Merge pull request #500 from seemethere/bump

[18.04] Bump version to 18.04.0-ce

CHANGELOG.md

@@ -1,120 +1,85 @@
-# Changelog 
-For more information on the list of deprecated flags and APIs please have a look at
-https://docs.docker.com/engine/deprecated/ where you can find the target removal dates 
+# Changelog
 
-## 18.03.0-ce (2018-03-21)
+For more information on the list of deprecated flags and APIs, have a look at
+https://docs.docker.com/engine/deprecated/ where you can find the target removal dates
+
+## 18.04.0-ce (2018-04-10)
 
 ### Builder
 
-* Switch to -buildmode=pie [moby/moby#34369](https://github.com/moby/moby/pull/34369)
-* Allow Dockerfile to be outside of build-context [docker/cli#886](https://github.com/docker/cli/pull/886) 
-* Builder: fix wrong cache hits building from tars [moby/moby#36329](https://github.com/moby/moby/pull/36329)
-- Fixes files leaking to other images in a multi-stage build [moby/moby#36338](https://github.com/moby/moby/pull/36338)
+- Fix typos in builder and client. [moby/moby#36424](https://github.com/moby/moby/pull/36424)
 
 ### Client
 
-* Simplify the marshaling of compose types.Config [docker/cli#895](https://github.com/docker/cli/pull/895)
-+ Add support for multiple composefile when deploying [docker/cli#569](https://github.com/docker/cli/pull/569)
-- Fix broken Kubernetes stack flags [docker/cli#831](https://github.com/docker/cli/pull/831)
-- Fix stack marshaling for Kubernetes [docker/cli#890](https://github.com/docker/cli/pull/890)
-- Fix and simplify bash completion for service env, mounts and labels [docker/cli#682](https://github.com/docker/cli/pull/682)
-- Fix `before` and `since` filter for `docker ps` [moby/moby#35938](https://github.com/moby/moby/pull/35938)
-- Fix `--label-file` weird behavior [docker/cli#838](https://github.com/docker/cli/pull/838)
-- Fix compilation of defaultCredentialStore() on unsupported platforms [docker/cli#872](https://github.com/docker/cli/pull/872)
-* Improve and fix bash completion for images [docker/cli#717](https://github.com/docker/cli/pull/717)
-+ Added check for empty source in bind mount [docker/cli#824](https://github.com/docker/cli/pull/824)
-- Fix TLS from environment variables in client [moby/moby#36270](https://github.com/moby/moby/pull/36270)
-* docker build now runs faster when registry-specific credential helper(s) are configured [docker/cli#840](https://github.com/docker/cli/pull/840)
-* Update event filter zsh completion with `disable`, `enable`, `install` and `remove` [docker/cli#372](https://github.com/docker/cli/pull/372)
-* Produce errors when empty ids are passed into inspect calls [moby/moby#36144](https://github.com/moby/moby/pull/36144)
-* Marshall version for the k8s controller [docker/cli#891](https://github.com/docker/cli/pull/891)
-* Set a non-zero timeout for HTTP client communication with plugin backend [docker/cli#883](https://github.com/docker/cli/pull/883)
-+ Add DOCKER_TLS environment variable for --tls option [docker/cli#863](https://github.com/docker/cli/pull/863)
-+ Add --template-driver option for secrets/configs [docker/cli#896](https://github.com/docker/cli/pull/896)
-+ Move `docker trust` commands out of experimental [docker/cli#934](https://github.com/docker/cli/pull/934) [docker/cli#935](https://github.com/docker/cli/pull/935) [docker/cli#944](https://github.com/docker/cli/pull/944)
+* Print Stack API and Kubernetes versions in version command. [docker/cli#898](https://github.com/docker/cli/pull/898)
+- Fix Kubernetes duplication in version command. [docker/cli#953](https://github.com/docker/cli/pull/953)
+* Use HasAvailableFlags instead of HasFlags for Options in help. [docker/cli#959](https://github.com/docker/cli/pull/959)
++ Add support for mandatory variables to stack deploy. [docker/cli#893](https://github.com/docker/cli/pull/893)
+- Fix docker stack services command Port output. [docker/cli#943](https://github.com/docker/cli/pull/943)
+* Deprecate unencrypted storage. [docker/cli#561](https://github.com/docker/cli/pull/561)
+* Don't set a default filename for ConfigFile. [docker/cli#917](https://github.com/docker/cli/pull/917)
+- Fix compose network name. [docker/cli#941](https://github.com/docker/cli/pull/941)
 
 ### Logging
 
-* AWS logs - don't add new lines to maximum sized events [moby/moby#36078](https://github.com/moby/moby/pull/36078)
-* Move log validator logic after plugins are loaded [moby/moby#36306](https://github.com/moby/moby/pull/36306)
-* Support a proxy in Splunk log driver [moby/moby#36220](https://github.com/moby/moby/pull/36220)
-- Fix log tail with empty logs [moby/moby#36305](https://github.com/moby/moby/pull/36305)
+* Silent login: use credentials from cred store to login. [docker/cli#139](https://github.com/docker/cli/pull/139)
++ Add support for compressibility of log file. [moby/moby#29932](https://github.com/moby/moby/pull/29932)
+- Fix empty LogPath with non-blocking logging mode. [moby/moby#36272](https://github.com/moby/moby/pull/36272)
 
 ### Networking
 
-* Libnetwork revendoring [moby/moby#36137](https://github.com/moby/moby/pull/36137)
-- Fix for deadlock on exit with Memberlist revendor [docker/libnetwork#2040](https://github.com/docker/libnetwork/pull/2040)
-* Fix user specified ndots option [docker/libnetwork#2065](https://github.com/docker/libnetwork/pull/2065) 
-- Fix to use ContainerID for Windows instead of SandboxID [docker/libnetwork#2010](https://github.com/docker/libnetwork/pull/2010)
-* Verify NetworkingConfig to make sure EndpointSettings is not nil [moby/moby#36077](https://github.com/moby/moby/pull/36077)
-- Fix `DockerNetworkInternalMode` issue [moby/moby#36298](https://github.com/moby/moby/pull/36298)
-- Fix race in attachable network attachment [moby/moby#36191](https://github.com/moby/moby/pull/36191)
-- Fix timeout issue of `InspectNetwork` on AArch64 [moby/moby#36257](https://github.com/moby/moby/pull/36257)
-* Verbose info is missing for partial overlay ID [moby/moby#35989](https://github.com/moby/moby/pull/35989)
-* Update `FindNetwork` to address network name duplications [moby/moby#30897](https://github.com/moby/moby/pull/30897)
-* Disallow attaching ingress network [docker/swarmkit#2523](https://github.com/docker/swarmkit/pull/2523)
-- Prevent implicit removal of the ingress network [moby/moby#36538](https://github.com/moby/moby/pull/36538)
-- Fix stale HNS endpoints on Windows [moby/moby#36603](https://github.com/moby/moby/pull/36603)
-- IPAM fixes for duplicate IP addresses [docker/libnetwork#2104](https://github.com/docker/libnetwork/pull/2104) [docker/libnetwork#2105](https://github.com/docker/libnetwork/pull/2105)
+- Prevent explicit removal of ingress network. [moby/moby#36538](https://github.com/moby/moby/pull/36538)
 
