontend,omitempty"`
@@ -2643,163 +2659,164 @@ func init() {
 func init() { proto.RegisterFile("gateway.proto", fileDescriptor_f1a937782ebbded5) }
 
 var fileDescriptor_f1a937782ebbded5 = []byte{
-	// 2485 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x59, 0x4b, 0x6f, 0x1b, 0xc9,
-	0xf1, 0xd7, 0x88, 0x14, 0x25, 0x16, 0x1f, 0xa2, 0x7b, 0xbd, 0xfb, 0xa7, 0x07, 0x0b, 0xaf, 0x3c,
-	0x5e, 0x6b, 0x65, 0xd9, 0x4b, 0xfa, 0x2f, 0xdb, 0x90, 0x63, 0x27, 0xde, 0xb5, 0x5e, 0x90, 0xd6,
-	0x92, 0xcd, 0xb4, 0x1c, 0x38, 0x58, 0x6c, 0x80, 0x8c, 0xc8, 0x26, 0x35, 0xf1, 0x68, 0x66, 0xd2,
-	0xd3, 0x94, 0xac, 0xdd, 0x4b, 0x72, 0x08, 0x10, 0xec, 0x07, 0xc8, 0x6d, 0x2f, 0x09, 0x90, 0x53,
-	0x0e, 0xc9, 0x07, 0x48, 0xce, 0x0b, 0x24, 0x87, 0x9c, 0x73, 0x58, 0x04, 0xfe, 0x02, 0xb9, 0x05,
-	0xc8, 0x2d, 0xa8, 0xee, 0x1e, 0xb2, 0xf9, 0xd0, 0x88, 0x8a, 0x4f, 0xec, 0xae, 0xae, 0x47, 0x57,
-	0x55, 0x57, 0xf5, 0xaf, 0x87, 0x50, 0xea, 0xb8, 0x82, 0x9d, 0xb8, 0xa7, 0xb5, 0x88, 0x87, 0x22,
-	0x24, 0x57, 0x8e, 0xc2, 0x83, 0xd3, 0xda, 0x41, 0xd7, 0xf3, 0x5b, 0xaf, 0x3c, 0x51, 0x3b, 0xfe,
-	0xff, 0x5a, 0x9b, 0x87, 0x81, 0x60, 0x41, 0xcb, 0xfe, 0xb8, 0xe3, 0x89, 0xc3, 0xee, 0x41, 0xad,
-	0x19, 0x1e, 0xd5, 0x3b, 0x61, 0x27, 0xac, 0x4b, 0x89, 0x83, 0x6e, 0x5b, 0xce, 0xe4, 0x44, 0x8e,
-	0x94, 0x26, 0x7b, 0x65, 0x98, 0xbd, 0x13, 0x86, 0x1d, 0x9f, 0xb9, 0x91, 0x17, 0xeb, 0x61, 0x9d,
-	0x47, 0xcd, 0x7a, 0x2c, 0x5c, 0xd1, 0x8d, 0xb5, 0xcc, 0x6d, 0x43, 0x06, 0x37, 0x52, 0x4f, 0x36,
-	0x52, 0x8f, 0x43, 0xff, 0x98, 0xf1, 0x7a, 0x74, 0x50, 0x0f, 0xa3, 0x84, 0xbb, 0x7e, 0x26, 0xb7,
-	0x1b, 0x79, 0x75, 0x71, 0x1a, 0xb1, 0xb8, 0x7e, 0x12, 0xf2, 0x57, 0x8c, 0x6b, 0x81, 0xbb, 0x67,
-	0x0a, 0x74, 0x85, 0xe7, 0xa3, 0x54, 0xd3, 0x8d, 0x62, 0x34, 0x82, 0xbf, 0x5a, 0xc8, 0x74, 0x5b,
-	0x84, 0x81, 0x17, 0x0b, 0xcf, 0xeb, 0x78, 0xf5, 0x76, 0x2c, 0x65, 0x94, 0x15, 0x74, 0x42, 0xb3,
-	0xdf, 0x4f, 0x71, 0xa1, 0xcb, 0x9b, 0x2c, 0x0a, 0x7d, 0xaf, 0x79, 0x8a, 0x36, 0xd4, 0x48, 0x89,
-	0x39, 0x7f, 0xcd, 0x42, 0x8e, 0xb2, 0xb8, 0xeb, 0x0b, 0xb2, 0x08, 0x25, 0xce, 0xda, 0x1b, 0x2c,
-	0xe2, 0xac, 0xe9, 0x0a, 0xd6, 0xaa, 0x5a, 0x0b, 0xd6, 0x52, 0x7e, 0x7b, 0x8a, 0x0e, 0x92, 0xc9,
-	0x8f, 0xa0, 0xcc, 0x59, 0x3b, 0x36, 0x18, 0xa7, 0x17, 0xac, 0xa5, 0xc2, 0xca, 0xad, 0xda, 0x99,
-	0x39, 0xac, 0x51, 0xd6, 0xde, 0x73, 0xa3, 0xbe, 0xc8, 0xf6, 0x14, 0x1d, 0x52, 0x42, 0x56, 0x20,
-	0xc3, 0x59, 0xbb, 0x9a, 0x91, 0xba, 0xae, 0xa6, 0xeb, 0xda, 0x9e, 0xa2, 0xc8, 0x4c, 0x56, 0x21,
-	0x8b, 0x5a, 0xaa, 0x59, 0x29, 0x74, 0xed, 0xdc, 0x0d, 0x6c, 0x4f, 0x51, 0x29, 0x40, 0x9e, 0xc2,
-	0xdc, 0x11, 0x13, 0x6e, 0xcb, 0x15, 0x6e, 0x15, 0x16, 0x32, 0x4b, 0x85, 0x95, 0x7a, 0xaa, 0x30,
-	0x06, 0xa8, 0xb6, 0xa7, 0x25, 0x36, 0x03, 0xc1, 0x4f, 0x69, 0x4f, 0x01, 0x79, 0x09, 0x45, 0x57,
-	0x08, 0x86, 0xc9, 0xf0, 0xc2, 0x20, 0xae, 0x16, 0xa5, 0xc2, 0xbb, 0xe7, 0x2b, 0x7c, 0x62, 0x48,
-	0x29, 0xa5, 0x03, 0x8a, 0xec, 0x47, 0x50, 0x1a, 0xb0, 0x49, 0x2a, 0x90, 0x79, 0xc5, 0x4e, 0x55,
-	0x62, 0x28, 0x0e, 0xc9, 0x65, 0x98, 0x39, 0x76, 0xfd, 0x2e, 0x93, 0x39, 0x28, 0x52, 0x35, 0x79,
-	0x38, 0xfd, 0xc0, 0xb2, 0x0f, 0xe1, 0xd2, 0x88, 0xfe, 0x31, 0x0a, 0x7e, 0x60, 0x2a, 0x28, 0xac,
-	0x7c, 0x94, 0xb2, 0x6b, 0x53, 0x9d, 0x61, 0x69, 0x6d, 0x0e, 0x72, 0x5c, 0x3a, 0xe4, 0xfc, 0xc6,
-	0x82, 0xca, 0x70, 0xaa, 0xc9, 0x8e, 0x4e, 0x92, 0x25, 0xc3, 0x72, 0xff, 0x02, 0xa7, 0x04, 0x09,
-	0x3a, 0x30, 0x52, 0x85, 0xbd, 0x0a, 0xf9, 0x1e, 0xe9, 0xbc, 0x60, 0xe4, 0x8d, 0x2d, 0x3a, 0xab,
-	0x90, 0xa1, 0xac, 0x4d, 0xca, 0x30, 0xed, 0xe9, 0x73, 0x4d, 0xa7, 0xbd, 0x16, 0x59, 0x80, 0x4c,
-	0x8b, 0xb5, 0xb5, 0xeb, 0xe5, 0x5a, 0x74, 0x50, 0xdb, 0x60, 0x6d, 0x2f, 0xf0, 0xd0, 0x45, 0x8a,
-	0x4b, 0xce, 0x6f, 0x2d, 0xac, 0x0f, 0xdc, 0x16, 0xf9, 0x64, 0xc0, 0x8f, 0xf3, 0x4f, 0xfb, 0xc8,
-	0xee, 0x5f, 0xa6, 0xef, 0xfe, 0xde, 0x60, 0x26, 0xce, 0x29, 0x01, 0xd3, 0xbb, 0x1f, 0x43, 0xd1,
-	0xcc, 0x0d, 0xd9, 0x86, 0x82, 0x71, 0x8e, 0xf4, 0x86, 0x17, 0x27, 0xcb, 0x2c, 0x35, 0x45, 0x9d,
-	0xdf, 0x67, 0xa0, 0x60, 0x2c, 0x92, 0xc7, 0x90, 0x7d, 0xe5, 0x05, 0x2a, 0x84, 0xe5, 0x95, 0xe5,
-	0xc9, 0x54, 0x3e, 0xf5, 0x82, 0x16, 0x95, 0x72, 0xa4, 0x61, 0xd4, 0xdd, 0xb4, 0xdc, 0xd6, 0xbd,
-	0xc9, 0x74, 0x9c, 0x59, 0x7c, 0x77, 0x2e, 0xd0, 0x36, 0x54, 0xd3, 0x20, 0x90, 0x8d, 0x5c, 0x71,
-	0x28, 0x9b, 0x46, 0x9e, 0xca, 0x31, 0xb9, 0x03, 0xef, 0x78, 0xc1, 0x8b, 0x50, 0x84, 0x0d, 0xce,
-	0x5a, 0x1e, 0x1e, 0xbe, 0x17, 0xa7, 0x11, 0xab, 0xce, 0x48, 0x96, 0x71, 0x4b, 0xa4, 0x01, 0x65,
-	0x45, 0xde, 0xef, 0x1e, 0xfc, 0x8c, 0x35, 0x45, 0x5c, 0xcd, 0x49, 0x7f, 0x96, 0x52, 0xb6, 0xb0,
-	0x63, 0x0a, 0xd0, 0x21, 0xf9, 0xb7, 0xaa, 0x76, 0xe7, 0x4f, 0x16, 0x94, 0x06, 0xd4, 0x93, 0x4f,
-	0x07, 0x52, 0x75, 0x7b, 0xd2, 0x6d, 0x19, 0xc9, 0xfa, 0x0c, 0x72, 0x2d, 0xaf, 0xc3, 0x62, 0x21,
-	0x53, 0x95, 0x5f, 0x5b, 0xf9, 0xf6, 0xbb, 0x0f, 0xa6, 0xfe, 0xf1, 0xdd, 0x07, 0xcb, 0xc6, 0x55,
-	0x13, 0x46, 0x2c, 0x68, 0x86, 0x81, 0x70, 0xbd, 0x80, 0x71, 0xbc, 0x60, 0x3f, 0x56, 0x22, 0xb5,
-	0x0d, 0xf9, 0x43, 0xb5, 0x06, 0x0c, 0x7a, 0xe0, 0x1e, 0x31, 0x99, 0xa7, 0x3c, 0x95, 0x63, 0x47,
-	0x40, 0x89, 0x32, 0xd1, 0xe5, 0x01, 0x65, 0x3f, 0xef, 0x22, 0xd3, 0xf7, 0x92, 0x46, 0x22, 0x37,
-	0x7d, 0x5e, 0x43, 0x47, 0x46, 0xaa, 0x05, 0xc8, 0x12, 0xcc, 0x30, 0xce, 0x43, 0xae, 0x8b, 0x87,
-	0xd4, 0xd4, 0x55, 0x5f, 0xe3, 0x51, 0xb3, 0xb6, 0x2f, 0xaf, 0x7a, 0xaa, 0x18, 0x9c, 0x0a, 0x94,
-	0x13, 0xab, 0x71, 0x14, 0x06, 0x31, 0x73, 0xe6, 0x31, 0x74, 0x51, 0x57, 0xc4, 0x7a, 0x1f, 0xce,
-	0x5f, 0x2c, 0x28, 0x27, 0x14, 0xc5, 0x43, 0xbe, 0x80, 0x42, 0xbf, 0x35, 0x24, 0x3d, 0xe0, 0x61,
-	0x6a, 0x50, 0x4d, 0x79, 0xa3, 0xaf, 0xe8, 0x96, 0x60, 0xaa, 0xb3, 0x9f, 0x41, 0x65, 0x98, 0x61,
-	0x4c, 0xf6, 0x3f, 0x1c, 0x6c, 0x10, 0xc3, 0xfd, 0xca, 0x38, 0x0d, 0xff, 0xb2, 0xe0, 0x0a, 0x65,
-	0x12, 0xbb, 0xec, 0x1c, 0xb9, 0x1d, 0xb6, 0x1e, 0x06, 0x6d, 0xaf, 0x93, 0x84, 0xb9, 0x22, 0x9b,
-	0x61, 0xa2, 0x19, 0xfb, 0xe2, 0x12, 0xcc, 0x35, 0x7c, 0x57, 0xb4, 0x43, 0x7e, 0xa4, 0x95, 0x17,
-	0x51, 0x79, 0x42, 0xa3, 0xbd, 0x55, 0xb2, 0x00, 0x05, 0xad, 0x78, 0x2f, 0x6c, 0x25, 0xe9, 0x34,
-	0x49, 0xa4, 0x0a, 0xb3, 0xbb, 0x61, 0xe7, 0x19, 0x26, 0x5b, 0x55, 0x58, 0x32, 0x25, 0x0e, 0x14,
-	0x35, 0x23, 0xef, 0x55, 0xd7, 0x0c, 0x1d, 0xa0, 0x91, 0xf7, 0x21, 0xbf, 0xcf, 0xe2, 0xd8, 0x0b,
-	0x83, 0x9d, 0x8d, 0x6a, 0x4e, 0xca, 0xf7, 0x09, 0xa8, 0x7b, 0x5f, 0x84, 0x9c, 0xed, 0x6c, 0x54,
-	0x67, 0x95, 0x6e, 0x3d, 0x75, 0x7e, 0x61, 0x81, 0x3d, 0xce, 0x63, 0x9d, 0xbe, 0xcf, 0x20, 0xa7,
-	0x0e, 0xa4, 0xf2, 0xfa, 0x7f, 0x3b, 0xca, 0xea, 0x97, 0xbc, 0x07, 0x39, 0xa5, 0x5d, 0x57, 0xa1,
-	0x9e, 0x39, 0xbf, 0xca, 0x41, 0x71, 0x1f, 0x37, 0x90, 0xc4, 0xb9, 0x06, 0xd0, 0x4f, 0x8f, 0x3e,
-	0xd2, 0xc3, 0x49, 0x33, 0x38, 0x88, 0x0d, 0x73, 0x5b, 0xfa, 0xf8, 0xe8, 0x1b, 0xac, 0x37, 0x27,
-	0x9f, 0x43, 0x21, 0x19, 0x3f, 0x8f, 0x44, 0x35, 0x23, 0xcf, 0xdf, 0x83, 0x94, 0xf3, 0x67, 0xee,
