implement docker trust as plugin

[thaJeztah]

Just a quick experiment to see if we can move the trust subcommands to a plugin, so that the subcommands can be installed separate from the docker trust integration in push/pull (for situations where trust verification happens on the daemon side).

make binary
go build -o /usr/libexec/docker/cli-plugins/docker-trust ./cmd/docker-trust

docker info
Client:
 Version:    28.2.0-dev
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.24.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  trust: Manage trust on Docker images (Docker Inc.)
    Version:  unknown-version
    Path:     /usr/libexec/docker/cli-plugins/docker-trust

docker trust --help
Usage:  docker trust [OPTIONS] COMMAND

Extended build capabilities with BuildKit

Options:
  -D, --debug   Enable debug logging

Management Commands:
  key         Manage keys for signing Docker images
  signer      Manage entities who can sign Docker images

Commands:
  inspect     Return low-level information about keys and signatures
  revoke      Remove trust for an image
  sign        Sign an image

Run 'docker trust COMMAND --help' for more information on a command.

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 0% with 97 lines in your changes missing coverage. Please review.

Project coverage is 55.34%. Comparing base (9e50654) to head (1c17d27).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #6121      +/-   ##
==========================================
+ Coverage   55.03%   55.34%   +0.30%     
==========================================
  Files         361      357       -4     
  Lines       30153    29988     -165     
==========================================
  Hits        16596    16596              
+ Misses      12599    12434     -165     
  Partials      958      958              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[thaJeztah]

It's currently expected that this fails, because the e2e test require the plugin to be installed (what we currently don't do).

This error is interesting though; for some reason it shows an error about API version mismatch, but after that it shows docker version output where it correctly downgraded the version, and was successfully able to connect 🤔

Waiting for docker daemon to become available at ssh://[email protected]
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Cannot connect to the Docker daemon at http://docker.example.com./ Is the docker daemon running?
Error response from daemon: client version 1.50 is too new. Maximum supported API version is 1.42
Client:
 Version:           28.2.0-dev
 API version:       1.42 (downgraded from 1.50)
 Go version:        go1.24.3
 Git commit:        d271c02
 Built:             Mon Jun  2 15:32:03 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          23.0.6
  API version:      1.42 (minimum version 1.12)