Dockerfile frontend: `ADD --checksum=.. https://..` hides HTTP error

Start by reproducing the Dockerfile frontend behavior with the provided ADD --checksum example and the docker build command, comparing the checksum and non-checksum errors for the HTTP 403 response. Trace the remote ADD and checksum error handling, then verify that the reported error preserves the HTTP failure and add coverage for this reproduction if the existing tests provide an appropriate entry point.

Contributing guidelines and issue reporting guide

• I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.

Well-formed report checklist

• I have found a bug that the documentation does not mention anything about my problem
• I have found a bug that there are no open or closed issues that are related to my problem
• I have provided version/information about my environment and done my best to provide a reproducer

Description of bug

Bug description

With an ADD where the remote HTTP server replies with a 403:

• with --checksum present: digest mismatch sha256:98c9e774f969bfcb951ddd795eb3adaa7cc2e6f9bfada43dd2c91f1320f343a7: sha256:ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301
• without: failed to load cache key: invalid response status 403

I believe the later error is the one that should be reported.

Reproduction

# syntax=docker.io/docker/dockerfile:1@sha256:b6afd42430b15f2d2a4c5a02b919e98a525b785b1aaff16747d2f623364e39b6

FROM scratch AS prebuild-2
ADD --chmod=0664 --unpack \
  https://static.crates.io/crates/zerotrie/0.2.3.crate /

BUILDX_BUILDER="supergreen" docker build --network=none --output=type=cacheonly - <_

(reproduces also without a specific builder)

Version information

# BUILDX_BUILDER=supergreen docker buildx inspect
Name:          supergreen
Driver:        docker-container
Last Activity: 2025-11-25 13:08:23 +0000 UTC

Nodes:
Name:                  supergreen0
Endpoint:              desktop-linux
Driver Options:        image="docker.io/moby/buildkit:latest@sha256:de10faf919fc71ba4eb1dd7bd6449566d012b0c9436b1c61bfee21d621b009aa"
Status:                running
BuildKit daemon flags: --allow-insecure-entitlement=network.host
BuildKit version:      v0.26.2
Platforms:             linux/arm64, linux/amd64, linux/amd64/v2, linux/riscv64, linux/ppc64le, linux/s390x, linux/386, linux/arm/v7, linux/arm/v6
Labels:
 org.mobyproject.buildkit.worker.executor:         oci
 org.mobyproject.buildkit.worker.hostname:         94b78d22a7be
 org.mobyproject.buildkit.worker.network:          host
 org.mobyproject.buildkit.worker.oci.process-mode: sandbox
 org.mobyproject.buildkit.worker.selinux.enabled:  false
 org.mobyproject.buildkit.worker.snapshotter:      overlayfs
GC Policy rule#0:
 All:            false
 Filters:        type==source.local,type==exec.cachemount,type==source.git.checkout
 Keep Duration:  48h0m0s
 Max Used Space: 488.3MiB
GC Policy rule#1:
 All:            false
 Keep Duration:  1440h0m0s
 Reserved Space: 9.313GiB
 Max Used Space: 93.13GiB
 Min Free Space: 84.75GiB
GC Policy rule#2:
 All:            false
 Reserved Space: 9.313GiB
 Max Used Space: 93.13GiB
 Min Free Space: 84.75GiB
GC Policy rule#3:
 All:            true
 Reserved Space: 9.313GiB
 Max Used Space: 93.13GiB
 Min Free Space: 84.75GiB
File#buildkitd.toml:
 > debug = true
 >
 > [registry]
 >
 >   [registry."docker.io"]
 >     mirrors = ["mirror.gcr.io", "public.ecr.aws/docker"]
 >

# docker version
Client:
 Version:           29.0.1
 API version:       1.52
 Go version:        go1.25.4
 Git commit:        eedd969
 Built:             Fri Nov 14 16:16:57 2025
 OS/Arch:           darwin/arm64
 Context:           desktop-linux

Server: Docker Desktop 4.52.0 (210994)
 Engine:
  Version:          29.0.1
  API version:      1.52 (minimum version 1.44)
  Go version:       go1.25.4
  Git commit:       198b5e3
  Built:            Fri Nov 14 16:18:20 2025
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          v2.1.5
  GitCommit:        fcd43222d6b07379a4be9786bda52438f0dd16a1
 runc:
  Version:          1.3.3
  GitCommit:        v1.3.3-0-gd842d771
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0