-	0xa4, 0x66, 0x88, 0xea, 0xd3, 0x67, 0x50, 0xc8, 0x6d, 0xb8, 0xe4, 0xfa, 0x7e, 0x78, 0xa2, 0x4b,
-	0x4a, 0x16, 0x87, 0x4c, 0xce, 0x1c, 0x1d, 0x5d, 0xc0, 0x56, 0x69, 0x10, 0x9f, 0x70, 0xee, 0x9e,
-	0xe2, 0x69, 0xca, 0x49, 0xfe, 0x71, 0x4b, 0xd8, 0xb5, 0xb6, 0xbc, 0xc0, 0xf5, 0xab, 0x20, 0x79,
-	0xd4, 0x04, 0x4f, 0xc3, 0xe6, 0xeb, 0x28, 0xe4, 0x82, 0xf1, 0x27, 0x42, 0xf0, 0x6a, 0x41, 0x06,
-	0x73, 0x80, 0x46, 0x1a, 0x50, 0x5c, 0x77, 0x9b, 0x87, 0x6c, 0xe7, 0x08, 0x89, 0x09, 0xb2, 0x4a,
-	0xeb, 0x65, 0x92, 0xfd, 0x79, 0x64, 0x42, 0x2a, 0x53, 0x03, 0x69, 0x42, 0x39, 0x71, 0x5d, 0x55,
-	0x68, 0xb5, 0x24, 0x75, 0x3e, 0xba, 0x68, 0x28, 0x95, 0xb4, 0x32, 0x31, 0xa4, 0x12, 0x13, 0xb9,
-	0x89, 0xc5, 0xe8, 0x0a, 0x56, 0x2d, 0x4b, 0x9f, 0x7b, 0x73, 0xb2, 0x07, 0xe5, 0x7d, 0x09, 0xc8,
-	0x1b, 0x08, 0xc3, 0x3d, 0x16, 0x57, 0xe7, 0xe5, 0x06, 0x6e, 0x8c, 0x6e, 0xc0, 0x04, 0xee, 0x35,
-	0xc9, 0x7e, 0x4a, 0x87, 0x84, 0xed, 0xc7, 0x50, 0x19, 0x4e, 0xee, 0x45, 0x80, 0x91, 0xfd, 0x43,
-	0x78, 0x67, 0x8c, 0x47, 0x6f, 0xd5, 0x7c, 0xfe, 0x68, 0xc1, 0xa5, 0x91, 0x34, 0xe0, 0x05, 0x20,
-	0x8b, 0x5e, 0xa9, 0x94, 0x63, 0xb2, 0x07, 0x33, 0x98, 0xe6, 0x58, 0x43, 0x81, 0xd5, 0x8b, 0xe4,
-	0xb5, 0x26, 0x25, 0x55, 0xfc, 0x95, 0x16, 0xfb, 0x01, 0x40, 0x9f, 0x78, 0x21, 0x78, 0xf8, 0x05,
-	0x94, 0x74, 0x92, 0x75, 0xbf, 0xa8, 0x28, 0x54, 0xa1, 0x85, 0x11, 0x35, 0xf4, 0xef, 0xa6, 0xcc,
-	0x05, 0xef, 0x26, 0xe7, 0x2b, 0x98, 0xa7, 0xcc, 0x6d, 0x6d, 0x79, 0x3e, 0x3b, 0xbb, 0x05, 0x63,
-	0xf1, 0x7b, 0x3e, 0x6b, 0x20, 0x32, 0x49, 0x8a, 0x5f, 0xcf, 0xc9, 0x43, 0x98, 0xa1, 0x6e, 0xd0,
-	0x61, 0xda, 0xf4, 0x87, 0x29, 0xa6, 0xa5, 0x11, 0xe4, 0xa5, 0x4a, 0xc4, 0x79, 0x04, 0xf9, 0x1e,
-	0x0d, 0x5b, 0xd7, 0xf3, 0x76, 0x3b, 0x66, 0xaa, 0x0d, 0x66, 0xa8, 0x9e, 0x21, 0x7d, 0x97, 0x05,
-	0x1d, 0x6d, 0x3a, 0x43, 0xf5, 0xcc, 0x59, 0x44, 0x38, 0x9f, 0xec, 0x5c, 0x87, 0x86, 0x40, 0x76,
-	0x03, 0xe1, 0x9b, 0x25, 0xeb, 0x55, 0x8e, 0x9d, 0x16, 0xde, 0xa9, 0x6e, 0x6b, 0xc3, 0xe3, 0x67,
-	0x3b, 0x58, 0x85, 0xd9, 0x0d, 0x8f, 0x1b, 0xfe, 0x25, 0x53, 0xb2, 0x88, 0xb7, 0x6d, 0xd3, 0xef,
-	0xb6, 0xd0, 0x5b, 0xc1, 0x78, 0xa0, 0xaf, 0x95, 0x21, 0xaa, 0xf3, 0x89, 0x8a, 0xa3, 0xb4, 0xa2,
-	0x37, 0x73, 0x1b, 0x66, 0x59, 0x20, 0x38, 0x96, 0x91, 0xba, 0x92, 0x49, 0x4d, 0x3d, 0x90, 0x6b,
-	0xf2, 0x81, 0x2c, 0xaf, 0x7e, 0x9a, 0xb0, 0x38, 0xab, 0x30, 0x8f, 0x84, 0xf4, 0x44, 0x10, 0xc8,
-	0x1a, 0x9b, 0x94, 0x63, 0xe7, 0x21, 0x54, 0xfa, 0x82, 0xda, 0xf4, 0x22, 0x64, 0x11, 0x9b, 0xea,
-	0xbe, 0x3e, 0xce, 0xae, 0x5c, 0x77, 0xae, 0xc3, 0x7c, 0x52, 0xfc, 0x67, 0x1a, 0x75, 0x08, 0x54,
-	0xfa, 0x4c, 0x1a, 0x96, 0x94, 0xa0, 0xd0, 0xf0, 0x82, 0xe4, 0xd6, 0x76, 0xde, 0x58, 0x50, 0x6c,
-	0x84, 0x41, 0xff, 0x4e, 0x6b, 0xc0, 0x7c, 0x52, 0xba, 0x4f, 0x1a, 0x3b, 0xeb, 0x6e, 0x94, 0xc4,
-	0x60, 0x61, 0xf4, 0x7c, 0xe8, 0x4f, 0x0c, 0x35, 0xc5, 0xb8, 0x96, 0xc5, 0xeb, 0x8f, 0x0e, 0x8b,
-	0x93, 0x4f, 0x61, 0x76, 0x77, 0x77, 0x4d, 0x6a, 0x9a, 0xbe, 0x90, 0xa6, 0x44, 0x8c, 0x3c, 0x86,
-	0xd9, 0x97, 0xf2, 0xcb, 0x47, 0xac, 0xaf, 0xa8, 0x31, 0x67, 0x55, 0x45, 0x48, 0xb1, 0x51, 0xd6,
-	0x0c, 0x79, 0x8b, 0x26, 0x42, 0xce, 0xbf, 0x2d, 0x28, 0xbc, 0x74, 0xfb, 0x88, 0xb0, 0x0f, 0x41,
-	0xdf, 0xe2, 0xde, 0xd6, 0x10, 0xf4, 0x32, 0xcc, 0xf8, 0xec, 0x98, 0xf9, 0xfa, 0x8c, 0xab, 0x09,
-	0x52, 0xe3, 0xc3, 0x90, 0xab, 0xb2, 0x2e, 0x52, 0x35, 0xc1, 0x82, 0x68, 0x31, 0xe1, 0x7a, 0x7e,
-	0x35, 0xbb, 0x90, 0xc1, 0x3b, 0x5e, 0xcd, 0x30, 0x73, 0x5d, 0xee, 0xeb, 0x77, 0x01, 0x0e, 0x89,
-	0x03, 0x59, 0x2f, 0x68, 0x87, 0xf2, 0xfe, 0xd3, 0x6d, 0x51, 0xb5, 0xe8, 0x9d, 0xa0, 0x1d, 0x52,
-	0xb9, 0x46, 0xae, 0x41, 0x8e, 0x63, 0xfd, 0xc5, 0xd5, 0x59, 0x19, 0x94, 0x3c, 0x72, 0xa9, 0x2a,
-	0xd5, 0x0b, 0x4e, 0x19, 0x8a, 0xca, 0x6f, 0x9d, 0xfc, 0x3f, 0x4c, 0xc3, 0x3b, 0xcf, 0xd8, 0xc9,
-	0x7a, 0xe2, 0x57, 0x12, 0x90, 0x05, 0x28, 0xf4, 0x68, 0x3b, 0x1b, 0xfa, 0x08, 0x99, 0x24, 0x34,
-	0xb6, 0x17, 0x76, 0x03, 0x91, 0xe4, 0x50, 0x1a, 0x93, 0x14, 0xaa, 0x17, 0xc8, 0x0d, 0x98, 0x7d,
-	0xc6, 0xc4, 0x49, 0xc8, 0x5f, 0x49, 0xaf, 0xcb, 0x2b, 0x05, 0xe4, 0x79, 0xc6, 0x04, 0x02, 0x38,
-	0x9a, 0xac, 0x21, 0x2a, 0x8c, 0x12, 0x54, 0x98, 0x1d, 0x87, 0x0a, 0x93, 0x55, 0xb2, 0x0a, 0x85,
-	0x66, 0x18, 0xc4, 0x82, 0xbb, 0x1e, 0x1a, 0x9e, 0x91, 0xcc, 0xef, 0x22, 0xb3, 0x4a, 0xec, 0x7a,
-	0x7f, 0x91, 0x9a, 0x9c, 0x64, 0x19, 0x80, 0xbd, 0x16, 0xdc, 0xdd, 0x0e, 0xe3, 0xde, 0x0b, 0x0a,
-	0x50, 0x0e, 0x09, 0x3b, 0x0d, 0x6a, 0xac, 0x62, 0x87, 0x3c, 0x0c, 0x63, 0x21, 0x9f, 0x11, 0x0a,
-	0xfd, 0xf5, 0xe6, 0xce, 0x7b, 0x70, 0x79, 0x30, 0x5a, 0x3a, 0x8c, 0x8f, 0xe0, 0xff, 0x28, 0xf3,
-	0x99, 0x1b, 0xb3, 0x8b, 0x47, 0xd2, 0xb1, 0xa1, 0x3a, 0x2a, 0xac, 0x15, 0xff, 0x27, 0x03, 0x85,
-	0xcd, 0xd7, 0xac, 0xb9, 0xc7, 0xe2, 0xd8, 0xed, 0x48, 0xdc, 0xda, 0xe0, 0x61, 0x93, 0xc5, 0x71,
-	0x4f, 0x57, 0x9f, 0x40, 0xbe, 0x0f, 0xd9, 0x9d, 0xc0, 0x13, 0xfa, 0xee, 0x5c, 0x4c, 0x7d, 0x36,
-	0x78, 0x42, 0xeb, 0xdc, 0x9e, 0xa2, 0x52, 0x8a, 0x3c, 0x84, 0x2c, 0x76, 0x9e, 0x49, 0xba, 0x7f,
-	0xcb, 0x90, 0x45, 0x19, 0xb2, 0x26, 0x3f, 0xef, 0x79, 0x5f, 0x32, 0x9d, 0xc1, 0xa5, 0xf4, 0x6b,
-	0xcb, 0xfb, 0x92, 0xf5, 0x35, 0x68, 0x49, 0xb2, 0x89, 0xa8, 0xdb, 0xe5, 0x82, 0xb5, 0x74, 0x66,
-	0x6f, 0xa6, 0x81, 0x25, 0xc5, 0xd9, 0xd7, 0x92, 0xc8, 0x62, 0x10, 0x36, 0x5f, 0x7b, 0x42, 0x57,
-	0x4a, 0x5a, 0x10, 0x90, 0xcd, 0x70, 0x04, 0xa7, 0x28, 0xbd, 0x11, 0x06, 0x2a, 0xf3, 0xe9, 0xd2,
-	0xc8, 0x66, 0x48, 0xe3, 0x14, 0xc3, 0xb0, 0xef, 0x75, 0x10, 0x83, 0xce, 0x9d, 0x1b, 0x06, 0xc5,
-	0x68, 0x84, 0x41, 0x11, 0xd6, 0x66, 0x61, 0x46, 0x42, 0x24, 0xe7, 0x6f, 0x16, 0x14, 0x8c, 0x3c,
-	0x4d, 0x50, 0x93, 0xef, 0x43, 0x16, 0x9f, 0xf6, 0x3a, 0xff, 0x73, 0xb2, 0x22, 0x99, 0x70, 0xa9,
-	0xa4, 0x62, 0x53, 0xd9, 0x6a, 0xa9, 0x86, 0x59, 0xa2, 0x38, 0x44, 0xca, 0x0b, 0x71, 0x2a, 0x53,
-	0x36, 0x47, 0x71, 0x48, 0x6e, 0xc3, 0xdc, 0x3e, 0x6b, 0x76, 0xb9, 0x27, 0x4e, 0x65, 0x12, 0xca,
-	0x2b, 0x15, 0xd9, 0x6a, 0x34, 0x4d, 0x16, 0x6e, 0x8f, 0x83, 0xdc, 0x82, 0x7c, 0xcc, 0x9a, 0x9c,
-	0x09, 0x16, 0x1c, 0xeb, 0xaa, 0x2a, 0x69, 0x76, 0xce, 0xc4, 0x66, 0x70, 0x4c, 0xfb, 0xeb, 0xce,
-	0x53, 0x3c, 0xc9, 0x7d, 0x6f, 0x08, 0x64, 0xd7, 0xf1, 0x69, 0x87, 0x6e, 0x94, 0xa8, 0x1c, 0xe3,
-	0xeb, 0x7a, 0xf3, 0xbc, 0xd7, 0xf5, 0x66, 0xf2, 0xba, 0x1e, 0x3c, 0x01, 0x78, 0x8d, 0x19, 0x19,
-	0x71, 0x9e, 0x40, 0xbe, 0x77, 0x4a, 0x49, 0x19, 0xa6, 0xb7, 0x5a, 0xda, 0xd2, 0xf4, 0x56, 0x0b,
-	0xfd, 0xde, 0x7c, 0xbe, 0x25, 0xad, 0xcc, 0x51, 0x1c, 0xf6, 0xd0, 0x46, 0xc6, 0x40, 0x1b, 0xab,
-	0x50, 0x1a, 0x38, 0xaa, 0xc8, 0x44, 0xc3, 0x93, 0x38, 0xd9, 0x32, 0x8e, 0x95, 0x1b, 0x7e, 0x2c,
-	0x75, 0x49, 0x37, 0xfc, 0xd8, 0xb9, 0x0e, 0xa5, 0x81, 0xe4, 0x22, 0x93, 0x7c, 0xa8, 0x6a, 0x50,
-	0x8a, 0xe3, 0x65, 0x06, 0xf3, 0x43, 0xdf, 0xae, 0xc8, 0x0d, 0xc8, 0xa9, 0x6f, 0x24, 0x95, 0x29,
-	0xfb, 0xca, 0xd7, 0xdf, 0x2c, 0xbc, 0x3b, 0xc4, 0xa0, 0x16, 0x91, 0x6d, 0xad, 0x1b, 0xb4, 0x7c,