 ### Runtime
 
-* Enable HotAdd for Windows [moby/moby#35414](https://github.com/moby/moby/pull/35414)
-* LCOW: Graphdriver fix deadlock in hotRemoveVHDs [moby/moby#36114](https://github.com/moby/moby/pull/36114)
-* LCOW: Regular mount if only one layer [moby/moby#36052](https://github.com/moby/moby/pull/36052)
-* Remove interim env var LCOW_API_PLATFORM_IF_OMITTED [moby/moby#36269](https://github.com/moby/moby/pull/36269)
-* Revendor Microsoft/opengcs @ v0.3.6 [moby/moby#36108](https://github.com/moby/moby/pull/36108)
-- Fix issue of ExitCode and PID not show up in Task.Status.ContainerStatus [moby/moby#36150](https://github.com/moby/moby/pull/36150)
-- Fix issue with plugin scanner going too deep [moby/moby#36119](https://github.com/moby/moby/pull/36119)
-* Do not make graphdriver homes private mounts [moby/moby#36047](https://github.com/moby/moby/pull/36047)
-* Do not recursive unmount on cleanup of zfs/btrfs [moby/moby#36237](https://github.com/moby/moby/pull/36237)
-* Don't restore image if layer does not exist [moby/moby#36304](https://github.com/moby/moby/pull/36304)
-* Adjust minimum API version for templated configs/secrets [moby/moby#36366](https://github.com/moby/moby/pull/36366)
-* Bump containerd to 1.0.2 (cfd04396dc68220d1cecbe686a6cc3aa5ce3667c) [moby/moby#36308](https://github.com/moby/moby/pull/36308)
-* Bump Golang to 1.9.4 [moby/moby#36243](https://github.com/moby/moby/pull/36243)
-* Ensure daemon root is unmounted on shutdown [moby/moby#36107](https://github.com/moby/moby/pull/36107)
-* Update runc to 6c55f98695e902427906eed2c799e566e3d3dfb5 [moby/moby#36222](https://github.com/moby/moby/pull/36222)
-- Fix container cleanup on daemon restart [moby/moby#36249](https://github.com/moby/moby/pull/36249)
-* Support SCTP port mapping (bump up API to v1.37) [moby/moby#33922](https://github.com/moby/moby/pull/33922)
-* Support SCTP port mapping [docker/cli#278](https://github.com/docker/cli/pull/278)
-- Fix Volumes property definition in ContainerConfig [moby/moby#35946](https://github.com/moby/moby/pull/35946)
-* Bump moby and dependencies [docker/cli#829](https://github.com/docker/cli/pull/829)
-* C.RWLayer: check for nil before use [moby/moby#36242](https://github.com/moby/moby/pull/36242)
-+ Add `REMOVE` and `ORPHANED` to TaskState [moby/moby#36146](https://github.com/moby/moby/pull/36146)
-- Fixed error detection using `IsErrNotFound` and `IsErrNotImplemented` for `ContainerStatPath`, `CopyFromContainer`, and `CopyToContainer` methods [moby/moby#35979](https://github.com/moby/moby/pull/35979)
-+ Add an integration/internal/container helper package [moby/moby#36266](https://github.com/moby/moby/pull/36266)
-+ Add canonical import path [moby/moby#36194](https://github.com/moby/moby/pull/36194)
-+ Add/use container.Exec() to integration [moby/moby#36326](https://github.com/moby/moby/pull/36326)
-- Fix "--node-generic-resource" singular/plural [moby/moby#36125](https://github.com/moby/moby/pull/36125)
-* Daemon.cleanupContainer: nullify container RWLayer upon release [moby/moby#36160](https://github.com/moby/moby/pull/36160)
-* Daemon: passdown the `--oom-kill-disable` option to containerd [moby/moby#36201](https://github.com/moby/moby/pull/36201)
-* Display a warn message when there is binding ports and net mode is host [moby/moby#35510](https://github.com/moby/moby/pull/35510)
-* Refresh containerd remotes on containerd restarted [moby/moby#36173](https://github.com/moby/moby/pull/36173)
-* Set daemon root to use shared propagation [moby/moby#36096](https://github.com/moby/moby/pull/36096)
-* Optimizations for recursive unmount [moby/moby#34379](https://github.com/moby/moby/pull/34379)
-* Perform plugin mounts in the runtime [moby/moby#35829](https://github.com/moby/moby/pull/35829)
-* Graphdriver: Fix RefCounter memory leak [moby/moby#36256](https://github.com/moby/moby/pull/36256)
-* Use continuity fs package for volume copy [moby/moby#36290](https://github.com/moby/moby/pull/36290)
-* Use proc/exe for reexec [moby/moby#36124](https://github.com/moby/moby/pull/36124)
-+ Add API support for templated secrets and configs [moby/moby#33702](https://github.com/moby/moby/pull/33702) and [moby/moby#36366](https://github.com/moby/moby/pull/36366)
-* Use rslave propagation for mounts from daemon root [moby/moby#36055](https://github.com/moby/moby/pull/36055)
-+ Add /proc/keys to masked paths [moby/moby#36368](https://github.com/moby/moby/pull/36368)
-* Bump Runc to 1.0.0-rc5 [moby/moby#36449](https://github.com/moby/moby/pull/36449)
-- Fixes `runc exec` on big-endian architectures [moby/moby#36449](https://github.com/moby/moby/pull/36449)
-* Use chroot when mount namespaces aren't provided [moby/moby#36449](https://github.com/moby/moby/pull/36449)
-- Fix systemd slice expansion so that it could be consumed by cAdvisor [moby/moby#36449](https://github.com/moby/moby/pull/36449)
-- Fix devices mounted with wrong uid/gid [moby/moby#36449](https://github.com/moby/moby/pull/36449)
-- Fix read-only containers with IPC private mounts `/dev/shm` read-only [moby/moby#36526](https://github.com/moby/moby/pull/36526)
+* Devmapper cleanup improvements. [moby/moby#36307](https://github.com/moby/moby/pull/36307)
+* Devmapper.Mounted: remove. [moby/moby#36437](https://github.com/moby/moby/pull/36437)
+* Devmapper/Remove(): use Rmdir, ignore errors. [moby/moby#36438](https://github.com/moby/moby/pull/36438)
+* LCOW - Change platform parser directive to FROM statement flag. [moby/moby#35089](https://github.com/moby/moby/pull/35089)
+* Split daemon service code to windows file. [moby/moby#36653](https://github.com/moby/moby/pull/36653)
+* Windows: Block pulling uplevel images. [moby/moby#36327](https://github.com/moby/moby/pull/36327)
+* Windows: Hyper-V containers are broken after 36586 was merged. [moby/moby#36610](https://github.com/moby/moby/pull/36610)
+* Windows: Move kernel_windows to use golang registry functions. [moby/moby#36617](https://github.com/moby/moby/pull/36617)
+* Windows: Pass back system errors on container exit. [moby/moby#35967](https://github.com/moby/moby/pull/35967)
+* Windows: Remove servicing mode. [moby/moby#36267](https://github.com/moby/moby/pull/36267)
+* Windows: Report Version and UBR. [moby/moby#36451](https://github.com/moby/moby/pull/36451)
+* Bump Runc to 1.0.0-rc5. [moby/moby#36449](https://github.com/moby/moby/pull/36449)
+* Mount failure indicates the path that failed. [moby/moby#36407](https://github.com/moby/moby/pull/36407)
+* Change return for errdefs.getImplementer(). [moby/moby#36489](https://github.com/moby/moby/pull/36489)
+* Client: fix hijackedconn reading from buffer. [moby/moby#36663](https://github.com/moby/moby/pull/36663)
+* Content encoding negotiation added to archive request. [moby/moby#36164](https://github.com/moby/moby/pull/36164)
+* Daemon/stats: more resilient cpu sampling. [moby/moby#36519](https://github.com/moby/moby/pull/36519)
+* Daemon/stats: remove obnoxious types file. [moby/moby#36494](https://github.com/moby/moby/pull/36494)
+* Daemon: use context error rather than inventing new one. [moby/moby#36670](https://github.com/moby/moby/pull/36670)
+* Enable CRIU on non-amd64 architectures (v2). [moby/moby#36676](https://github.com/moby/moby/pull/36676)
+- Fixes intermittent client hang after closing stdin to attached container [moby/moby#36517](https://github.com/moby/moby/pull/36517)
+- Fix daemon panic on container export after restart [moby/moby#36586](https://github.com/moby/moby/pull/36586)
+- Follow-up fixes on multi-stage moby's Dockerfile. [moby/moby#36425](https://github.com/moby/moby/pull/36425)
+* Freeze busybox and latest glibc in Docker image. [moby/moby#36375](https://github.com/moby/moby/pull/36375)
+* If container will run as non root user, drop permitted, effective caps early. [moby/moby#36587](https://github.com/moby/moby/pull/36587)
+* Layer: remove metadata store interface. [moby/moby#36504](https://github.com/moby/moby/pull/36504)
+* Minor optimizations to dockerd. [moby/moby#36577](https://github.com/moby/moby/pull/36577)
+* Whitelist statx syscall. [moby/moby#36417](https://github.com/moby/moby/pull/36417)
++ Add missing error return for plugin creation. [moby/moby#36646](https://github.com/moby/moby/pull/36646)
+- Fix AppArmor not being applied to Exec processes. [moby/moby#36466](https://github.com/moby/moby/pull/36466)
+* Daemon/logger/ring.go: log error not instance. [moby/moby#36475](https://github.com/moby/moby/pull/36475)
+- Fix stats collector spinning CPU if no stats are collected. [moby/moby#36609](https://github.com/moby/moby/pull/36609)
+- Fix(distribution): digest cache should not be moved if it was an auth. [moby/moby#36509](https://github.com/moby/moby/pull/36509)
+- Make sure plugin container is removed on failure. [moby/moby#36715](https://github.com/moby/moby/pull/36715)
+* Bump to containerd 1.0.3. [moby/moby#36749](https://github.com/moby/moby/pull/36749)
+* Don't sort plugin mount slice. [moby/moby#36711](https://github.com/moby/moby/pull/36711)
 
 ### Swarm Mode
 
-* Replace EC Private Key with PKCS#8 PEMs [docker/swarmkit#2246](https://github.com/docker/swarmkit/pull/2246)
-* Fix IP overlap with empty EndpointSpec [docker/swarmkit #2505](https://github.com/docker/swarmkit/pull/2505)
-* Add support for Support SCTP port mapping [docker/swarmkit#2298](https://github.com/docker/swarmkit/pull/2298)
-* Do not reschedule tasks if only placement constraints change and are satisfied by the assigned node [docker/swarmkit#2496](https://github.com/docker/swarmkit/pull/2496)
-* Ensure task reaper stopChan is closed no more than once [docker/swarmkit #2491](https://github.com/docker/swarmkit/pull/2491)
-* Synchronization fixes [docker/swarmkit#2495](https://github.com/docker/swarmkit/pull/2495)
-* Add log message to indicate message send retry if streaming unimplemented [docker/swarmkit#2483](https://github.com/docker/swarmkit/pull/2483)
-* Debug logs for session, node events on dispatcher, heartbeats [docker/swarmkit#2486](https://github.com/docker/swarmkit/pull/2486)
-+ Add swarm types to bash completion event type filter [docker/cli#888](https://github.com/docker/cli/pull/888)
-- Fix issue where network inspect does not show Created time for networks in swarm scope [moby/moby#36095](https://github.com/moby/moby/pull/36095)
+* Fixes for synchronizing the dispatcher shutdown with in-progress rpcs. [moby/moby#36371](https://github.com/moby/moby/pull/36371)
+* Increase raft ElectionTick to 10xHeartbeatTick. [moby/moby#36672](https://github.com/moby/moby/pull/36672)
+* Make Swarm manager Raft quorum parameters configurable in daemon config. [moby/moby#36726](https://github.com/moby/moby/pull/36726)
+* Ingress network should not be attachable. [docker/swarmkit#2523](https://github.com/docker/swarmkit/pull/2523)
+* [manager/state] Add fernet as an option for raft encryption. [docker/swarmkit#2535](https://github.com/docker/swarmkit/pull/2535)
+* Log GRPC server errors.  [docker/swarmkit#2541](https://github.com/docker/swarmkit/pull/2541)
+* Log leadership changes at the manager level. [docker/swarmkit#2542](https://github.com/docker/swarmkit/pull/2542)
+* Remove the containerd executor. [docker/swarmkit#2568](https://github.com/docker/swarmkit/pull/2568)
+* Agent: backoff session when no remotes are available. [docker/swarmkit#2570](https://github.com/docker/swarmkit/pull/2570)
+* [ca/manager] Remove root CA key encryption support entirely. [docker/swarmkit#2573](https://github.com/docker/swarmkit/pull/2573)
+- Fix agent logging race. [docker/swarmkit#2578](https://github.com/docker/swarmkit/pull/2578)
+* Adding logic to restore networks in order. [docker/swarmkit#2571](https://github.com/docker/swarmkit/pull/2571)

