fix: handle docker's unknown/unknown platform in index manifests

pkg/build/gobuild.go

@@ -1171,7 +1171,13 @@ func parseSpec(spec []string) (*platformMatcher, error) {
 }
 
 func (pm *platformMatcher) matches(base *v1.Platform) bool {
-	if len(pm.spec) > 0 && pm.spec[0] == "all" {
+	if base != nil &&
+		(base.OS == "unknown" || base.Architecture == "unknown") {
+		return false
+	}
+
+	all := len(pm.spec) > 0 && pm.spec[0] == "all"
+	if all {
 		return true
 	}
 
@@ -1181,6 +1187,12 @@ func (pm *platformMatcher) matches(base *v1.Platform) bool {
 	}
 
 	for _, p := range pm.platforms {
+		// Strip out manifests with "unknown/unknown" platform, which Docker uses
+		// to store provenance attestations.
+		if p.OS == "unknown" || p.Architecture == "unknown" {
+			continue
+		}
+
 		if p.OS != "" && base.OS != p.OS {
 			continue
 		}

pkg/build/gobuild_test.go

@@ -1139,6 +1139,11 @@ func TestMatchesPlatformSpec(t *testing.T) {
 			OSVersion:    "10.0.17763.1234.5678", // this won't happen in the wild, but it shouldn't match.
 		},
 		result: false,
+	}, {
+		// Even --platform=all does not match unknown/unknown.
+		platform: &v1.Platform{Architecture: "unknown", OS: "unknown"},
+		spec:     []string{"all"},
+		result:   false,
 	}} {
 		pm, err := parseSpec(tc.spec)
 		if tc.err {