Reapply "cli/command/image: deprecate TagTrusted, move to cli/trust"

This reverts commit 4aecad4.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

cli/trust: TagTrusted: lazily request APIClient to fix regression

Commit e37d814 moved the image.TagTrusted
function to the trust package, but changed the signature slightly to accept
an API client, instead of requiring the command.Cli. However, this could
result in situations where the Client obtained from the CLI was not correctly
initialized, resulting in failures in our e2e test;

    === FAIL: e2e/global TestPromptExitCode/plugin_upgrade (9.14s)
        cli_test.go:203: assertion failed:
            Command:  docker plugin push registry:5000/plugin-content-trust-upgrade:next
            ExitCode: 1
            Error:    exit status 1
            Stdout:   The push refers to repository [registry:5000/plugin-content-trust-upgrade]
            24ec5b45d59b: Preparing
            6a594992d358: Preparing
            224414d1b129: Preparing
            24ec5b45d59b: Preparing
            6a594992d358: Preparing
            224414d1b129: Preparing

            Stderr:   error pushing plugin: failed to do request: Head "https://registry:5000/v2/plugin-content-trust-upgrade/blobs/sha256:6a594992d358facbbc4ab134bbbba77cb91e0adee6ff0d6103403ff94a9b796c": http: server gave HTTP response to HTTPS client

            Failures:
            ExitCode was 1 expected 0
            Expected no error

This patch changes the signature to accept an "APIClientProvider" so that
the Client is obtained the moment when used.

We should look what exactly causes this situation, and if we can make
sure that requesting the `Client()` will always produce the client with
the expected configuration.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Author: thaJeztah

cli/command/container/create.go

@@ -242,7 +242,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 			return err
 		}
 		if taggedRef, ok := namedRef.(reference.NamedTagged); ok && trustedRef != nil {
-			return image.TagTrusted(ctx, dockerCli, trustedRef, taggedRef)
+			return tagTrusted(ctx, dockerCli, trustedRef, taggedRef)
 		}
 		return nil
 	}

cli/command/container/trust.go

@@ -0,0 +1,13 @@
+package container
+
+import (
+	"context"
+
+	"github.com/distribution/reference"
+	"github.com/docker/cli/cli/command"
+	"github.com/docker/cli/cli/trust"
+)
+
+func tagTrusted(ctx context.Context, cli command.Cli, trustedRef reference.Canonical, ref reference.NamedTagged) error {
+	return trust.TagTrusted(ctx, cli, cli.Err(), trustedRef, ref)
+}

cli/command/image/build.go

@@ -406,7 +406,7 @@ func runBuild(ctx context.Context, dockerCli command.Cli, options buildOptions)
 		// Since the build was successful, now we must tag any of the resolved
 		// images from the above Dockerfile rewrite.
 		for _, resolved := range resolvedTags {
-			if err := TagTrusted(ctx, dockerCli, resolved.digestRef, resolved.tagRef); err != nil {
+			if err := tagTrusted(ctx, dockerCli, resolved.digestRef, resolved.tagRef); err != nil {
 				return err
 			}
 		}

cli/command/image/trust.go

@@ -104,7 +104,7 @@ func trustedPull(ctx context.Context, cli command.Cli, imgRefAndAuth trust.Image
 			return err
 		}
 
-		if err := TagTrusted(ctx, cli, trustedRef, tagged); err != nil {
+		if err := tagTrusted(ctx, cli, trustedRef, tagged); err != nil {
 			return err
 		}
 	}
@@ -225,15 +225,20 @@ func convertTarget(t client.Target) (target, error) {
 	}, nil
 }
 
-// TagTrusted tags a trusted ref
+// TagTrusted tags a trusted ref. It is a shallow wrapper around APIClient.ImageTag
+// that updates the given image references to their familiar format for tagging
+// and printing.
+//
+// Deprecated: use [trust.TagTrusted] instead. This function was only used internally, and will be removed in the next release.
 func TagTrusted(ctx context.Context, cli command.Cli, trustedRef reference.Canonical, ref reference.NamedTagged) error {
-	// Use familiar references when interacting with client and output
-	familiarRef := reference.FamiliarString(ref)
-	trustedFamiliarRef := reference.FamiliarString(trustedRef)
-
-	_, _ = fmt.Fprintf(cli.Err(), "Tagging %s as %s\n", trustedFamiliarRef, familiarRef)
+	return tagTrusted(ctx, cli, trustedRef, ref)
+}
 
-	return cli.Client().ImageTag(ctx, trustedFamiliarRef, familiarRef)
+// tagTrusted tags a trusted ref. It is a shallow wrapper around APIClient.ImageTag
+// that updates the given image references to their familiar format for tagging
+// and printing.
+func tagTrusted(ctx context.Context, cli command.Cli, trustedRef reference.Canonical, ref reference.NamedTagged) error {
+	return trust.TagTrusted(ctx, cli, cli.Err(), trustedRef, ref)
 }
 
 // AuthResolver returns an auth resolver function from a command.Cli

cli/trust/trust_tag.go

@@ -0,0 +1,26 @@
+package trust
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/distribution/reference"
+	"github.com/docker/docker/client"
+)
+
+type APIClientProvider interface {
+	Client() client.APIClient
+}
+
+// TagTrusted tags a trusted ref. It is a shallow wrapper around [client.Client.ImageTag]
+// that updates the given image references to their familiar format for tagging
+// and printing.
+func TagTrusted(ctx context.Context, cli APIClientProvider, out io.Writer, trustedRef reference.Canonical, ref reference.NamedTagged) error {
+	// Use familiar references when interacting with client and output
+	familiarRef := reference.FamiliarString(ref)
+	trustedFamiliarRef := reference.FamiliarString(trustedRef)
+
+	_, _ = fmt.Fprintf(out, "Tagging %s as %s\n", trustedFamiliarRef, familiarRef)
+	return cli.Client().ImageTag(ctx, trustedFamiliarRef, familiarRef)
+}