-	0x56, 0xb1, 0xc6, 0xb2, 0xa9, 0x45, 0x3b, 0xfb, 0xeb, 0xdf, 0x5d, 0x9d, 0x5a, 0x76, 0xe1, 0xd2,
-	0xc8, 0x77, 0x17, 0x72, 0x1d, 0xb2, 0xfb, 0xcc, 0x6f, 0x27, 0x66, 0x46, 0x18, 0x70, 0x91, 0x5c,
-	0x83, 0x0c, 0x75, 0x4f, 0x2a, 0x96, 0x5d, 0xfd, 0xfa, 0x9b, 0x85, 0xcb, 0xa3, 0x1f, 0x6f, 0xdc,
-	0x13, 0x65, 0x62, 0xe5, 0xcf, 0x00, 0xf9, 0xdd, 0xdd, 0xb5, 0x35, 0xee, 0xb5, 0x3a, 0x8c, 0xfc,
-	0xd2, 0x02, 0x32, 0xfa, 0x42, 0x26, 0xf7, 0xd2, 0x1b, 0xc2, 0xf8, 0x4f, 0x08, 0xf6, 0xfd, 0x0b,
-	0x4a, 0x69, 0xc8, 0xf2, 0x39, 0xcc, 0x48, 0x9c, 0x4d, 0x3e, 0x9a, 0xf0, 0xb9, 0x65, 0x2f, 0x9d,
-	0xcf, 0xa8, 0x75, 0x37, 0x61, 0x2e, 0xc1, 0xaa, 0x64, 0x39, 0x75, 0x7b, 0x03, 0x50, 0xdc, 0xbe,
-	0x35, 0x11, 0xaf, 0x36, 0xf2, 0x53, 0x98, 0xd5, 0x10, 0x94, 0xdc, 0x3c, 0x47, 0xae, 0x0f, 0x86,
-	0xed, 0xe5, 0x49, 0x58, 0xfb, 0x6e, 0x24, 0x50, 0x33, 0xd5, 0x8d, 0x21, 0x20, 0x9b, 0xea, 0xc6,
-	0x08, 0x76, 0x6d, 0xf6, 0x1f, 0xa8, 0xa9, 0x46, 0x86, 0x80, 0x6b, 0xaa, 0x91, 0x61, 0xfc, 0x4a,
-	0x5e, 0x42, 0x16, 0xf1, 0x2b, 0x49, 0xeb, 0xd5, 0x06, 0xc0, 0xb5, 0xd3, 0xce, 0xc4, 0x00, 0xf0,
-	0xfd, 0x09, 0xde, 0x69, 0xf2, 0x5b, 0x44, 0xfa, 0x6d, 0x66, 0x7c, 0x5a, 0xb4, 0x6f, 0x4e, 0xc0,
-	0xd9, 0x57, 0xaf, 0xdf, 0xf1, 0x4b, 0x13, 0x7c, 0xdf, 0x3b, 0x5f, 0xfd, 0xd0, 0x97, 0xc4, 0x10,
-	0x8a, 0x26, 0x54, 0x21, 0xb5, 0x14, 0xd1, 0x31, 0x08, 0xd0, 0xae, 0x4f, 0xcc, 0xaf, 0x0d, 0x7e,
-	0x85, 0x8f, 0xb8, 0x41, 0x18, 0x43, 0x56, 0x52, 0xc3, 0x31, 0x16, 0x30, 0xd9, 0x77, 0x2f, 0x24,
-	0xa3, 0x8d, 0xbb, 0x0a, 0x26, 0x69, 0x28, 0x44, 0xd2, 0x6f, 0xfd, 0x1e, 0x9c, 0xb2, 0x27, 0xe4,
-	0x5b, 0xb2, 0xee, 0x58, 0x78, 0xce, 0x10, 0x3a, 0xa7, 0xea, 0x36, 0xde, 0x14, 0xa9, 0xe7, 0xcc,
-	0xc4, 0xe0, 0x6b, 0xc5, 0x6f, 0xdf, 0x5c, 0xb5, 0xfe, 0xfe, 0xe6, 0xaa, 0xf5, 0xcf, 0x37, 0x57,
-	0xad, 0x83, 0x9c, 0xfc, 0xc3, 0xf4, 0xee, 0x7f, 0x03, 0x00, 0x00, 0xff, 0xff, 0x99, 0x09, 0xbf,
-	0xd6, 0xb9, 0x1e, 0x00, 0x00,
+	// 2497 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x59, 0xcf, 0x6f, 0x1b, 0xc7,
+	0xf5, 0xd7, 0x8a, 0x14, 0x45, 0x3e, 0xfe, 0x10, 0x3d, 0x71, 0xf2, 0xa5, 0x17, 0x81, 0x23, 0xaf,
+	0x63, 0x45, 0x96, 0x1d, 0xd2, 0x5f, 0xd9, 0x86, 0x5c, 0xbb, 0x75, 0x62, 0xfd, 0x82, 0x14, 0x4b,
+	0x36, 0x3b, 0x72, 0xe1, 0x22, 0x48, 0x81, 0xae, 0xb8, 0x43, 0x6a, 0xeb, 0xd5, 0xee, 0x76, 0x77,
+	0x28, 0x59, 0xc9, 0xa9, 0x87, 0x02, 0x45, 0x8e, 0x3d, 0xf4, 0x96, 0x4b, 0x0b, 0xf4, 0xd4, 0x43,
+	0xfb, 0x07, 0x34, 0xe7, 0x00, 0xed, 0xa1, 0xe7, 0x1e, 0x82, 0xc2, 0x7f, 0x44, 0x81, 0xde, 0x8a,
+	0x37, 0x33, 0x4b, 0x0e, 0x7f, 0x68, 0x45, 0xd6, 0x27, 0xce, 0xbc, 0x79, 0x3f, 0xe6, 0xbd, 0x37,
+	0xef, 0xcd, 0x67, 0x96, 0x50, 0xee, 0xd8, 0x9c, 0x9d, 0xda, 0x67, 0xf5, 0x30, 0x0a, 0x78, 0x40,
+	0xae, 0x1c, 0x07, 0x87, 0x67, 0xf5, 0xc3, 0xae, 0xeb, 0x39, 0xaf, 0x5c, 0x5e, 0x3f, 0xf9, 0xff,
+	0x7a, 0x3b, 0x0a, 0x7c, 0xce, 0x7c, 0xc7, 0xfc, 0xb8, 0xe3, 0xf2, 0xa3, 0xee, 0x61, 0xbd, 0x15,
+	0x1c, 0x37, 0x3a, 0x41, 0x27, 0x68, 0x08, 0x89, 0xc3, 0x6e, 0x5b, 0xcc, 0xc4, 0x44, 0x8c, 0xa4,
+	0x26, 0x73, 0x75, 0x98, 0xbd, 0x13, 0x04, 0x1d, 0x8f, 0xd9, 0xa1, 0x1b, 0xab, 0x61, 0x23, 0x0a,
+	0x5b, 0x8d, 0x98, 0xdb, 0xbc, 0x1b, 0x2b, 0x99, 0xdb, 0x9a, 0x0c, 0x6e, 0xa4, 0x91, 0x6c, 0xa4,
+	0x11, 0x07, 0xde, 0x09, 0x8b, 0x1a, 0xe1, 0x61, 0x23, 0x08, 0x13, 0xee, 0xc6, 0xb9, 0xdc, 0x76,
+	0xe8, 0x36, 0xf8, 0x59, 0xc8, 0xe2, 0xc6, 0x69, 0x10, 0xbd, 0x62, 0x91, 0x12, 0xb8, 0x7b, 0xae,
+	0x40, 0x97, 0xbb, 0x1e, 0x4a, 0xb5, 0xec, 0x30, 0x46, 0x23, 0xf8, 0xab, 0x84, 0x74, 0xb7, 0x79,
+	0xe0, 0xbb, 0x31, 0x77, 0xdd, 0x8e, 0xdb, 0x68, 0xc7, 0x42, 0x46, 0x5a, 0x41, 0x27, 0x14, 0xfb,
+	0xfd, 0x14, 0x17, 0xba, 0x51, 0x8b, 0x85, 0x81, 0xe7, 0xb6, 0xce, 0xd0, 0x86, 0x1c, 0x49, 0x31,
+	0xeb, 0x6f, 0x59, 0xc8, 0x51, 0x16, 0x77, 0x3d, 0x4e, 0x96, 0xa0, 0x1c, 0xb1, 0xf6, 0x26, 0x0b,
+	0x23, 0xd6, 0xb2, 0x39, 0x73, 0x6a, 0xc6, 0xa2, 0xb1, 0x5c, 0xd8, 0x99, 0xa1, 0x83, 0x64, 0xf2,
+	0x13, 0xa8, 0x44, 0xac, 0x1d, 0x6b, 0x8c, 0xb3, 0x8b, 0xc6, 0x72, 0x71, 0xf5, 0x56, 0xfd, 0xdc,
+	0x1c, 0xd6, 0x29, 0x6b, 0xef, 0xdb, 0x61, 0x5f, 0x64, 0x67, 0x86, 0x0e, 0x29, 0x21, 0xab, 0x90,
+	0x89, 0x58, 0xbb, 0x96, 0x11, 0xba, 0xae, 0xa6, 0xeb, 0xda, 0x99, 0xa1, 0xc8, 0x4c, 0xd6, 0x20,
+	0x8b, 0x5a, 0x6a, 0x59, 0x21, 0x74, 0xed, 0xc2, 0x0d, 0xec, 0xcc, 0x50, 0x21, 0x40, 0x9e, 0x42,
+	0xfe, 0x98, 0x71, 0xdb, 0xb1, 0xb9, 0x5d, 0x83, 0xc5, 0xcc, 0x72, 0x71, 0xb5, 0x91, 0x2a, 0x8c,
+	0x01, 0xaa, 0xef, 0x2b, 0x89, 0x2d, 0x9f, 0x47, 0x67, 0xb4, 0xa7, 0x80, 0xbc, 0x84, 0x92, 0xcd,
+	0x39, 0xc3, 0x64, 0xb8, 0x81, 0x1f, 0xd7, 0x4a, 0x42, 0xe1, 0xdd, 0x8b, 0x15, 0x3e, 0xd1, 0xa4,
+	0xa4, 0xd2, 0x01, 0x45, 0xe6, 0x23, 0x28, 0x0f, 0xd8, 0x24, 0x55, 0xc8, 0xbc, 0x62, 0x67, 0x32,
+	0x31, 0x14, 0x87, 0xe4, 0x32, 0xcc, 0x9d, 0xd8, 0x5e, 0x97, 0x89, 0x1c, 0x94, 0xa8, 0x9c, 0x3c,
+	0x9c, 0x7d, 0x60, 0x98, 0x47, 0x70, 0x69, 0x44, 0xff, 0x18, 0x05, 0x3f, 0xd2, 0x15, 0x14, 0x57,
+	0x3f, 0x4a, 0xd9, 0xb5, 0xae, 0x4e, 0xb3, 0xb4, 0x9e, 0x87, 0x5c, 0x24, 0x1c, 0xb2, 0x7e, 0x67,
+	0x40, 0x75, 0x38, 0xd5, 0x64, 0x57, 0x25, 0xc9, 0x10, 0x61, 0xb9, 0x3f, 0xc5, 0x29, 0x41, 0x82,
+	0x0a, 0x8c, 0x50, 0x61, 0xae, 0x41, 0xa1, 0x47, 0xba, 0x28, 0x18, 0x05, 0x6d, 0x8b, 0xd6, 0x1a,
+	0x64, 0x28, 0x6b, 0x93, 0x0a, 0xcc, 0xba, 0xea, 0x5c, 0xd3, 0x59, 0xd7, 0x21, 0x8b, 0x90, 0x71,
+	0x58, 0x5b, 0xb9, 0x5e, 0xa9, 0x87, 0x87, 0xf5, 0x4d, 0xd6, 0x76, 0x7d, 0x17, 0x5d, 0xa4, 0xb8,
+	0x64, 0xfd, 0xde, 0xc0, 0xfa, 0xc0, 0x6d, 0x91, 0x4f, 0x06, 0xfc, 0xb8, 0xf8, 0xb4, 0x8f, 0xec,
+	0xfe, 0x65, 0xfa, 0xee, 0xef, 0x0d, 0x66, 0xe2, 0x82, 0x12, 0xd0, 0xbd, 0xfb, 0x29, 0x94, 0xf4,
+	0xdc, 0x90, 0x1d, 0x28, 0x6a, 0xe7, 0x48, 0x6d, 0x78, 0x69, 0xb2, 0xcc, 0x52, 0x5d, 0xd4, 0xfa,
+	0x63, 0x06, 0x8a, 0xda, 0x22, 0x79, 0x0c, 0xd9, 0x57, 0xae, 0x2f, 0x43, 0x58, 0x59, 0x5d, 0x99,
+	0x4c, 0xe5, 0x53, 0xd7, 0x77, 0xa8, 0x90, 0x23, 0x4d, 0xad, 0xee, 0x66, 0xc5, 0xb6, 0xee, 0x4d,
+	0xa6, 0xe3, 0xdc, 0xe2, 0xbb, 0x33, 0x45, 0xdb, 0x90, 0x4d, 0x83, 0x40, 0x36, 0xb4, 0xf9, 0x91,
+	0x68, 0x1a, 0x05, 0x2a, 0xc6, 0xe4, 0x0e, 0xbc, 0xe3, 0xfa, 0x2f, 0x02, 0x1e, 0x34, 0x23, 0xe6,
+	0xb8, 0x78, 0xf8, 0x5e, 0x9c, 0x85, 0xac, 0x36, 0x27, 0x58, 0xc6, 0x2d, 0x91, 0x26, 0x54, 0x24,
+	0xf9, 0xa0, 0x7b, 0xf8, 0x0b, 0xd6, 0xe2, 0x71, 0x2d, 0x27, 0xfc, 0x59, 0x4e, 0xd9, 0xc2, 0xae,
+	0x2e, 0x40, 0x87, 0xe4, 0xdf, 0xaa, 0xda, 0xad, 0xbf, 0x18, 0x50, 0x1e, 0x50, 0x4f, 0x3e, 0x1d,
+	0x48, 0xd5, 0xed, 0x49, 0xb7, 0xa5, 0x25, 0xeb, 0x33, 0xc8, 0x39, 0x6e, 0x87, 0xc5, 0x5c, 0xa4,
+	0xaa, 0xb0, 0xbe, 0xfa, 0xdd, 0xf7, 0x1f, 0xcc, 0xfc, 0xf3, 0xfb, 0x0f, 0x56, 0xb4, 0xab, 0x26,
+	0x08, 0x99, 0xdf, 0x0a, 0x7c, 0x6e, 0xbb, 0x3e, 0x8b, 0xf0, 0x82, 0xfd, 0x58, 0x8a, 0xd4, 0x37,
+	0xc5, 0x0f, 0x55, 0x1a, 0x30, 0xe8, 0xbe, 0x7d, 0xcc, 0x44, 0x9e, 0x0a, 0x54, 0x8c, 0x2d, 0x0e,
+	0x65, 0xca, 0x78, 0x37, 0xf2, 0x29, 0xfb, 0x65, 0x17, 0x99, 0x7e, 0x90, 0x34, 0x12, 0xb1, 0xe9,