VERSION

@@ -1 +1 @@
-18.03.0-ce
+18.04.0-ce

components/cli/VERSION

@@ -1 +1 @@
-18.03.0-ce
+18.04.0-ce

components/cli/appveyor.yml

@@ -0,0 +1,23 @@
+version: "{build}"
+
+clone_folder: c:\gopath\src\github.com\docker\cli
+
+environment:
+  GOPATH: c:\gopath
+  GOVERSION: 1.10
+  DEPVERSION: v0.4.1
+
+install:
+  - rmdir c:\go /s /q
+  - appveyor DownloadFile https://storage.googleapis.com/golang/go%GOVERSION%.windows-amd64.msi
+  - msiexec /i go%GOVERSION%.windows-amd64.msi /q
+  - go version
+  - go env
+
+deploy: false
+
+build_script:
+  - ps: .\scripts\make.ps1 -Binary
+
+test_script:
+  - ps: .\scripts\make.ps1 -TestUnit

components/cli/cli/cobra.go

@@ -128,7 +128,7 @@ Examples:
 {{ .Example }}
 
 {{- end}}
-{{- if .HasFlags}}
+{{- if .HasAvailableFlags}}
 
 Options:
 {{ wrappedFlagUsages . | trimRightSpace}}

components/cli/cli/command/bundlefile/bundlefile_test.go

@@ -5,7 +5,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestLoadFileV01Success(t *testing.T) {
@@ -25,9 +26,9 @@ func TestLoadFileV01Success(t *testing.T) {
 	}`)
 
 	bundle, err := LoadFile(reader)
-	assert.NoError(t, err)
-	assert.Equal(t, "0.1", bundle.Version)
-	assert.Len(t, bundle.Services, 2)
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal("0.1", bundle.Version))
+	assert.Check(t, is.Len(bundle.Services, 2))
 }
 
 func TestLoadFileSyntaxError(t *testing.T) {
@@ -37,7 +38,7 @@ func TestLoadFileSyntaxError(t *testing.T) {
 	}`)
 
 	_, err := LoadFile(reader)
-	assert.EqualError(t, err, "JSON syntax error at byte 37: invalid character 'u' looking for beginning of value")
+	assert.Error(t, err, "JSON syntax error at byte 37: invalid character 'u' looking for beginning of value")
 }
 
 func TestLoadFileTypeError(t *testing.T) {
@@ -52,7 +53,7 @@ func TestLoadFileTypeError(t *testing.T) {
 	}`)
 
 	_, err := LoadFile(reader)
-	assert.EqualError(t, err, "Unexpected type at byte 94. Expected []string but received string.")
+	assert.Error(t, err, "Unexpected type at byte 94. Expected []string but received string.")
 }
 
 func TestPrint(t *testing.T) {
@@ -66,12 +67,12 @@ func TestPrint(t *testing.T) {
 			},
 		},
 	}
-	assert.NoError(t, Print(&buffer, bundle))
+	assert.Check(t, Print(&buffer, bundle))
 	output := buffer.String()
-	assert.Contains(t, output, "\"Image\": \"image\"")
-	assert.Contains(t, output,
+	assert.Check(t, is.Contains(output, "\"Image\": \"image\""))
+	assert.Check(t, is.Contains(output,
 		`"Command": [
                 "echo",
                 "something"
-            ]`)
+            ]`))
 }

components/cli/cli/command/checkpoint/create_test.go

@@ -6,10 +6,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestCheckpointCreateErrors(t *testing.T) {
@@ -42,7 +42,7 @@ func TestCheckpointCreateErrors(t *testing.T) {
 		cmd := newCreateCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -63,10 +63,10 @@ func TestCheckpointCreateWithOptions(t *testing.T) {
 	cmd.SetArgs([]string{"container-foo", checkpoint})
 	cmd.Flags().Set("leave-running", "true")
 	cmd.Flags().Set("checkpoint-dir", "/dir/foo")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "container-foo", containerID)
-	assert.Equal(t, checkpoint, checkpointID)
-	assert.Equal(t, "/dir/foo", checkpointDir)
-	assert.Equal(t, false, exit)
-	assert.Equal(t, checkpoint, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("container-foo", containerID))
+	assert.Check(t, is.Equal(checkpoint, checkpointID))
+	assert.Check(t, is.Equal("/dir/foo", checkpointDir))
+	assert.Check(t, is.Equal(false, exit))
+	assert.Check(t, is.Equal(checkpoint, strings.TrimSpace(cli.OutBuffer().String())))
 }

components/cli/cli/command/checkpoint/list_test.go

@@ -5,11 +5,11 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestCheckpointListErrors(t *testing.T) {
@@ -42,7 +42,7 @@ func TestCheckpointListErrors(t *testing.T) {
 		cmd := newListCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -60,8 +60,8 @@ func TestCheckpointListWithOptions(t *testing.T) {
 	cmd := newListCommand(cli)
 	cmd.SetArgs([]string{"container-foo"})
 	cmd.Flags().Set("checkpoint-dir", "/dir/foo")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "container-foo", containerID)
-	assert.Equal(t, "/dir/foo", checkpointDir)
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("container-foo", containerID))
+	assert.Check(t, is.Equal("/dir/foo", checkpointDir))
 	golden.Assert(t, cli.OutBuffer().String(), "checkpoint-list-with-options.golden")
 }

components/cli/cli/command/checkpoint/remove_test.go

@@ -5,10 +5,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestCheckpointRemoveErrors(t *testing.T) {
@@ -41,7 +41,7 @@ func TestCheckpointRemoveErrors(t *testing.T) {
 		cmd := newRemoveCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -58,8 +58,8 @@ func TestCheckpointRemoveWithOptions(t *testing.T) {
 	cmd := newRemoveCommand(cli)
 	cmd.SetArgs([]string{"container-foo", "checkpoint-bar"})
 	cmd.Flags().Set("checkpoint-dir", "/dir/foo")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "container-foo", containerID)
-	assert.Equal(t, "checkpoint-bar", checkpointID)
-	assert.Equal(t, "/dir/foo", checkpointDir)
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("container-foo", containerID))
+	assert.Check(t, is.Equal("checkpoint-bar", checkpointID))
+	assert.Check(t, is.Equal("/dir/foo", checkpointDir))
 }

components/cli/cli/command/cli.go

@@ -22,7 +22,6 @@ import (
 	"github.com/docker/docker/api/types"
 	registrytypes "github.com/docker/docker/api/types/registry"
 	"github.com/docker/docker/client"
-	"github.com/docker/go-connections/sockets"
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
@@ -53,18 +52,20 @@ type Cli interface {
 	DefaultVersion() string
 	ManifestStore() manifeststore.Store
 	RegistryClient(bool) registryclient.RegistryClient
+	ContentTrustEnabled() bool
 }
 
 // DockerCli is an instance the docker command line client.
 // Instances of the client can be returned from NewDockerCli.
 type DockerCli struct {
-	configFile *configfile.ConfigFile
-	in         *InStream
-	out        *OutStream
-	err        io.Writer
-	client     client.APIClient
-	serverInfo ServerInfo
-	clientInfo ClientInfo
+	configFile   *configfile.ConfigFile
+	in           *InStream
+	out          *OutStream
+	err          io.Writer
+	client       client.APIClient
+	serverInfo   ServerInfo
+	clientInfo   ClientInfo
+	contentTrust bool
 }
 
 // DefaultVersion returns api.defaultVersion or DOCKER_API_VERSION if specified.
@@ -122,6 +123,12 @@ func (cli *DockerCli) ClientInfo() ClientInfo {
 	return cli.clientInfo
 }
 
+// ContentTrustEnabled returns whether content trust has been enabled by an
+// environment variable.
+func (cli *DockerCli) ContentTrustEnabled() bool {
+	return cli.contentTrust
+}
+
 // ManifestStore returns a store for local manifests
 func (cli *DockerCli) ManifestStore() manifeststore.Store {
 	// TODO: support override default location from config file
@@ -238,8 +245,8 @@ func (c ClientInfo) HasKubernetes() bool {
 }
 
 // NewDockerCli returns a DockerCli instance with IO output and error streams set by in, out and err.
-func NewDockerCli(in io.ReadCloser, out, err io.Writer) *DockerCli {
-	return &DockerCli{in: NewInStream(in), out: NewOutStream(out), err: err}
+func NewDockerCli(in io.ReadCloser, out, err io.Writer, isTrusted bool) *DockerCli {
+	return &DockerCli{in: NewInStream(in), out: NewOutStream(out), err: err, contentTrust: isTrusted}
 }
 
 // NewAPIClientFromFlags creates a new APIClient from command line flags
@@ -260,12 +267,12 @@ func NewAPIClientFromFlags(opts *cliflags.CommonOptions, configFile *configfile.
 		verStr = tmpStr
 	}
 
-	httpClient, err := newHTTPClient(host, opts.TLSOptions)
-	if err != nil {
-		return &client.Client{}, err
-	}
-
-	return client.NewClient(host, verStr, httpClient, customHeaders)
+	return client.NewClientWithOpts(
+		withHTTPClient(opts.TLSOptions),
+		client.WithHTTPHeaders(customHeaders),
+		client.WithVersion(verStr),
+		client.WithHost(host),
+	)
 }
 
 func getServerHost(hosts []string, tlsOptions *tlsconfig.Options) (string, error) {
@@ -282,35 +289,32 @@ func getServerHost(hosts []string, tlsOptions *tlsconfig.Options) (string, error
 	return dopts.ParseHost(tlsOptions != nil, host)
 }
 
-func newHTTPClient(host string, tlsOptions *tlsconfig.Options) (*http.Client, error) {
-	if tlsOptions == nil {
-		// let the api client configure the default transport.
-		return nil, nil
-	}
-	opts := *tlsOptions
-	opts.ExclusiveRootPools = true
-	config, err := tlsconfig.Client(opts)
-	if err != nil {
-		return nil, err
-	}
-	tr := &http.Transport{
-		TLSClientConfig: config,
-		DialContext: (&net.Dialer{
-			KeepAlive: 30 * time.Second,
-			Timeout:   30 * time.Second,
-		}).DialContext,
-	}
-	hostURL, err := client.ParseHostURL(host)
-	if err != nil {
-		return nil, err
-	}
+func withHTTPClient(tlsOpts *tlsconfig.Options) func(*client.Client) error {
+	return func(c *client.Client) error {
+		if tlsOpts == nil {
+			// Use the default HTTPClient
+			return nil
+		}
 
-	sockets.ConfigureTransport(tr, hostURL.Scheme, hostURL.Host)
+		opts := *tlsOpts
+		opts.ExclusiveRootPools = true
+		tlsConfig, err := tlsconfig.Client(opts)
+		if err != nil {
+			return err
+		}
 
-	return &http.Client{
-		Transport:     tr,
-		CheckRedirect: client.CheckRedirect,
-	}, nil
+		httpClient := &http.Client{
+			Transport: &http.Transport{
+				TLSClientConfig: tlsConfig,
+				DialContext: (&net.Dialer{
+					KeepAlive: 30 * time.Second,
+					Timeout:   30 * time.Second,
+				}).DialContext,
+			},
+			CheckRedirect: client.CheckRedirect,
+		}
+		return client.WithHTTPClient(httpClient)(c)
+	}
 }
 
