DOCKER_CONTENT_TRUST_SERVER not working correctly with port number

[peterthomassen]

Description

DOCKER_CONTENT_TRUST_SERVER does not work correctly if a port number is provided.

Steps to reproduce the issue:

1. export DOCKER_CONTENT_TRUST=1
2. export DOCKER_CONTENT_TRUST_SERVER=https://notary.docker.io:443
3. docker image pull mariadb/server

Describe the results you received:

Using default tag: latest
unable to reach trust server at this time: 503.

This appears to be a HTTP 503 error.

Describe the results you expected:

Using default tag: latest
Error: remote trust data does not exist for docker.io/mariadb/server: notary.docker.io:443 does not have trust data for docker.io/mariadb/server

Additional information you deem important (e.g. issue happens only occasionally):
Setting DOCKER_CONTENT_TRUST_SERVER=https://notary.docker.io works, but adding a 443 port leads to a HTTP 503 response. Using port 4443 instead leads to connection refused (I believe this is the wrong port anyway).

Output of docker version:

Client:
 Version:           18.09.5
 API version:       1.39
 Go version:        go1.10.4
 Git commit:        e8ff056
 Built:             Thu May  9 23:11:19 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server:
 Engine:
  Version:          18.09.5
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.4
  Git commit:       e8ff056
  Built:            Thu May  9 22:59:19 2019
  OS/Arch:          linux/amd64
  Experimental:     false

[thaJeztah]

Thanks for reporting; I'm able to reproduce this.

Wondering if it's an issue in the client, or if there's a configuration issue with the hosted notary server 🤔

/cc @justincormack ptal

[peterthomassen]

The two requests should be identical, with the exception of the Host header that likely contains the port only in one case.

[thaJeztah]

• closing because we removed docker trust from the CLI; remove support for client-side docker content trust validation #6603