+	0x8b, 0x1a, 0x3a, 0x32, 0x52, 0x25, 0x40, 0x96, 0x61, 0x8e, 0x45, 0x51, 0x10, 0xa9, 0xe2, 0x21,
+	0x75, 0x79, 0xd5, 0xd7, 0xa3, 0xb0, 0x55, 0x3f, 0x10, 0x57, 0x3d, 0x95, 0x0c, 0x56, 0x15, 0x2a,
+	0x89, 0xd5, 0x38, 0x0c, 0xfc, 0x98, 0x59, 0x0b, 0x18, 0xba, 0xb0, 0xcb, 0x63, 0xb5, 0x0f, 0xeb,
+	0x5b, 0x03, 0x2a, 0x09, 0x45, 0xf2, 0x90, 0x2f, 0xa0, 0xd8, 0x6f, 0x0d, 0x49, 0x0f, 0x78, 0x98,
+	0x1a, 0x54, 0x5d, 0x5e, 0xeb, 0x2b, 0xaa, 0x25, 0xe8, 0xea, 0xcc, 0x67, 0x50, 0x1d, 0x66, 0x18,
+	0x93, 0xfd, 0x0f, 0x07, 0x1b, 0xc4, 0x70, 0xbf, 0xd2, 0x4e, 0xc3, 0xb7, 0xb3, 0x70, 0x85, 0x32,
+	0x81, 0x5d, 0x76, 0x8f, 0xed, 0x0e, 0xdb, 0x08, 0xfc, 0xb6, 0xdb, 0x49, 0xc2, 0x5c, 0x15, 0xcd,
+	0x30, 0xd1, 0x8c, 0x7d, 0x71, 0x19, 0xf2, 0x4d, 0xcf, 0xe6, 0xed, 0x20, 0x3a, 0x56, 0xca, 0x4b,
+	0xa8, 0x3c, 0xa1, 0xd1, 0xde, 0x2a, 0x59, 0x84, 0xa2, 0x52, 0xbc, 0x1f, 0x38, 0x49, 0x3a, 0x75,
+	0x12, 0xa9, 0xc1, 0xfc, 0x5e, 0xd0, 0x79, 0x86, 0xc9, 0x96, 0x15, 0x96, 0x4c, 0x89, 0x05, 0x25,
+	0xc5, 0x18, 0xf5, 0xaa, 0x6b, 0x8e, 0x0e, 0xd0, 0xc8, 0xfb, 0x50, 0x38, 0x60, 0x71, 0xec, 0x06,
+	0xfe, 0xee, 0x66, 0x2d, 0x27, 0xe4, 0xfb, 0x04, 0xd4, 0x7d, 0xc0, 0x83, 0x88, 0xed, 0x6e, 0xd6,
+	0xe6, 0xa5, 0x6e, 0x35, 0x25, 0xfb, 0x50, 0x39, 0x10, 0x38, 0xa7, 0x89, 0xe8, 0xc6, 0x65, 0x71,
+	0x2d, 0x2f, 0x52, 0x74, 0x63, 0x34, 0x45, 0x3a, 0x1e, 0xaa, 0x0b, 0xf6, 0x33, 0x3a, 0x24, 0x6c,
+	0xfd, 0xd6, 0x00, 0x73, 0x5c, 0x00, 0xd5, 0x69, 0xf8, 0x0c, 0x72, 0xf2, 0x7c, 0xcb, 0x20, 0xfe,
+	0x6f, 0x95, 0x21, 0x7f, 0xc9, 0x7b, 0x90, 0x93, 0xda, 0x55, 0x51, 0xab, 0x59, 0x92, 0xa5, 0x4c,
+	0x2f, 0x4b, 0xd6, 0xaf, 0x73, 0x50, 0x3a, 0xc0, 0x2d, 0x25, 0x89, 0xac, 0x03, 0xf4, 0xf3, 0xaf,
+	0x6a, 0x66, 0xf8, 0x54, 0x68, 0x1c, 0xc4, 0x84, 0xfc, 0xb6, 0x3a, 0x9f, 0xea, 0x8a, 0xec, 0xcd,
+	0xc9, 0xe7, 0x50, 0x4c, 0xc6, 0xcf, 0x43, 0x5e, 0xcb, 0x88, 0xe8, 0x3d, 0x48, 0x39, 0xe0, 0xfa,
+	0x4e, 0xea, 0x9a, 0xa8, 0x3a, 0xde, 0x1a, 0x85, 0xdc, 0x86, 0x4b, 0xb6, 0xe7, 0x05, 0xa7, 0xaa,
+	0x66, 0x45, 0xf5, 0x89, 0xec, 0xe7, 0xe9, 0xe8, 0x02, 0xf6, 0x62, 0x8d, 0xf8, 0x24, 0x8a, 0xec,
+	0x33, 0x0c, 0x44, 0x4e, 0xf0, 0x8f, 0x5b, 0xc2, 0xb6, 0xb8, 0xed, 0xfa, 0xb6, 0x57, 0x03, 0xc1,
+	0x23, 0x27, 0x78, 0xdc, 0xb6, 0x5e, 0x87, 0x41, 0xc4, 0x59, 0xf4, 0x84, 0xf3, 0xa8, 0x56, 0x14,
+	0xe1, 0x1d, 0xa0, 0x91, 0x26, 0x94, 0x36, 0xec, 0xd6, 0x11, 0xdb, 0x3d, 0x46, 0x62, 0x02, 0xdd,
+	0xd2, 0x9a, 0xa5, 0x60, 0x7f, 0x1e, 0xea, 0x98, 0x4d, 0xd7, 0x40, 0x5a, 0x50, 0x49, 0x5c, 0x97,
+	0x2d, 0xa0, 0x56, 0x16, 0x3a, 0x1f, 0x4d, 0x1b, 0x4a, 0x29, 0x2d, 0x4d, 0x0c, 0xa9, 0xc4, 0x44,
+	0x6e, 0x61, 0xb5, 0xdb, 0x9c, 0xd5, 0x2a, 0xc2, 0xe7, 0xde, 0x7c, 0x4c, 0x25, 0x2c, 0xbc, 0x45,
+	0x25, 0x98, 0x8f, 0xa1, 0x3a, 0x9c, 0xdc, 0x69, 0x90, 0x97, 0xf9, 0x63, 0x78, 0x67, 0x8c, 0x47,
+	0x6f, 0xd5, 0xdd, 0xfe, 0x6c, 0xc0, 0xa5, 0x91, 0x34, 0xe0, 0x0d, 0x23, 0xba, 0x8a, 0x54, 0x29,
+	0xc6, 0x64, 0x1f, 0xe6, 0x30, 0xcd, 0xb1, 0xc2, 0x1a, 0x6b, 0xd3, 0xe4, 0xb5, 0x2e, 0x24, 0x65,
+	0xfc, 0xa5, 0x16, 0xf3, 0x01, 0x40, 0x9f, 0x38, 0x15, 0xfe, 0xfc, 0x02, 0xca, 0x2a, 0xc9, 0xaa,
+	0x83, 0x54, 0x25, 0x6c, 0x51, 0xc2, 0x08, 0x4b, 0xfa, 0x97, 0x5f, 0x66, 0xca, 0xcb, 0xcf, 0xfa,
+	0x0a, 0x16, 0x28, 0xb3, 0x9d, 0x6d, 0xd7, 0x63, 0xe7, 0xf7, 0x78, 0x2c, 0x7e, 0xd7, 0x63, 0x4d,
+	0x84, 0x3e, 0x49, 0xf1, 0xab, 0x39, 0x79, 0x08, 0x73, 0xd4, 0xf6, 0x3b, 0x4c, 0x99, 0xfe, 0x30,
+	0xc5, 0xb4, 0x30, 0x82, 0xbc, 0x54, 0x8a, 0x58, 0x8f, 0xa0, 0xd0, 0xa3, 0x61, 0x33, 0x7b, 0xde,
+	0x6e, 0xc7, 0x4c, 0x36, 0xc6, 0x0c, 0x55, 0x33, 0xa4, 0xef, 0x31, 0xbf, 0xa3, 0x4c, 0x67, 0xa8,
+	0x9a, 0x59, 0x4b, 0xf8, 0x5e, 0x48, 0x76, 0xae, 0x42, 0x43, 0x20, 0xbb, 0x89, 0xf8, 0xd0, 0x10,
+	0xf5, 0x2a, 0xc6, 0x96, 0x83, 0x97, 0xb6, 0xed, 0x6c, 0xba, 0xd1, 0xf9, 0x0e, 0xd6, 0x60, 0x7e,
+	0xd3, 0x8d, 0x34, 0xff, 0x92, 0x29, 0x59, 0xc2, 0xeb, 0xbc, 0xe5, 0x75, 0x1d, 0xf4, 0x96, 0xb3,
+	0xc8, 0x57, 0x5d, 0x75, 0x88, 0x6a, 0x7d, 0x22, 0xe3, 0x28, 0xac, 0xa8, 0xcd, 0xdc, 0x86, 0x79,
+	0xe6, 0xf3, 0x08, 0xcb, 0x48, 0xde, 0xf9, 0xa4, 0x2e, 0x5f, 0xe0, 0x75, 0xf1, 0x02, 0x17, 0xd8,
+	0x82, 0x26, 0x2c, 0xd6, 0x1a, 0x2c, 0x20, 0x21, 0x3d, 0x11, 0x04, 0xb2, 0xda, 0x26, 0xc5, 0xd8,
+	0x7a, 0x08, 0xd5, 0xbe, 0xa0, 0x32, 0xbd, 0x04, 0x59, 0x04, 0xbf, 0xaa, 0xaf, 0x8f, 0xb3, 0x2b,
+	0xd6, 0xad, 0xeb, 0xb0, 0x90, 0x14, 0xff, 0xb9, 0x46, 0x2d, 0x02, 0xd5, 0x3e, 0x93, 0xc2, 0x3d,
+	0x65, 0x28, 0x36, 0x5d, 0x3f, 0x81, 0x05, 0xd6, 0x1b, 0x03, 0x4a, 0xcd, 0xc0, 0xef, 0xdf, 0x72,
+	0x4d, 0x58, 0x48, 0x4a, 0xf7, 0x49, 0x73, 0x77, 0xc3, 0x0e, 0x93, 0x18, 0x2c, 0x8e, 0x9e, 0x0f,
+	0xf5, 0x0d, 0xa3, 0x2e, 0x19, 0xd7, 0xb3, 0x78, 0x21, 0xd2, 0x61, 0x71, 0xf2, 0x29, 0xcc, 0xef,
+	0xed, 0xad, 0x0b, 0x4d, 0xb3, 0x53, 0x69, 0x4a, 0xc4, 0xc8, 0x63, 0x98, 0x7f, 0x29, 0x3e, 0xad,
+	0xc4, 0xea, 0x8a, 0x1a, 0x73, 0x56, 0x65, 0x84, 0x24, 0x1b, 0x65, 0xad, 0x20, 0x72, 0x68, 0x22,
+	0x64, 0xfd, 0xdb, 0x80, 0xe2, 0x4b, 0xbb, 0x0f, 0x39, 0xfb, 0x18, 0xf7, 0x2d, 0x6e, 0x72, 0x85,
+	0x71, 0x2f, 0xc3, 0x9c, 0xc7, 0x4e, 0x98, 0xa7, 0xce, 0xb8, 0x9c, 0x20, 0x35, 0x3e, 0x0a, 0x22,
+	0x59, 0xd6, 0x25, 0x2a, 0x27, 0x58, 0x10, 0x0e, 0xe3, 0xb6, 0xeb, 0xd5, 0xb2, 0x8b, 0x19, 0xbc,
+	0xf5, 0xe5, 0x0c, 0x33, 0xd7, 0x8d, 0x3c, 0xf5, 0xf0, 0xc0, 0x21, 0xb1, 0x20, 0xeb, 0xfa, 0xed,
+	0x40, 0xdc, 0x7f, 0xaa, 0x2d, 0xca, 0x16, 0xbd, 0xeb, 0xb7, 0x03, 0x2a, 0xd6, 0xc8, 0x35, 0xc8,
+	0x45, 0x58, 0x7f, 0x71, 0x6d, 0x5e, 0x04, 0xa5, 0x80, 0x5c, 0xb2, 0x4a, 0xd5, 0x82, 0x55, 0x81,
+	0x92, 0xf4, 0x5b, 0x25, 0xff, 0x4f, 0xb3, 0xf0, 0xce, 0x33, 0x76, 0xba, 0x91, 0xf8, 0x95, 0x04,
+	0x64, 0x11, 0x8a, 0x3d, 0xda, 0xee, 0xa6, 0x3a, 0x42, 0x3a, 0x09, 0x8d, 0xed, 0x07, 0x5d, 0x9f,
+	0x27, 0x39, 0x14, 0xc6, 0x04, 0x85, 0xaa, 0x05, 0x72, 0x03, 0xe6, 0x9f, 0x31, 0x7e, 0x1a, 0x44,
+	0xaf, 0x84, 0xd7, 0x95, 0xd5, 0x22, 0xf2, 0x3c, 0x63, 0x1c, 0x11, 0x22, 0x4d, 0xd6, 0x10, 0x76,
+	0x86, 0x09, 0xec, 0xcc, 0x8e, 0x83, 0x9d, 0xc9, 0x2a, 0x59, 0x83, 0x62, 0x2b, 0xf0, 0x63, 0x1e,
+	0xd9, 0x2e, 0x1a, 0x9e, 0x13, 0xcc, 0xef, 0x22, 0xb3, 0x4c, 0xec, 0x46, 0x7f, 0x91, 0xea, 0x9c,
+	0x64, 0x05, 0x80, 0xbd, 0xe6, 0x91, 0xbd, 0x13, 0xc4, 0xbd, 0x27, 0x1a, 0xa0, 0x1c, 0x12, 0x76,
+	0x9b, 0x54, 0x5b, 0xc5, 0x0e, 0x79, 0x14, 0xc4, 0x5c, 0xbc, 0x53, 0x24, 0xbc, 0xec, 0xcd, 0xad,
+	0xf7, 0xe0, 0xf2, 0x60, 0xb4, 0x54, 0x18, 0x1f, 0xc1, 0xff, 0x51, 0xe6, 0x31, 0x3b, 0x66, 0xd3,
+	0x47, 0xd2, 0x32, 0xa1, 0x36, 0x2a, 0xac, 0x14, 0xff, 0x27, 0x03, 0xc5, 0xad, 0xd7, 0xac, 0xb5,
+	0xcf, 0xe2, 0xd8, 0xee, 0x08, 0x60, 0xdc, 0x8c, 0x82, 0x16, 0x8b, 0xe3, 0x9e, 0xae, 0x3e, 0x81,
+	0xfc, 0x10, 0xb2, 0xbb, 0xbe, 0xcb, 0xd5, 0xdd, 0xb9, 0x94, 0xfa, 0x2e, 0x71, 0xb9, 0xd2, 0xb9,
+	0x33, 0x43, 0x85, 0x14, 0x79, 0x08, 0x59, 0xec, 0x3c, 0x93, 0x74, 0x7f, 0x47, 0x93, 0x45, 0x19,
+	0xb2, 0x2e, 0xbe, 0x1f, 0xba, 0x5f, 0x32, 0x95, 0xc1, 0xe5, 0xf4, 0x6b, 0xcb, 0xfd, 0x92, 0xf5,
+	0x35, 0x28, 0x49, 0xb2, 0x85, 0xb0, 0xde, 0x8e, 0x38, 0x73, 0x54, 0x66, 0x6f, 0xa6, 0x81, 0x25,