 // UserAgent returns the user agent string used for making API requests

components/cli/cli/command/cli_test.go

@@ -3,24 +3,27 @@ package command
 import (
 	"crypto/x509"
 	"os"
+	"runtime"
 	"testing"
 
 	cliconfig "github.com/docker/cli/cli/config"
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/cli/flags"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/client"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/fs"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
 func TestNewAPIClientFromFlags(t *testing.T) {
 	host := "unix://path"
+	if runtime.GOOS == "windows" {
+		host = "npipe://./"
+	}
 	opts := &flags.CommonOptions{Hosts: []string{host}}
 	configFile := &configfile.ConfigFile{
 		HTTPHeaders: map[string]string{
@@ -28,15 +31,15 @@ func TestNewAPIClientFromFlags(t *testing.T) {
 		},
 	}
 	apiclient, err := NewAPIClientFromFlags(opts, configFile)
-	require.NoError(t, err)
-	assert.Equal(t, host, apiclient.DaemonHost())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(host, apiclient.DaemonHost()))
 
 	expectedHeaders := map[string]string{
 		"My-Header":  "Custom-Value",
 		"User-Agent": UserAgent(),
 	}
-	assert.Equal(t, expectedHeaders, apiclient.(*client.Client).CustomHTTPHeaders())
-	assert.Equal(t, api.DefaultVersion, apiclient.ClientVersion())
+	assert.Check(t, is.DeepEqual(expectedHeaders, apiclient.(*client.Client).CustomHTTPHeaders()))
+	assert.Check(t, is.Equal(api.DefaultVersion, apiclient.ClientVersion()))
 }
 
 func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
@@ -46,20 +49,20 @@ func TestNewAPIClientFromFlagsWithAPIVersionFromEnv(t *testing.T) {
 	opts := &flags.CommonOptions{}
 	configFile := &configfile.ConfigFile{}
 	apiclient, err := NewAPIClientFromFlags(opts, configFile)
-	require.NoError(t, err)
-	assert.Equal(t, customVersion, apiclient.ClientVersion())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(customVersion, apiclient.ClientVersion()))
 }
 
 // TODO: use gotestyourself/env.Patch
 func patchEnvVariable(t *testing.T, key, value string) func() {
 	oldValue, ok := os.LookupEnv(key)
-	require.NoError(t, os.Setenv(key, value))
+	assert.NilError(t, os.Setenv(key, value))
 	return func() {
 		if !ok {
-			require.NoError(t, os.Unsetenv(key))
+			assert.NilError(t, os.Unsetenv(key))
 			return
 		}
-		require.NoError(t, os.Setenv(key, oldValue))
+		assert.NilError(t, os.Setenv(key, oldValue))
 	}
 }
 
@@ -125,8 +128,8 @@ func TestInitializeFromClient(t *testing.T) {
 
 			cli := &DockerCli{client: apiclient}
 			cli.initializeFromClient()
-			assert.Equal(t, testcase.expectedServer, cli.serverInfo)
-			assert.Equal(t, testcase.negotiated, apiclient.negotiated)
+			assert.Check(t, is.DeepEqual(testcase.expectedServer, cli.serverInfo))
+			assert.Check(t, is.Equal(testcase.negotiated, apiclient.negotiated))
 		})
 	}
 }
@@ -164,8 +167,8 @@ func TestExperimentalCLI(t *testing.T) {
 			cli := &DockerCli{client: apiclient, err: os.Stderr}
 			cliconfig.SetDir(dir.Path())
 			err := cli.Initialize(flags.NewClientOptions())
-			assert.NoError(t, err)
-			assert.Equal(t, testcase.expectedExperimentalCLI, cli.ClientInfo().HasExperimental)
+			assert.NilError(t, err)
+			assert.Check(t, is.Equal(testcase.expectedExperimentalCLI, cli.ClientInfo().HasExperimental))
 		})
 	}
 }
@@ -267,9 +270,9 @@ func TestOrchestratorSwitch(t *testing.T) {
 				options.Common.Orchestrator = testcase.flagOrchestrator
 			}
 			err := cli.Initialize(options)
-			assert.NoError(t, err)
-			assert.Equal(t, testcase.expectedKubernetes, cli.ClientInfo().HasKubernetes())
-			assert.Equal(t, testcase.expectedOrchestrator, string(cli.ClientInfo().Orchestrator))
+			assert.NilError(t, err)
+			assert.Check(t, is.Equal(testcase.expectedKubernetes, cli.ClientInfo().HasKubernetes()))
+			assert.Check(t, is.Equal(testcase.expectedOrchestrator, string(cli.ClientInfo().Orchestrator)))
 		})
 	}
 }
@@ -331,11 +334,11 @@ func TestGetClientWithPassword(t *testing.T) {
 
 			_, err := getClientWithPassword(passRetriever, newClient)
 			if testcase.expectedErr != "" {
-				testutil.ErrorContains(t, err, testcase.expectedErr)
+				assert.ErrorContains(t, err, testcase.expectedErr)
 				return
 			}
 
-			assert.NoError(t, err)
+			assert.NilError(t, err)
 		})
 	}
 }

components/cli/cli/command/config/create_test.go

@@ -8,12 +8,12 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 const configDataFile = "config-create-with-name.golden"
@@ -47,7 +47,7 @@ func TestConfigCreateErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -70,9 +70,9 @@ func TestConfigCreateWithName(t *testing.T) {
 
 	cmd := newConfigCreateCommand(cli)
 	cmd.SetArgs([]string{name, filepath.Join("testdata", configDataFile)})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, string(actual), configDataFile)
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }
 
 func TestConfigCreateWithLabels(t *testing.T) {
@@ -83,7 +83,7 @@ func TestConfigCreateWithLabels(t *testing.T) {
 	name := "foo"
 
 	data, err := ioutil.ReadFile(filepath.Join("testdata", configDataFile))
-	assert.NoError(t, err)
+	assert.NilError(t, err)
 
 	expected := swarm.ConfigSpec{
 		Annotations: swarm.Annotations{
@@ -109,8 +109,8 @@ func TestConfigCreateWithLabels(t *testing.T) {
 	cmd.SetArgs([]string{name, filepath.Join("testdata", configDataFile)})
 	cmd.Flags().Set("label", "lbl1=Label-foo")
 	cmd.Flags().Set("label", "lbl2=Label-bar")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }
 
 func TestConfigCreateWithTemplatingDriver(t *testing.T) {
@@ -138,6 +138,6 @@ func TestConfigCreateWithTemplatingDriver(t *testing.T) {
 	cmd := newConfigCreateCommand(cli)
 	cmd.SetArgs([]string{name, filepath.Join("testdata", configDataFile)})
 	cmd.Flags().Set("template-driver", expectedDriver.Name)
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }

components/cli/cli/command/config/inspect_test.go

@@ -11,9 +11,8 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestConfigInspectErrors(t *testing.T) {
@@ -62,7 +61,7 @@ func TestConfigInspectErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -96,7 +95,7 @@ func TestConfigInspectWithoutFormat(t *testing.T) {
 		cli := test.NewFakeCli(&fakeClient{configInspectFunc: tc.configInspectFunc})
 		cmd := newConfigInspectCommand(cli)
 		cmd.SetArgs(tc.args)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("config-inspect-without-format.%s.golden", tc.name))
 	}
 }
@@ -133,7 +132,7 @@ func TestConfigInspectWithFormat(t *testing.T) {
 		cmd := newConfigInspectCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.Flags().Set("format", tc.format)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("config-inspect-with-format.%s.golden", tc.name))
 	}
 }
@@ -167,7 +166,7 @@ func TestConfigInspectPretty(t *testing.T) {
 
 		cmd.SetArgs([]string{"configID"})
 		cmd.Flags().Set("pretty", "true")
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("config-inspect-pretty.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/config/ls_test.go

@@ -12,9 +12,9 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestConfigListErrors(t *testing.T) {
@@ -42,7 +42,7 @@ func TestConfigListErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -72,7 +72,7 @@ func TestConfigList(t *testing.T) {
 		},
 	})
 	cmd := newConfigListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "config-list-sort.golden")
 }
 
@@ -89,7 +89,7 @@ func TestConfigListWithQuietOption(t *testing.T) {
 	})
 	cmd := newConfigListCommand(cli)
 	cmd.Flags().Set("quiet", "true")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "config-list-with-quiet-option.golden")
 }
 
@@ -108,7 +108,7 @@ func TestConfigListWithConfigFormat(t *testing.T) {
 		ConfigFormat: "{{ .Name }} {{ .Labels }}",
 	})
 	cmd := newConfigListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "config-list-with-config-format.golden")
 }
 
@@ -125,15 +125,15 @@ func TestConfigListWithFormat(t *testing.T) {
 	})
 	cmd := newConfigListCommand(cli)
 	cmd.Flags().Set("format", "{{ .Name }} {{ .Labels }}")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "config-list-with-format.golden")
 }
 
 func TestConfigListWithFilter(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
 		configListFunc: func(options types.ConfigListOptions) ([]swarm.Config, error) {
-			assert.Equal(t, "foo", options.Filters.Get("name")[0])
-			assert.Equal(t, "lbl1=Label-bar", options.Filters.Get("label")[0])
+			assert.Check(t, is.Equal("foo", options.Filters.Get("name")[0]))
+			assert.Check(t, is.Equal("lbl1=Label-bar", options.Filters.Get("label")[0]))
 			return []swarm.Config{
 				*Config(ConfigID("ID-foo"),
 					ConfigName("foo"),
@@ -153,6 +153,6 @@ func TestConfigListWithFilter(t *testing.T) {
 	cmd := newConfigListCommand(cli)
 	cmd.Flags().Set("filter", "name=foo")
 	cmd.Flags().Set("filter", "label=lbl1=Label-bar")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "config-list-with-filter.golden")
 }

components/cli/cli/command/config/remove_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestConfigRemoveErrors(t *testing.T) {
@@ -37,7 +37,7 @@ func TestConfigRemoveErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -52,9 +52,9 @@ func TestConfigRemoveWithName(t *testing.T) {
 	})
 	cmd := newConfigRemoveCommand(cli)
 	cmd.SetArgs(names)
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, names, strings.Split(strings.TrimSpace(cli.OutBuffer().String()), "\n"))
-	assert.Equal(t, names, removedConfigs)
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.DeepEqual(names, strings.Split(strings.TrimSpace(cli.OutBuffer().String()), "\n")))
+	assert.Check(t, is.DeepEqual(names, removedConfigs))
 }
 