+	0xc9, 0xd9, 0xd7, 0x92, 0xc8, 0x62, 0x10, 0xb6, 0x5e, 0xbb, 0x5c, 0x55, 0x4a, 0x5a, 0x10, 0x90,
+	0x4d, 0x73, 0x04, 0xa7, 0x28, 0xbd, 0x19, 0xf8, 0x32, 0xf3, 0xe9, 0xd2, 0xc8, 0xa6, 0x49, 0xe3,
+	0x14, 0xc3, 0x70, 0xe0, 0x76, 0x10, 0x83, 0xe6, 0x2f, 0x0c, 0x83, 0x64, 0xd4, 0xc2, 0x20, 0x09,
+	0xeb, 0xf3, 0x30, 0x27, 0x20, 0x92, 0xf5, 0x77, 0x03, 0x8a, 0x5a, 0x9e, 0x26, 0xa8, 0xc9, 0xf7,
+	0x21, 0xbb, 0xcf, 0xc4, 0x37, 0x15, 0x34, 0x9e, 0x17, 0x15, 0xc9, 0xb8, 0x4d, 0x05, 0x15, 0x9b,
+	0xca, 0xb6, 0x23, 0x1b, 0x66, 0x99, 0xe2, 0x10, 0x29, 0x2f, 0xf8, 0x99, 0x48, 0x59, 0x9e, 0xe2,
+	0x90, 0xdc, 0x86, 0xfc, 0x01, 0x6b, 0x75, 0x23, 0x97, 0x9f, 0x89, 0x24, 0x54, 0x56, 0xab, 0xa2,
+	0xd5, 0x28, 0x9a, 0x28, 0xdc, 0x1e, 0x07, 0xb9, 0x05, 0x85, 0x98, 0xb5, 0x22, 0xc6, 0x99, 0x7f,
+	0xa2, 0xaa, 0xaa, 0xac, 0xd8, 0x23, 0xc6, 0xb7, 0xfc, 0x13, 0xda, 0x5f, 0xb7, 0x9e, 0xe2, 0x49,
+	0xee, 0x7b, 0x43, 0x20, 0xbb, 0x81, 0x6f, 0x47, 0x74, 0xa3, 0x4c, 0xc5, 0x18, 0x9f, 0xef, 0x5b,
+	0x17, 0x3d, 0xdf, 0xb7, 0x92, 0xe7, 0xfb, 0xe0, 0x09, 0xc0, 0x6b, 0x4c, 0xcb, 0x88, 0xf5, 0x04,
+	0x0a, 0xbd, 0x53, 0x4a, 0x2a, 0x30, 0xbb, 0xed, 0x28, 0x4b, 0xb3, 0xdb, 0x0e, 0xfa, 0xbd, 0xf5,
+	0x7c, 0x5b, 0x58, 0xc9, 0x53, 0x1c, 0xf6, 0xd0, 0x46, 0x46, 0x43, 0x1b, 0x6b, 0x50, 0x1e, 0x38,
+	0xaa, 0xc8, 0x44, 0x83, 0xd3, 0x38, 0xd9, 0x32, 0x8e, 0xa5, 0x1b, 0x5e, 0x2c, 0x74, 0x09, 0x37,
+	0xbc, 0xd8, 0xba, 0x0e, 0xe5, 0x81, 0xe4, 0x22, 0x93, 0x78, 0x09, 0x2b, 0x50, 0x8a, 0xe3, 0x15,
+	0x06, 0x0b, 0x43, 0x1f, 0xc7, 0xc8, 0x0d, 0xc8, 0xc9, 0x8f, 0x30, 0xd5, 0x19, 0xf3, 0xca, 0xd7,
+	0xdf, 0x2c, 0xbe, 0x3b, 0xc4, 0x20, 0x17, 0x91, 0x6d, 0xbd, 0xeb, 0x3b, 0x1e, 0xab, 0x1a, 0x63,
+	0xd9, 0xe4, 0xa2, 0x99, 0xfd, 0xcd, 0x1f, 0xae, 0xce, 0xac, 0xd8, 0x70, 0x69, 0xe4, 0xc3, 0x0e,
+	0xb9, 0x0e, 0xd9, 0x03, 0xe6, 0xb5, 0x13, 0x33, 0x23, 0x0c, 0xb8, 0x48, 0xae, 0x41, 0x86, 0xda,
+	0xa7, 0x55, 0xc3, 0xac, 0x7d, 0xfd, 0xcd, 0xe2, 0xe5, 0xd1, 0xaf, 0x43, 0xf6, 0xa9, 0x34, 0xb1,
+	0xfa, 0x57, 0x80, 0xc2, 0xde, 0xde, 0xfa, 0x7a, 0xe4, 0x3a, 0x1d, 0x46, 0x7e, 0x65, 0x00, 0x19,
+	0x7d, 0x33, 0x93, 0x7b, 0xe9, 0x0d, 0x61, 0xfc, 0x37, 0x0a, 0xf3, 0xfe, 0x94, 0x52, 0x0a, 0xb2,
+	0x7c, 0x0e, 0x73, 0x02, 0x67, 0x93, 0x8f, 0x26, 0x7c, 0x6e, 0x99, 0xcb, 0x17, 0x33, 0x2a, 0xdd,
+	0x2d, 0xc8, 0x27, 0x58, 0x95, 0xac, 0xa4, 0x6e, 0x6f, 0x00, 0x8a, 0x9b, 0xb7, 0x26, 0xe2, 0x55,
+	0x46, 0x7e, 0x0e, 0xf3, 0x0a, 0x82, 0x92, 0x9b, 0x17, 0xc8, 0xf5, 0xc1, 0xb0, 0xb9, 0x32, 0x09,
+	0x6b, 0xdf, 0x8d, 0x04, 0x6a, 0xa6, 0xba, 0x31, 0x04, 0x64, 0x53, 0xdd, 0x18, 0xc1, 0xae, 0xad,
+	0xfe, 0x03, 0x35, 0xd5, 0xc8, 0x10, 0x70, 0x4d, 0x35, 0x32, 0x8c, 0x5f, 0xc9, 0x4b, 0xc8, 0x22,
+	0x7e, 0x25, 0x69, 0xbd, 0x5a, 0x03, 0xb8, 0x66, 0xda, 0x99, 0x18, 0x00, 0xbe, 0x3f, 0xc3, 0x3b,
+	0x4d, 0x7c, 0x8b, 0x48, 0xbf, 0xcd, 0xb4, 0x6f, 0x97, 0xe6, 0xcd, 0x09, 0x38, 0xfb, 0xea, 0xd5,
+	0x3b, 0x7e, 0x79, 0x82, 0x0f, 0x88, 0x17, 0xab, 0x1f, 0xfa, 0x54, 0x19, 0x40, 0x49, 0x87, 0x2a,
+	0xa4, 0x9e, 0x22, 0x3a, 0x06, 0x01, 0x9a, 0x8d, 0x89, 0xf9, 0x95, 0xc1, 0xaf, 0xf0, 0x11, 0x37,
+	0x08, 0x63, 0xc8, 0x6a, 0x6a, 0x38, 0xc6, 0x02, 0x26, 0xf3, 0xee, 0x54, 0x32, 0xca, 0xb8, 0x2d,
+	0x61, 0x92, 0x82, 0x42, 0x24, 0xfd, 0xd6, 0xef, 0xc1, 0x29, 0x73, 0x42, 0xbe, 0x65, 0xe3, 0x8e,
+	0x81, 0xe7, 0x0c, 0xa1, 0x73, 0xaa, 0x6e, 0xed, 0x4d, 0x91, 0x7a, 0xce, 0x74, 0x0c, 0xbe, 0x5e,
+	0xfa, 0xee, 0xcd, 0x55, 0xe3, 0x1f, 0x6f, 0xae, 0x1a, 0xff, 0x7a, 0x73, 0xd5, 0x38, 0xcc, 0x89,
+	0x7f, 0x64, 0xef, 0xfe, 0x37, 0x00, 0x00, 0xff, 0xff, 0x20, 0x47, 0x7d, 0x27, 0x1a, 0x1f, 0x00,
+	0x00,
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -4032,6 +4049,20 @@ func (m *ResolveImageConfigRequest) MarshalToSizedBuffer(dAtA []byte) (int, erro
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.SourcePolicies) > 0 {
+		for iNdEx := len(m.SourcePolicies) - 1; iNdEx >= 0; iNdEx-- {
+			{
+				size, err := m.SourcePolicies[iNdEx].MarshalToSizedBuffer(dAtA[:i])
+				if err != nil {
+					return 0, err
+				}
+				i -= size
+				i = encodeVarintGateway(dAtA, i, uint64(size))
+			}
+			i--
+			dAtA[i] = 0x42
+		}
+	}
 	if len(m.StoreID) > 0 {
 		i -= len(m.StoreID)
 		copy(dAtA[i:], m.StoreID)
@@ -4111,6 +4142,13 @@ func (m *ResolveImageConfigResponse) MarshalToSizedBuffer(dAtA []byte) (int, err
 		i -= len(m.XXX_unrecognized)
 		copy(dAtA[i:], m.XXX_unrecognized)
 	}
+	if len(m.Ref) > 0 {
+		i -= len(m.Ref)
+		copy(dAtA[i:], m.Ref)
+		i = encodeVarintGateway(dAtA, i, uint64(len(m.Ref)))
+		i--
+		dAtA[i] = 0x1a
+	}
 	if len(m.Config) > 0 {
 		i -= len(m.Config)
 		copy(dAtA[i:], m.Config)
@@ -5997,6 +6035,12 @@ func (m *ResolveImageConfigRequest) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovGateway(uint64(l))
 	}
+	if len(m.SourcePolicies) > 0 {
+		for _, e := range m.SourcePolicies {
+			l = e.Size()
+			n += 1 + l + sovGateway(uint64(l))
+		}
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -6017,6 +6061,10 @@ func (m *ResolveImageConfigResponse) Size() (n int) {
 	if l > 0 {
 		n += 1 + l + sovGateway(uint64(l))
 	}
+	l = len(m.Ref)
+	if l > 0 {
+		n += 1 + l + sovGateway(uint64(l))
+	}
 	if m.XXX_unrecognized != nil {
 		n += len(m.XXX_unrecognized)
 	}
@@ -8849,6 +8897,40 @@ func (m *ResolveImageConfigRequest) Unmarshal(dAtA []byte) error {
 			}
 			m.StoreID = string(dAtA[iNdEx:postIndex])
 			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SourcePolicies", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGateway
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthGateway
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return ErrInvalidLengthGateway
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SourcePolicies = append(m.SourcePolicies, &pb1.Policy{})
+			if err := m.SourcePolicies[len(m.SourcePolicies)-1].Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGateway(dAtA[iNdEx:])
@@ -8966,6 +9048,38 @@ func (m *ResolveImageConfigResponse) Unmarshal(dAtA []byte) error {
 				m.Config = []byte{}
 			}
 			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ref", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowGateway
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthGateway
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return ErrInvalidLengthGateway
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Ref = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
 		default:
 			iNdEx = preIndex
 			skippy, err := skipGateway(dAtA[iNdEx:])
diff --git a/frontend/gateway/pb/gateway.proto b/frontend/gateway/pb/gateway.proto
index b4ffd7863c87..c00d97391a43 100644
--- a/frontend/gateway/pb/gateway.proto
+++ b/frontend/gateway/pb/gateway.proto
@@ -11,6 +11,7 @@ import "github.com/tonistiigi/fsutil/types/stat.proto";
 import "github.com/moby/buildkit/sourcepolicy/pb/policy.proto";
 