 func TestConfigRemoveContinueAfterError(t *testing.T) {
@@ -74,6 +74,6 @@ func TestConfigRemoveContinueAfterError(t *testing.T) {
 	cmd := newConfigRemoveCommand(cli)
 	cmd.SetArgs(names)
 	cmd.SetOutput(ioutil.Discard)
-	assert.EqualError(t, cmd.Execute(), "error removing config: foo")
-	assert.Equal(t, names, removedConfigs)
+	assert.Error(t, cmd.Execute(), "error removing config: foo")
+	assert.Check(t, is.DeepEqual(names, removedConfigs))
 }

components/cli/cli/command/container/attach_test.go

@@ -7,11 +7,10 @@ import (
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewAttachCommandErrors(t *testing.T) {
@@ -74,7 +73,7 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		cmd := NewAttachCommand(test.NewFakeCli(&fakeClient{inspectFunc: tc.containerInspectFunc}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -101,9 +100,7 @@ func TestGetExitStatus(t *testing.T) {
 		},
 		{
 			result: &container.ContainerWaitOKBody{
-				Error: &container.ContainerWaitOKBodyError{
-					expectedErr.Error(),
-				},
+				Error: &container.ContainerWaitOKBodyError{expectedErr.Error()},
 			},
 			expectedError: expectedErr,
 		},
@@ -123,6 +120,10 @@ func TestGetExitStatus(t *testing.T) {
 			resultC <- *testcase.result
 		}
 		err := getExitStatus(errC, resultC)
-		assert.Equal(t, testcase.expectedError, err)
+		if testcase.expectedError == nil {
+			assert.NilError(t, err)
+		} else {
+			assert.Error(t, err, testcase.expectedError.Error())
+		}
 	}
 }

components/cli/cli/command/container/cp_test.go

@@ -9,13 +9,12 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/archive"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/fs"
 	"github.com/gotestyourself/gotestyourself/skip"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestRunCopyWithInvalidArguments(t *testing.T) {
@@ -44,7 +43,7 @@ func TestRunCopyWithInvalidArguments(t *testing.T) {
 	for _, testcase := range testcases {
 		t.Run(testcase.doc, func(t *testing.T) {
 			err := runCopy(test.NewFakeCli(nil), testcase.options)
-			assert.EqualError(t, err, testcase.expectedErr)
+			assert.Error(t, err, testcase.expectedErr)
 		})
 	}
 }
@@ -54,16 +53,16 @@ func TestRunCopyFromContainerToStdout(t *testing.T) {
 
 	fakeClient := &fakeClient{
 		containerCopyFromFunc: func(container, srcPath string) (io.ReadCloser, types.ContainerPathStat, error) {
-			assert.Equal(t, "container", container)
+			assert.Check(t, is.Equal("container", container))
 			return ioutil.NopCloser(strings.NewReader(tarContent)), types.ContainerPathStat{}, nil
 		},
 	}
 	options := copyOptions{source: "container:/path", destination: "-"}
 	cli := test.NewFakeCli(fakeClient)
 	err := runCopy(cli, options)
-	require.NoError(t, err)
-	assert.Equal(t, tarContent, cli.OutBuffer().String())
-	assert.Equal(t, "", cli.ErrBuffer().String())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(tarContent, cli.OutBuffer().String()))
+	assert.Check(t, is.Equal("", cli.ErrBuffer().String()))
 }
 
 func TestRunCopyFromContainerToFilesystem(t *testing.T) {
@@ -73,7 +72,7 @@ func TestRunCopyFromContainerToFilesystem(t *testing.T) {
 
 	fakeClient := &fakeClient{
 		containerCopyFromFunc: func(container, srcPath string) (io.ReadCloser, types.ContainerPathStat, error) {
-			assert.Equal(t, "container", container)
+			assert.Check(t, is.Equal("container", container))
 			readCloser, err := archive.TarWithOptions(destDir.Path(), &archive.TarOptions{})
 			return readCloser, types.ContainerPathStat{}, err
 		},
@@ -81,13 +80,13 @@ func TestRunCopyFromContainerToFilesystem(t *testing.T) {
 	options := copyOptions{source: "container:/path", destination: destDir.Path()}
 	cli := test.NewFakeCli(fakeClient)
 	err := runCopy(cli, options)
-	require.NoError(t, err)
-	assert.Equal(t, "", cli.OutBuffer().String())
-	assert.Equal(t, "", cli.ErrBuffer().String())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal("", cli.OutBuffer().String()))
+	assert.Check(t, is.Equal("", cli.ErrBuffer().String()))
 
 	content, err := ioutil.ReadFile(destDir.Join("file1"))
-	require.NoError(t, err)
-	assert.Equal(t, "content\n", string(content))
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal("content\n", string(content)))
 }
 
 func TestRunCopyFromContainerToFilesystemMissingDestinationDirectory(t *testing.T) {
@@ -97,7 +96,7 @@ func TestRunCopyFromContainerToFilesystemMissingDestinationDirectory(t *testing.
 
 	fakeClient := &fakeClient{
 		containerCopyFromFunc: func(container, srcPath string) (io.ReadCloser, types.ContainerPathStat, error) {
-			assert.Equal(t, "container", container)
+			assert.Check(t, is.Equal("container", container))
 			readCloser, err := archive.TarWithOptions(destDir.Path(), &archive.TarOptions{})
 			return readCloser, types.ContainerPathStat{}, err
 		},
@@ -109,7 +108,7 @@ func TestRunCopyFromContainerToFilesystemMissingDestinationDirectory(t *testing.
 	}
 	cli := test.NewFakeCli(fakeClient)
 	err := runCopy(cli, options)
-	testutil.ErrorContains(t, err, destDir.Join("missing"))
+	assert.ErrorContains(t, err, destDir.Join("missing"))
 }
 
 func TestRunCopyToContainerFromFileWithTrailingSlash(t *testing.T) {
@@ -122,7 +121,12 @@ func TestRunCopyToContainerFromFileWithTrailingSlash(t *testing.T) {
 	}
 	cli := test.NewFakeCli(&fakeClient{})
 	err := runCopy(cli, options)
-	testutil.ErrorContains(t, err, "not a directory")
+
+	expectedError := "not a directory"
+	if runtime.GOOS == "windows" {
+		expectedError = "The filename, directory name, or volume label syntax is incorrect"
+	}
+	assert.ErrorContains(t, err, expectedError)
 }
 
 func TestRunCopyToContainerSourceDoesNotExist(t *testing.T) {
@@ -136,7 +140,7 @@ func TestRunCopyToContainerSourceDoesNotExist(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		expected = "cannot find the file specified"
 	}
-	testutil.ErrorContains(t, err, expected)
+	assert.ErrorContains(t, err, expected)
 }
 
 func TestSplitCpArg(t *testing.T) {
@@ -181,8 +185,8 @@ func TestSplitCpArg(t *testing.T) {
 			skip.IfCondition(t, testcase.os != "" && testcase.os != runtime.GOOS)
 
 			container, path := splitCpArg(testcase.path)
-			assert.Equal(t, testcase.expectedContainer, container)
-			assert.Equal(t, testcase.expectedPath, path)
+			assert.Check(t, is.Equal(testcase.expectedContainer, container))
+			assert.Check(t, is.Equal(testcase.expectedPath, path))
 		})
 	}
 }

components/cli/cli/command/container/create.go

@@ -21,8 +21,9 @@ import (
 )
 
 type createOptions struct {
-	name     string
-	platform string
+	name      string
+	platform  string
+	untrusted bool
 }
 
 // NewCreateCommand creates a new cobra.Command for `docker create`
@@ -53,7 +54,7 @@ func NewCreateCommand(dockerCli command.Cli) *cobra.Command {
 	flags.Bool("help", false, "Print usage")
 
 	command.AddPlatformFlag(flags, &opts.platform)
-	command.AddTrustVerificationFlags(flags)
+	command.AddTrustVerificationFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 	copts = addFlags(flags)
 	return cmd
 }
@@ -64,7 +65,7 @@ func runCreate(dockerCli command.Cli, flags *pflag.FlagSet, opts *createOptions,
 		reportError(dockerCli.Err(), "create", err.Error(), true)
 		return cli.StatusError{StatusCode: 125}
 	}
-	response, err := createContainer(context.Background(), dockerCli, containerConfig, opts.name, opts.platform)
+	response, err := createContainer(context.Background(), dockerCli, containerConfig, opts)
 	if err != nil {
 		return err
 	}
@@ -158,7 +159,7 @@ func newCIDFile(path string) (*cidFile, error) {
 	return &cidFile{path: path, file: f}, nil
 }
 
-func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig *containerConfig, name string, platform string) (*container.ContainerCreateCreatedBody, error) {
+func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig *containerConfig, opts *createOptions) (*container.ContainerCreateCreatedBody, error) {
 	config := containerConfig.Config
 	hostConfig := containerConfig.HostConfig
 	networkingConfig := containerConfig.NetworkingConfig
@@ -182,7 +183,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig
 	if named, ok := ref.(reference.Named); ok {
 		namedRef = reference.TagNameOnly(named)
 
-		if taggedRef, ok := namedRef.(reference.NamedTagged); ok && command.IsTrusted() {
+		if taggedRef, ok := namedRef.(reference.NamedTagged); ok && !opts.untrusted {
 			var err error
 			trustedRef, err = image.TrustedReference(ctx, dockerCli, taggedRef, nil)
 			if err != nil {
@@ -193,7 +194,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig
 	}
 
 	//create the container
-	response, err := dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, name)
+	response, err := dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, opts.name)
 
 	//if image not found try to pull it
 	if err != nil {
@@ -201,7 +202,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig
 			fmt.Fprintf(stderr, "Unable to find image '%s' locally\n", reference.FamiliarString(namedRef))
 
 			// we don't want to write to stdout anything apart from container.ID
-			if err := pullImage(ctx, dockerCli, config.Image, platform, stderr); err != nil {
+			if err := pullImage(ctx, dockerCli, config.Image, opts.platform, stderr); err != nil {
 				return nil, err
 			}
 			if taggedRef, ok := namedRef.(reference.NamedTagged); ok && trustedRef != nil {
@@ -211,7 +212,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerConfig
 			}
 			// Retry
 			var retryErr error
-			response, retryErr = dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, name)
+			response, retryErr = dockerCli.Client().ContainerCreate(ctx, config, hostConfig, networkingConfig, opts.name)
 			if retryErr != nil {
 				return nil, retryErr
 			}

components/cli/cli/command/container/create_test.go

@@ -2,6 +2,7 @@ package container
 
 import (
 	"context"
+	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
@@ -10,23 +11,24 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/docker/cli/internal/test/notary"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
+	"github.com/google/go-cmp/cmp"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/fs"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestCIDFileNoOPWithNoFilename(t *testing.T) {
 	file, err := newCIDFile("")
-	require.NoError(t, err)
-	assert.Equal(t, &cidFile{}, file)
+	assert.NilError(t, err)
+	assert.DeepEqual(t, &cidFile{}, file, cmp.AllowUnexported(cidFile{}))
 