 
+
 option (gogoproto.sizer_all) = true;
 option (gogoproto.marshaler_all) = true;
 option (gogoproto.unmarshaler_all) = true;
@@ -124,11 +125,13 @@ message ResolveImageConfigRequest {
 	int32 ResolverType = 5;
 	string SessionID = 6;
 	string StoreID = 7;
+	repeated moby.buildkit.v1.sourcepolicy.Policy SourcePolicies = 8;
 }
 
 message ResolveImageConfigResponse {
 	string Digest = 1 [(gogoproto.customtype) = "github.com/opencontainers/go-digest.Digest", (gogoproto.nullable) = false];
 	bytes Config = 2;
+	string Ref = 3;
 }
 
 message SolveRequest {
diff --git a/solver/llbsolver/bridge.go b/solver/llbsolver/bridge.go
index c34f8c061345..27dc133620f3 100644
--- a/solver/llbsolver/bridge.go
+++ b/solver/llbsolver/bridge.go
@@ -290,10 +290,10 @@ func (rp *resultProxy) Result(ctx context.Context) (res solver.CachedResult, err
 	})
 }
 
-func (b *llbBridge) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (dgst digest.Digest, config []byte, err error) {
+func (b *llbBridge) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (resolvedRef string, dgst digest.Digest, config []byte, err error) {
 	w, err := b.resolveWorker()
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 	if opt.LogName == "" {
 		opt.LogName = fmt.Sprintf("resolve image config for %s", ref)
@@ -304,11 +304,18 @@ func (b *llbBridge) ResolveImageConfig(ctx context.Context, ref string, opt llb.
 	} else {
 		id += platforms.Format(*platform)
 	}
+	pol, err := loadSourcePolicy(b.builder)
+	if err != nil {
+		return "", "", nil, err
+	}
+	if pol != nil {
+		opt.SourcePolicies = append(opt.SourcePolicies, pol)
+	}
 	err = inBuilderContext(ctx, b.builder, opt.LogName, id, func(ctx context.Context, g session.Group) error {
-		dgst, config, err = w.ResolveImageConfig(ctx, ref, opt, b.sm, g)
+		resolvedRef, dgst, config, err = w.ResolveImageConfig(ctx, ref, opt, b.sm, g)
 		return err
 	})
-	return dgst, config, err
+	return resolvedRef, dgst, config, err
 }
 
 type lazyCacheManager struct {
diff --git a/solver/llbsolver/provenance.go b/solver/llbsolver/provenance.go
index 9f2fb9e29965..9138d6d9f88f 100644
--- a/solver/llbsolver/provenance.go
+++ b/solver/llbsolver/provenance.go
@@ -131,10 +131,10 @@ func (b *provenanceBridge) findByResult(rp solver.ResultProxy) (*resultWithBridg
 	return nil, false
 }
 
-func (b *provenanceBridge) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (dgst digest.Digest, config []byte, err error) {
-	dgst, config, err = b.llbBridge.ResolveImageConfig(ctx, ref, opt)
+func (b *provenanceBridge) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt) (resolvedRef string, dgst digest.Digest, config []byte, err error) {
+	ref, dgst, config, err = b.llbBridge.ResolveImageConfig(ctx, ref, opt)
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
 	b.images = append(b.images, provenance.ImageSource{
@@ -143,7 +143,7 @@ func (b *provenanceBridge) ResolveImageConfig(ctx context.Context, ref string, o
 		Digest:   dgst,
 		Local:    opt.ResolverType == llb.ResolverTypeOCILayout,
 	})
-	return dgst, config, nil
+	return ref, dgst, config, nil
 }
 
 func (b *provenanceBridge) Solve(ctx context.Context, req frontend.SolveRequest, sid string) (res *frontend.Result, err error) {
diff --git a/source/containerimage/pull.go b/source/containerimage/pull.go
index 08b1bcc678bc..8792111aaa5d 100644
--- a/source/containerimage/pull.go
+++ b/source/containerimage/pull.go
@@ -61,6 +61,7 @@ type SourceOpt struct {
 }
 
 type resolveImageResult struct {
+	ref  string
 	dgst digest.Digest
 	dt   []byte
 }
@@ -87,7 +88,7 @@ func (is *Source) ID() string {
 	return srctypes.DockerImageScheme
 }
 