-	assert.NoError(t, file.Write("id"))
-	assert.NoError(t, file.Close())
+	assert.NilError(t, file.Write("id"))
+	assert.NilError(t, file.Close())
 }
 
 func TestNewCIDFileWhenFileAlreadyExists(t *testing.T) {
@@ -34,7 +36,7 @@ func TestNewCIDFileWhenFileAlreadyExists(t *testing.T) {
 	defer tempfile.Remove()
 
 	_, err := newCIDFile(tempfile.Path())
-	testutil.ErrorContains(t, err, "Container ID file found")
+	assert.ErrorContains(t, err, "Container ID file found")
 }
 
 func TestCIDFileCloseWithNoWrite(t *testing.T) {
@@ -43,12 +45,12 @@ func TestCIDFileCloseWithNoWrite(t *testing.T) {
 
 	path := tempdir.Join("cidfile")
 	file, err := newCIDFile(path)
-	require.NoError(t, err)
-	assert.Equal(t, file.path, path)
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(file.path, path))
 
-	assert.NoError(t, file.Close())
+	assert.NilError(t, file.Close())
 	_, err = os.Stat(path)
-	assert.True(t, os.IsNotExist(err))
+	assert.Check(t, os.IsNotExist(err))
 }
 
 func TestCIDFileCloseWithWrite(t *testing.T) {
@@ -57,18 +59,18 @@ func TestCIDFileCloseWithWrite(t *testing.T) {
 
 	path := tempdir.Join("cidfile")
 	file, err := newCIDFile(path)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	content := "id"
-	assert.NoError(t, file.Write(content))
+	assert.NilError(t, file.Write(content))
 
 	actual, err := ioutil.ReadFile(path)
-	require.NoError(t, err)
-	assert.Equal(t, content, string(actual))
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(content, string(actual)))
 
-	assert.NoError(t, file.Close())
+	assert.NilError(t, file.Close())
 	_, err = os.Stat(path)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 }
 
 func TestCreateContainerPullsImageIfMissing(t *testing.T) {
@@ -107,12 +109,61 @@ func TestCreateContainerPullsImageIfMissing(t *testing.T) {
 		},
 		HostConfig: &container.HostConfig{},
 	}
-	body, err := createContainer(context.Background(), cli, config, "name", runtime.GOOS)
-	require.NoError(t, err)
+	body, err := createContainer(context.Background(), cli, config, &createOptions{
+		name:      "name",
+		platform:  runtime.GOOS,
+		untrusted: true,
+	})
+	assert.NilError(t, err)
 	expected := container.ContainerCreateCreatedBody{ID: containerID}
-	assert.Equal(t, expected, *body)
+	assert.Check(t, is.DeepEqual(expected, *body))
 	stderr := cli.ErrBuffer().String()
-	assert.Contains(t, stderr, "Unable to find image 'does-not-exist-locally:latest' locally")
+	assert.Check(t, is.Contains(stderr, "Unable to find image 'does-not-exist-locally:latest' locally"))
+}
+
+func TestNewCreateCommandWithContentTrustErrors(t *testing.T) {
+	testCases := []struct {
+		name          string
+		args          []string
+		expectedError string
+		notaryFunc    test.NotaryClientFuncType
+	}{
+		{
+			name:          "offline-notary-server",
+			notaryFunc:    notary.GetOfflineNotaryRepository,
+			expectedError: "client is offline",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "uninitialized-notary-server",
+			notaryFunc:    notary.GetUninitializedNotaryRepository,
+			expectedError: "remote trust data does not exist",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "empty-notary-server",
+			notaryFunc:    notary.GetEmptyTargetsNotaryRepository,
+			expectedError: "No valid trust data for tag",
+			args:          []string{"image:tag"},
+		},
+	}
+	for _, tc := range testCases {
+		cli := test.NewFakeCli(&fakeClient{
+			createContainerFunc: func(config *container.Config,
+				hostConfig *container.HostConfig,
+				networkingConfig *network.NetworkingConfig,
+				containerName string,
+			) (container.ContainerCreateCreatedBody, error) {
+				return container.ContainerCreateCreatedBody{}, fmt.Errorf("shouldn't try to pull image")
+			},
+		}, test.EnableContentTrust)
+		cli.SetNotaryClient(tc.notaryFunc)
+		cmd := NewCreateCommand(cli)
+		cmd.SetOutput(ioutil.Discard)
+		cmd.SetArgs(tc.args)
+		err := cmd.Execute()
+		assert.ErrorContains(t, err, tc.expectedError)
+	}
 }
 
 type fakeNotFound struct{}

components/cli/cli/command/container/exec_test.go

@@ -7,11 +7,11 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/cli/opts"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -106,7 +106,7 @@ func TestParseExec(t *testing.T) {
 
 	for _, testcase := range testcases {
 		execConfig := parseExec(testcase.options, &testcase.configFile)
-		assert.Equal(t, testcase.expected, *execConfig)
+		assert.Check(t, is.DeepEqual(testcase.expected, *execConfig))
 	}
 }
 
@@ -150,14 +150,14 @@ func TestRunExec(t *testing.T) {
 
 			err := runExec(cli, testcase.options)
 			if testcase.expectedError != "" {
-				testutil.ErrorContains(t, err, testcase.expectedError)
+				assert.ErrorContains(t, err, testcase.expectedError)
 			} else {
-				if !assert.NoError(t, err) {
+				if !assert.Check(t, err) {
 					return
 				}
 			}
-			assert.Equal(t, testcase.expectedOut, cli.OutBuffer().String())
-			assert.Equal(t, testcase.expectedErr, cli.ErrBuffer().String())
+			assert.Check(t, is.Equal(testcase.expectedOut, cli.OutBuffer().String()))
+			assert.Check(t, is.Equal(testcase.expectedErr, cli.ErrBuffer().String()))
 		})
 	}
 }
@@ -192,12 +192,12 @@ func TestGetExecExitStatus(t *testing.T) {
 	for _, testcase := range testcases {
 		client := &fakeClient{
 			execInspectFunc: func(id string) (types.ContainerExecInspect, error) {
-				assert.Equal(t, execID, id)
+				assert.Check(t, is.Equal(execID, id))
 				return types.ContainerExecInspect{ExitCode: testcase.exitCode}, testcase.inspectError
 			},
 		}
 		err := getExecExitStatus(context.Background(), client, execID)
-		assert.Equal(t, testcase.expectedError, err)
+		assert.Check(t, is.Equal(testcase.expectedError, err))
 	}
 }
 
@@ -222,6 +222,6 @@ func TestNewExecCommandErrors(t *testing.T) {
 		cmd := NewExecCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }

components/cli/cli/command/container/list_test.go

@@ -7,11 +7,10 @@ import (
 
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
 )
 
@@ -52,7 +51,7 @@ func TestContainerListErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -69,7 +68,7 @@ func TestContainerListWithoutFormat(t *testing.T) {
 		},
 	})
 	cmd := newListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-without-format.golden")
 }
 
@@ -84,7 +83,7 @@ func TestContainerListNoTrunc(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("no-trunc", "true")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-without-format-no-trunc.golden")
 }
 
@@ -100,7 +99,7 @@ func TestContainerListNamesMultipleTime(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("format", "{{.Names}} {{.Names}}")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-format-name-name.golden")
 }
 
@@ -116,20 +115,20 @@ func TestContainerListFormatTemplateWithArg(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("format", `{{.Names}} {{.Label "some.label"}}`)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-format-with-arg.golden")
 }
 
 func TestContainerListFormatSizeSetsOption(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
 		containerListFunc: func(options types.ContainerListOptions) ([]types.Container, error) {
-			assert.True(t, options.Size)
+			assert.Check(t, options.Size)
 			return []types.Container{}, nil
 		},
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("format", `{{.Size}}`)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }
 
 func TestContainerListWithConfigFormat(t *testing.T) {
@@ -145,7 +144,7 @@ func TestContainerListWithConfigFormat(t *testing.T) {
 		PsFormat: "{{ .Names }} {{ .Image }} {{ .Labels }}",
 	})
 	cmd := newListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-with-config-format.golden")
 }
 
@@ -160,6 +159,6 @@ func TestContainerListWithFormat(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("format", "{{ .Names }} {{ .Image }} {{ .Labels }}")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "container-list-with-format.golden")
 }

components/cli/cli/command/container/logs_test.go

@@ -7,10 +7,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 var logFn = func(expectedOut string) func(string, types.ContainerLogsOptions) (io.ReadCloser, error) {
@@ -49,14 +49,14 @@ func TestRunLogs(t *testing.T) {
 
 			err := runLogs(cli, testcase.options)
 			if testcase.expectedError != "" {
-				testutil.ErrorContains(t, err, testcase.expectedError)
+				assert.ErrorContains(t, err, testcase.expectedError)
 			} else {
-				if !assert.NoError(t, err) {
+				if !assert.Check(t, err) {
 					return
 				}
 			}
-			assert.Equal(t, testcase.expectedOut, cli.OutBuffer().String())
-			assert.Equal(t, testcase.expectedErr, cli.ErrBuffer().String())
+			assert.Check(t, is.Equal(testcase.expectedOut, cli.OutBuffer().String()))
+			assert.Check(t, is.Equal(testcase.expectedErr, cli.ErrBuffer().String()))
 		})
 	}
 }

components/cli/cli/command/container/opts_test.go

@@ -9,14 +9,13 @@ import (
 	"testing"
 	"time"
 
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types/container"
 	networktypes "github.com/docker/docker/api/types/network"
 	"github.com/docker/go-connections/nat"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
 	"github.com/spf13/pflag"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestValidateAttach(t *testing.T) {
@@ -67,12 +66,12 @@ func setupRunFlags() (*pflag.FlagSet, *containerOptions) {
 
 func parseMustError(t *testing.T, args string) {
 	_, _, _, err := parseRun(strings.Split(args+" ubuntu bash", " "))
-	assert.Error(t, err, args)
+	assert.ErrorContains(t, err, "", args)
 }
 
 func mustParse(t *testing.T, args string) (*container.Config, *container.HostConfig) {
 	config, hostConfig, _, err := parseRun(append(strings.Split(args, " "), "ubuntu", "bash"))
-	assert.NoError(t, err)
+	assert.NilError(t, err)
 	return config, hostConfig
 }
 
@@ -236,23 +235,23 @@ func TestRunFlagsParseWithMemory(t *testing.T) {
 	flags, _ := setupRunFlags()
 	args := []string{"--memory=invalid", "img", "cmd"}
 	err := flags.Parse(args)
-	testutil.ErrorContains(t, err, `invalid argument "invalid" for "-m, --memory" flag`)
+	assert.ErrorContains(t, err, `invalid argument "invalid" for "-m, --memory" flag`)
 
 	_, hostconfig := mustParse(t, "--memory=1G")
-	assert.Equal(t, int64(1073741824), hostconfig.Memory)
+	assert.Check(t, is.Equal(int64(1073741824), hostconfig.Memory))
 }
 
 func TestParseWithMemorySwap(t *testing.T) {
 	flags, _ := setupRunFlags()
 	args := []string{"--memory-swap=invalid", "img", "cmd"}
 	err := flags.Parse(args)
-	testutil.ErrorContains(t, err, `invalid argument "invalid" for "--memory-swap" flag`)
+	assert.ErrorContains(t, err, `invalid argument "invalid" for "--memory-swap" flag`)
 
 	_, hostconfig := mustParse(t, "--memory-swap=1G")
-	assert.Equal(t, int64(1073741824), hostconfig.MemorySwap)
+	assert.Check(t, is.Equal(int64(1073741824), hostconfig.MemorySwap))
 
 	_, hostconfig = mustParse(t, "--memory-swap=-1")
-	assert.Equal(t, int64(-1), hostconfig.MemorySwap)
+	assert.Check(t, is.Equal(int64(-1), hostconfig.MemorySwap))
 }
 
 func TestParseHostname(t *testing.T) {
@@ -373,24 +372,24 @@ func TestParseModes(t *testing.T) {
 	// pid ko
 	flags, copts := setupRunFlags()
 	args := []string{"--pid=container:", "img", "cmd"}
-	require.NoError(t, flags.Parse(args))
+	assert.NilError(t, flags.Parse(args))
 	_, err := parse(flags, copts)
-	testutil.ErrorContains(t, err, "--pid: invalid PID mode")
+	assert.ErrorContains(t, err, "--pid: invalid PID mode")
 
 	// pid ok
 	_, hostconfig, _, err := parseRun([]string{"--pid=host", "img", "cmd"})
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	if !hostconfig.PidMode.Valid() {
 		t.Fatalf("Expected a valid PidMode, got %v", hostconfig.PidMode)
 	}
 
 	// uts ko
 	_, _, _, err = parseRun([]string{"--uts=container:", "img", "cmd"})
-	testutil.ErrorContains(t, err, "--uts: invalid UTS mode")
+	assert.ErrorContains(t, err, "--uts: invalid UTS mode")
 
 	// uts ok
 	_, hostconfig, _, err = parseRun([]string{"--uts=host", "img", "cmd"})
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	if !hostconfig.UTSMode.Valid() {
 		t.Fatalf("Expected a valid UTSMode, got %v", hostconfig.UTSMode)
 	}
@@ -402,11 +401,11 @@ func TestRunFlagsParseShmSize(t *testing.T) {
 	args := []string{"--shm-size=a128m", "img", "cmd"}
 	expectedErr := `invalid argument "a128m" for "--shm-size" flag: invalid size: 'a128m'`
 	err := flags.Parse(args)
-	testutil.ErrorContains(t, err, expectedErr)
+	assert.ErrorContains(t, err, expectedErr)
 
 	// shm-size ok
 	_, hostconfig, _, err := parseRun([]string{"--shm-size=128m", "img", "cmd"})
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	if hostconfig.ShmSize != 134217728 {
 		t.Fatalf("Expected a valid ShmSize, got %d", hostconfig.ShmSize)
 	}

components/cli/cli/command/container/ps_test.go

@@ -4,13 +4,14 @@ import (
 	"testing"
 
 	"github.com/docker/cli/opts"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestBuildContainerListOptions(t *testing.T) {
 	filters := opts.NewFilterOpt()
-	assert.NoError(t, filters.Set("foo=bar"))
-	assert.NoError(t, filters.Set("baz=foo"))
+	assert.NilError(t, filters.Set("foo=bar"))
+	assert.NilError(t, filters.Set("baz=foo"))
 
 	contexts := []struct {
 		psOpts          *psOptions
@@ -101,12 +102,12 @@ func TestBuildContainerListOptions(t *testing.T) {
 
 	for _, c := range contexts {
 		options, err := buildContainerListOptions(c.psOpts)
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 
-		assert.Equal(t, c.expectedAll, options.All)
-		assert.Equal(t, c.expectedSize, options.Size)
-		assert.Equal(t, c.expectedLimit, options.Limit)
-		assert.Equal(t, len(c.expectedFilters), options.Filters.Len())
+		assert.Check(t, is.Equal(c.expectedAll, options.All))
+		assert.Check(t, is.Equal(c.expectedSize, options.Size))
+		assert.Check(t, is.Equal(c.expectedLimit, options.Limit))
+		assert.Check(t, is.Equal(len(c.expectedFilters), options.Filters.Len()))
 
 		for k, v := range c.expectedFilters {
 			f := options.Filters

components/cli/cli/command/container/run.go

@@ -25,11 +25,10 @@ import (
 )
 
 type runOptions struct {
+	createOptions
 	detach     bool
 	sigProxy   bool
-	name       string
 	detachKeys string
-	platform   string
 }
 
 // NewRunCommand create a new `docker run` command
@@ -64,7 +63,7 @@ func NewRunCommand(dockerCli command.Cli) *cobra.Command {
 	flags.Bool("help", false, "Print usage")
 
 	command.AddPlatformFlag(flags, &opts.platform)
-	command.AddTrustVerificationFlags(flags)
+	command.AddTrustVerificationFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 	copts = addFlags(flags)
 	return cmd
 }
@@ -162,7 +161,7 @@ func runContainer(dockerCli command.Cli, opts *runOptions, copts *containerOptio
 
 	ctx, cancelFun := context.WithCancel(context.Background())
 
-	createResponse, err := createContainer(ctx, dockerCli, containerConfig, opts.name, opts.platform)
+	createResponse, err := createContainer(ctx, dockerCli, containerConfig, &opts.createOptions)
 	if err != nil {
 		reportError(stderr, cmdPath, err.Error(), true)
 		return runStartContainerErr(err)

components/cli/cli/command/container/run_test.go

@@ -1,12 +1,15 @@
 package container
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
+	"github.com/docker/cli/internal/test/notary"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestRunLabel(t *testing.T) {
@@ -21,5 +24,50 @@ func TestRunLabel(t *testing.T) {
 	cmd := NewRunCommand(cli)
 	cmd.Flags().Set("detach", "true")
 	cmd.SetArgs([]string{"--label", "foo", "busybox"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
+}
+
+func TestRunCommandWithContentTrustErrors(t *testing.T) {
+	testCases := []struct {
+		name          string
+		args          []string
+		expectedError string
+		notaryFunc    test.NotaryClientFuncType
+	}{
+		{
+			name:          "offline-notary-server",
+			notaryFunc:    notary.GetOfflineNotaryRepository,
+			expectedError: "client is offline",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "uninitialized-notary-server",
+			notaryFunc:    notary.GetUninitializedNotaryRepository,
+			expectedError: "remote trust data does not exist",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "empty-notary-server",
+			notaryFunc:    notary.GetEmptyTargetsNotaryRepository,
+			expectedError: "No valid trust data for tag",
+			args:          []string{"image:tag"},
+		},
+	}
+	for _, tc := range testCases {
+		cli := test.NewFakeCli(&fakeClient{
+			createContainerFunc: func(config *container.Config,
+				hostConfig *container.HostConfig,
+				networkingConfig *network.NetworkingConfig,
+				containerName string,
+			) (container.ContainerCreateCreatedBody, error) {
+				return container.ContainerCreateCreatedBody{}, fmt.Errorf("shouldn't try to pull image")
+			},
+		}, test.EnableContentTrust)
+		cli.SetNotaryClient(tc.notaryFunc)
+		cmd := NewRunCommand(cli)
+		cmd.SetArgs(tc.args)
+		err := cmd.Execute()
+		assert.Assert(t, err != nil)
+		assert.Assert(t, is.Contains(cli.ErrBuffer().String(), tc.expectedError))
+	}
 }

components/cli/cli/command/container/stats_helpers_test.go

@@ -1,10 +1,11 @@
 package container
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
 )
 
 func TestCalculateMemUsageUnixNoCache(t *testing.T) {
@@ -15,7 +16,7 @@ func TestCalculateMemUsageUnixNoCache(t *testing.T) {
 	result := calculateMemUsageUnixNoCache(stats)
 
 	// Then
-	assert.InDelta(t, 100.0, result, 1e-6)
+	assert.Assert(t, inDelta(100.0, result, 1e-6))
 }
 
 func TestCalculateMemPercentUnixNoCache(t *testing.T) {
@@ -27,10 +28,20 @@ func TestCalculateMemPercentUnixNoCache(t *testing.T) {
 	// When and Then
 	t.Run("Limit is set", func(t *testing.T) {
 		result := calculateMemPercentUnixNoCache(someLimit, used)
-		assert.InDelta(t, 70.0, result, 1e-6)
+		assert.Assert(t, inDelta(70.0, result, 1e-6))
 	})
 	t.Run("No limit, no cgroup data", func(t *testing.T) {
 		result := calculateMemPercentUnixNoCache(noLimit, used)
-		assert.InDelta(t, 0.0, result, 1e-6)
+		assert.Assert(t, inDelta(0.0, result, 1e-6))
 	})
 }
+
+func inDelta(x, y, delta float64) func() (bool, string) {
+	return func() (bool, string) {
+		diff := x - y
+		if diff < -delta || diff > delta {
+			return false, fmt.Sprintf("%f != %f within %f", x, y, delta)
+		}
+		return true, ""
+	}
+}

components/cli/cli/command/container/utils_test.go

@@ -7,8 +7,9 @@ import (
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api"
 	"github.com/docker/docker/api/types/container"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -64,6 +65,6 @@ func TestWaitExitOrRemoved(t *testing.T) {
 	for _, testcase := range testcases {
 		statusC := waitExitOrRemoved(context.Background(), client, testcase.cid, true)
 		exitCode := <-statusC
-		assert.Equal(t, testcase.exitCode, exitCode)
+		assert.Check(t, is.Equal(testcase.exitCode, exitCode))
 	}
 }