-func (is *Source) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (digest.Digest, []byte, error) {
+func (is *Source) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (string, digest.Digest, []byte, error) {
 	key := ref
 	if platform := opt.Platform; platform != nil {
 		key += platforms.Format(*platform)
@@ -102,7 +103,7 @@ func (is *Source) ResolveImageConfig(ctx context.Context, ref string, opt llb.Re
 	case ResolverTypeRegistry:
 		rm, err = source.ParseImageResolveMode(opt.ResolveMode)
 		if err != nil {
-			return "", nil, err
+			return "", "", nil, err
 		}
 		rslvr = resolver.DefaultPool.GetResolver(is.RegistryHosts, ref, "pull", sm, g).WithImageStore(is.ImageStore, rm)
 	case ResolverTypeOCILayout:
@@ -111,16 +112,16 @@ func (is *Source) ResolveImageConfig(ctx context.Context, ref string, opt llb.Re
 	}
 	key += rm.String()
 	res, err := is.g.Do(ctx, key, func(ctx context.Context) (*resolveImageResult, error) {
-		dgst, dt, err := imageutil.Config(ctx, ref, rslvr, is.ContentStore, is.LeaseManager, opt.Platform)
+		newRef, dgst, dt, err := imageutil.Config(ctx, ref, rslvr, is.ContentStore, is.LeaseManager, opt.Platform, opt.SourcePolicies)
 		if err != nil {
 			return nil, err
 		}
-		return &resolveImageResult{dgst: dgst, dt: dt}, nil
+		return &resolveImageResult{dgst: dgst, dt: dt, ref: newRef}, nil
 	})
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
-	return res.dgst, res.dt, nil
+	return res.ref, res.dgst, res.dt, nil
 }
 
 func (is *Source) Resolve(ctx context.Context, id source.Identifier, sm *session.Manager, vtx solver.Vertex) (source.SourceInstance, error) {
diff --git a/sourcepolicy/engine.go b/sourcepolicy/engine.go
index 829e8510650c..8515b276a416 100644
--- a/sourcepolicy/engine.go
+++ b/sourcepolicy/engine.go
@@ -7,6 +7,7 @@ import (
 	spb "github.com/moby/buildkit/sourcepolicy/pb"
 	"github.com/moby/buildkit/util/bklog"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
 var (
@@ -112,12 +113,20 @@ func (e *Engine) evaluatePolicies(ctx context.Context, srcOp *pb.SourceOp) (bool
 //
 // For Allow/Deny rules, the last matching rule wins.
 // E.g. `ALLOW foo; DENY foo` will deny `foo`, `DENY foo; ALLOW foo` will allow `foo`.
-func (e *Engine) evaluatePolicy(ctx context.Context, pol *spb.Policy, srcOp *pb.SourceOp) (bool, error) {
+func (e *Engine) evaluatePolicy(ctx context.Context, pol *spb.Policy, srcOp *pb.SourceOp) (retMut bool, retErr error) {
 	ident := srcOp.GetIdentifier()
 
-	ctx = bklog.WithLogger(ctx, bklog.G(ctx).WithFields(map[string]interface{}{
-		"ref": ident,
-	}))
+	ctx = bklog.WithLogger(ctx, bklog.G(ctx).WithField("ref", ident))
+	defer func() {
+		if retMut || retErr != nil {
+			bklog.G(ctx).WithFields(
+				logrus.Fields{
+					"mutated":       retMut,
+					"updated":       srcOp.GetIdentifier(),
+					logrus.ErrorKey: retErr,
+				}).Debug("Evaluated source policy")
+		}
+	}()
 
 	var deny bool
 	for _, rule := range pol.Rules {
diff --git a/util/imageutil/config.go b/util/imageutil/config.go
index d7bf6b6a1bf4..f183db5872b9 100644
--- a/util/imageutil/config.go
+++ b/util/imageutil/config.go
@@ -3,6 +3,8 @@ package imageutil
 import (
 	"context"
 	"encoding/json"
+	"fmt"
+	"strings"
 	"sync"
 	"time"
 
@@ -14,6 +16,10 @@ import (
 	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/containerd/remotes/docker"
 	intoto "github.com/in-toto/in-toto-golang/in_toto"
+	"github.com/moby/buildkit/solver/pb"
+	srctypes "github.com/moby/buildkit/source/types"
+	"github.com/moby/buildkit/sourcepolicy"
+	spb "github.com/moby/buildkit/sourcepolicy/pb"
 	"github.com/moby/buildkit/util/contentutil"
 	"github.com/moby/buildkit/util/leaseutil"
 	"github.com/moby/buildkit/util/resolver/limited"
@@ -47,7 +53,17 @@ func AddLease(f func(context.Context) error) {
 	leasesMu.Unlock()
 }
 
-func Config(ctx context.Context, str string, resolver remotes.Resolver, cache ContentCache, leaseManager leases.Manager, p *ocispecs.Platform) (digest.Digest, []byte, error) {
+// ResolveToNonImageError is returned by the resolver when the ref is mutated by policy to a non-image ref
+type ResolveToNonImageError struct {
+	Ref     string
+	Updated string
+}
+
+func (e ResolveToNonImageError) Error() string {
+	return fmt.Sprintf("ref mutated by policy to non-image: %s://%s -> %s", srctypes.DockerImageScheme, e.Ref, e.Updated)
+}
+
+func Config(ctx context.Context, str string, resolver remotes.Resolver, cache ContentCache, leaseManager leases.Manager, p *ocispecs.Platform, spls []*spb.Policy) (string, digest.Digest, []byte, error) {
 	// TODO: fix buildkit to take interface instead of struct
 	var platform platforms.MatchComparer
 	if p != nil {
@@ -57,13 +73,44 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co
 	}
 	ref, err := reference.Parse(str)
 	if err != nil {
-		return "", nil, errors.WithStack(err)
+		return "", "", nil, errors.WithStack(err)
+	}
+
+	op := &pb.Op{
+		Op: &pb.Op_Source{
+			Source: &pb.SourceOp{
+				Identifier: srctypes.DockerImageScheme + "://" + ref.String(),
+			},
+		},
+	}
+
+	mut, err := sourcepolicy.NewEngine(spls).Evaluate(ctx, op)
+	if err != nil {
+		return "", "", nil, errors.Wrap(err, "could not resolve image due to policy")
+	}
+
+	if mut {
+		var (
+			t  string
+			ok bool
+		)
+		t, newRef, ok := strings.Cut(op.GetSource().GetIdentifier(), "://")
+		if !ok {
+			return "", "", nil, errors.Errorf("could not parse ref: %s", op.GetSource().GetIdentifier())
+		}
+		if ok && t != srctypes.DockerImageScheme {
+			return "", "", nil, &ResolveToNonImageError{Ref: str, Updated: newRef}
+		}
+		ref, err = reference.Parse(newRef)
+		if err != nil {
+			return "", "", nil, errors.WithStack(err)
+		}
 	}
 
 	if leaseManager != nil {
 		ctx2, done, err := leaseutil.WithLease(ctx, leaseManager, leases.WithExpiration(5*time.Minute), leaseutil.MakeTemporary)
 		if err != nil {
-			return "", nil, errors.WithStack(err)
+			return "", "", nil, errors.WithStack(err)
 		}
 		ctx = ctx2
 		defer func() {
@@ -94,24 +141,25 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co
 	if desc.MediaType == "" {
 		_, desc, err = resolver.Resolve(ctx, ref.String())
 		if err != nil {
-			return "", nil, err
+			return "", "", nil, err
 		}
 	}
 
 	fetcher, err := resolver.Fetcher(ctx, ref.String())
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
 	if desc.MediaType == images.MediaTypeDockerSchema1Manifest {
-		return readSchema1Config(ctx, ref.String(), desc, fetcher, cache)
+		dgst, dt, err := readSchema1Config(ctx, ref.String(), desc, fetcher, cache)
+		return ref.String(), dgst, dt, err
 	}
 
 	children := childrenConfigHandler(cache, platform)
 
 	dslHandler, err := docker.AppendDistributionSourceLabel(cache, ref.String())
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
 	handlers := []images.Handler{
@@ -120,19 +168,19 @@ func Config(ctx context.Context, str string, resolver remotes.Resolver, cache Co
 		children,
 	}
 	if err := images.Dispatch(ctx, images.Handlers(handlers...), nil, desc); err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 	config, err := images.Config(ctx, cache, desc, platform)
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
 	dt, err := content.ReadBlob(ctx, cache, config)
 	if err != nil {
-		return "", nil, err
+		return "", "", nil, err
 	}
 
-	return desc.Digest, dt, nil
+	return ref.String(), desc.Digest, dt, nil
 }
 
 func childrenConfigHandler(provider content.Provider, platform platforms.MatchComparer) images.HandlerFunc {
diff --git a/worker/base/worker.go b/worker/base/worker.go
index 13d3ac714e08..8d402ff2fb1b 100644
--- a/worker/base/worker.go
+++ b/worker/base/worker.go
@@ -362,7 +362,7 @@ func (w *Worker) PruneCacheMounts(ctx context.Context, ids []string) error {
 	return nil
 }
 
-func (w *Worker) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (digest.Digest, []byte, error) {
+func (w *Worker) ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (string, digest.Digest, []byte, error) {
 	// is this an registry source? Or an OCI layout source?
 	switch opt.ResolverType {
 	case llb.ResolverTypeOCILayout:
diff --git a/worker/worker.go b/worker/worker.go
index d6bae6dfe729..d62047e9fb5f 100644
--- a/worker/worker.go
+++ b/worker/worker.go
@@ -30,7 +30,7 @@ type Worker interface {
 	LoadRef(ctx context.Context, id string, hidden bool) (cache.ImmutableRef, error)
 	// ResolveOp resolves Vertex.Sys() to Op implementation.
 	ResolveOp(v solver.Vertex, s frontend.FrontendLLBBridge, sm *session.Manager) (solver.Op, error)
-	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (digest.Digest, []byte, error)
+	ResolveImageConfig(ctx context.Context, ref string, opt llb.ResolveImageConfigOpt, sm *session.Manager, g session.Group) (string, digest.Digest, []byte, error)
 	DiskUsage(ctx context.Context, opt client.DiskUsageInfo) ([]*client.UsageInfo, error)
 	Exporter(name string, sm *session.Manager) (exporter.Exporter, error)
 	Prune(ctx context.Context, ch chan client.UsageInfo, opt ...client.PruneInfo) error