components/cli/cli/command/formatter/checkpoint_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
 )
 
 func TestCheckpointContextFormatWrite(t *testing.T) {
@@ -46,10 +46,7 @@ checkpoint-3:
 		out := bytes.NewBufferString("")
 		testcase.context.Output = out
 		err := CheckpointWrite(testcase.context, checkpoints)
-		if err != nil {
-			assert.Error(t, err, testcase.expected)
-		} else {
-			assert.Equal(t, out.String(), testcase.expected)
-		}
+		assert.NilError(t, err)
+		assert.Equal(t, out.String(), testcase.expected)
 	}
 }

components/cli/cli/command/formatter/config_test.go

@@ -6,7 +6,8 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types/swarm"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestConfigContextFormatWrite(t *testing.T) {
@@ -55,9 +56,9 @@ id_rsa
 		out := bytes.NewBufferString("")
 		testcase.context.Output = out
 		if err := ConfigWrite(testcase.context, configs); err != nil {
-			assert.Error(t, err, testcase.expected)
+			assert.ErrorContains(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, out.String(), testcase.expected)
+			assert.Check(t, is.Equal(out.String(), testcase.expected))
 		}
 	}
 }

components/cli/cli/command/formatter/container_test.go

@@ -10,9 +10,9 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/stringid"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestContainerPsContext(t *testing.T) {
@@ -244,9 +244,9 @@ size: 0B
 		testcase.context.Output = out
 		err := ContainerWrite(testcase.context, containers)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -305,7 +305,7 @@ func TestContainerContextWriteWithNoContainers(t *testing.T) {
 
 	for _, context := range contexts {
 		ContainerWrite(context.context, containers)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}
@@ -359,8 +359,8 @@ func TestContainerContextWriteJSON(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var m map[string]interface{}
 		err := json.Unmarshal([]byte(line), &m)
-		require.NoError(t, err, msg)
-		assert.Equal(t, expectedJSONs[i], m, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.DeepEqual(expectedJSONs[i], m), msg)
 	}
 }
 
@@ -378,8 +378,8 @@ func TestContainerContextWriteJSONField(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var s string
 		err := json.Unmarshal([]byte(line), &s)
-		require.NoError(t, err, msg)
-		assert.Equal(t, containers[i].ID, s, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.Equal(containers[i].ID, s), msg)
 	}
 }
 
@@ -653,6 +653,6 @@ func TestDisplayablePorts(t *testing.T) {
 
 	for _, port := range cases {
 		actual := DisplayablePorts(port.ports)
-		assert.Equal(t, port.expected, actual)
+		assert.Check(t, is.Equal(port.expected, actual))
 	}
 }

components/cli/cli/command/formatter/custom_test.go

@@ -4,7 +4,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func compareMultipleValues(t *testing.T, value, expected string) {
@@ -23,5 +24,5 @@ func compareMultipleValues(t *testing.T, value, expected string) {
 		keyval := strings.Split(expected, "=")
 		expMap[keyval[0]] = keyval[1]
 	}
-	assert.Equal(t, expMap, entriesMap)
+	assert.Check(t, is.DeepEqual(expMap, entriesMap))
 }

components/cli/cli/command/formatter/diff_test.go

@@ -6,7 +6,8 @@ import (
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestDiffContextFormatWrite(t *testing.T) {
@@ -51,9 +52,9 @@ D: /usr/app/old_app.js
 		testcase.context.Output = out
 		err := DiffWrite(testcase.context, diffs)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }

components/cli/cli/command/formatter/disk_usage_test.go

@@ -4,8 +4,9 @@ import (
 	"bytes"
 	"testing"
 
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestDiskUsageContextFormatWrite(t *testing.T) {
@@ -101,9 +102,9 @@ Build Cache                                                 0B
 		out := bytes.NewBufferString("")
 		testcase.context.Output = out
 		if err := testcase.context.Write(); err != nil {
-			assert.Equal(t, testcase.expected, err.Error())
+			assert.Check(t, is.Equal(testcase.expected, err.Error()))
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }

components/cli/cli/command/formatter/displayutils_test.go

@@ -3,7 +3,8 @@ package formatter
 import (
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestEllipsis(t *testing.T) {
@@ -25,6 +26,6 @@ func TestEllipsis(t *testing.T) {
 	}
 
 	for _, testcase := range testcases {
-		assert.Equal(t, testcase.expected, Ellipsis(testcase.source, testcase.width))
+		assert.Check(t, is.Equal(testcase.expected, Ellipsis(testcase.source, testcase.width)))
 	}
 }

components/cli/cli/command/formatter/history_test.go

@@ -1,16 +1,16 @@
 package formatter
 
 import (
+	"bytes"
 	"strconv"
 	"strings"
 	"testing"
 	"time"
 
-	"bytes"
-
 	"github.com/docker/docker/api/types/image"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 type historyCase struct {
@@ -50,6 +50,7 @@ func TestHistoryContext_ID(t *testing.T) {
 }
 
 func TestHistoryContext_CreatedSince(t *testing.T) {
+	dateStr := "2009-11-10T23:00:00Z"
 	var ctx historyContext
 	cases := []historyCase{
 		{
@@ -64,7 +65,7 @@ func TestHistoryContext_CreatedSince(t *testing.T) {
 				h:     image.HistoryResponseItem{Created: time.Date(2009, time.November, 10, 23, 0, 0, 0, time.UTC).Unix()},
 				trunc: false,
 				human: false,
-			}, "2009-11-10T23:00:00Z", ctx.CreatedSince,
+			}, dateStr, ctx.CreatedSince,
 		},
 	}
 
@@ -218,7 +219,7 @@ imageID4            24 hours ago        /bin/bash grep
 
 	for _, context := range contexts {
 		HistoryWrite(context.context, true, histories)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}

components/cli/cli/command/formatter/image_test.go

@@ -9,7 +9,8 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestImageContext(t *testing.T) {
@@ -83,7 +84,7 @@ func TestImageContext(t *testing.T) {
 		if strings.Contains(v, ",") {
 			compareMultipleValues(t, v, c.expValue)
 		} else {
-			assert.Equal(t, c.expValue, v)
+			assert.Check(t, is.Equal(c.expValue, v))
 		}
 	}
 }
@@ -293,9 +294,9 @@ image_id: imageID3
 		testcase.context.Output = out
 		err := ImageWrite(testcase.context, images)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -348,7 +349,7 @@ func TestImageContextWriteWithNoImage(t *testing.T) {
 
 	for _, context := range contexts {
 		ImageWrite(context.context, images)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}

components/cli/cli/command/formatter/network_test.go

@@ -10,8 +10,8 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestNetworkContext(t *testing.T) {
@@ -162,9 +162,9 @@ foobar_bar 2017-01-01 00:00:00 +0000 UTC
 		testcase.context.Output = out
 		err := NetworkWrite(testcase.context, networks)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -188,8 +188,8 @@ func TestNetworkContextWriteJSON(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var m map[string]interface{}
 		err := json.Unmarshal([]byte(line), &m)
-		require.NoError(t, err, msg)
-		assert.Equal(t, expectedJSONs[i], m, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.DeepEqual(expectedJSONs[i], m), msg)
 	}
 }
 
@@ -207,7 +207,7 @@ func TestNetworkContextWriteJSONField(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var s string
 		err := json.Unmarshal([]byte(line), &s)
-		require.NoError(t, err, msg)
-		assert.Equal(t, networks[i].ID, s, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.Equal(networks[i].ID, s), msg)
 	}
 }

components/cli/cli/command/formatter/node_test.go

@@ -10,8 +10,8 @@ import (
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestNodeContext(t *testing.T) {
@@ -203,9 +203,9 @@ foobar_boo  Unknown
 		testcase.context.Output = out
 		err := NodeWrite(testcase.context, nodes, types.Info{Swarm: swarm.Info{Cluster: &testcase.clusterInfo}})
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -255,8 +255,8 @@ func TestNodeContextWriteJSON(t *testing.T) {
 			msg := fmt.Sprintf("Output: line %d: %s", i, line)
 			var m map[string]interface{}
 			err := json.Unmarshal([]byte(line), &m)
-			require.NoError(t, err, msg)
-			assert.Equal(t, testcase.expected[i], m, msg)
+			assert.NilError(t, err, msg)
+			assert.Check(t, is.DeepEqual(testcase.expected[i], m), msg)
 		}
 	}
 }
@@ -275,8 +275,8 @@ func TestNodeContextWriteJSONField(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var s string
 		err := json.Unmarshal([]byte(line), &s)
-		require.NoError(t, err, msg)
-		assert.Equal(t, nodes[i].ID, s, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.Equal(nodes[i].ID, s), msg)
 	}
 }
 
@@ -344,5 +344,5 @@ data
  Issuer Subject:	c3ViamVjdA==
  Issuer Public Key:	cHViS2V5
 `
-	assert.Equal(t, expected, out.String())
+	assert.Check(t, is.Equal(expected, out.String()))
 }

components/cli/cli/command/formatter/plugin_test.go

@@ -8,7 +8,8 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestPluginContext(t *testing.T) {
@@ -131,9 +132,9 @@ foobar_bar
 		testcase.context.Output = out
 		err := PluginWrite(testcase.context, plugins)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -158,7 +159,7 @@ func TestPluginContextWriteJSON(t *testing.T) {
 		if err := json.Unmarshal([]byte(line), &m); err != nil {
 			t.Fatal(err)
 		}
-		assert.Equal(t, expectedJSONs[i], m)
+		assert.Check(t, is.DeepEqual(expectedJSONs[i], m))
 	}
 }
 
@@ -177,6 +178,6 @@ func TestPluginContextWriteJSONField(t *testing.T) {
 		if err := json.Unmarshal([]byte(line), &s); err != nil {
 			t.Fatal(err)
 		}
-		assert.Equal(t, plugins[i].ID, s)
+		assert.Check(t, is.Equal(plugins[i].ID, s))
 	}
 }

components/cli/cli/command/formatter/search_test.go

@@ -7,8 +7,9 @@ import (
 	"testing"
 
 	registrytypes "github.com/docker/docker/api/types/registry"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestSearchContext(t *testing.T) {
@@ -154,9 +155,9 @@ result2 5
 		testcase.context.Output = out
 		err := SearchWrite(testcase.context, results, false, 0)
 		if err != nil {
-			assert.Error(t, err, testcase.expected)
+			assert.Check(t, is.ErrorContains(err, testcase.expected))
 		} else {
-			assert.Equal(t, out.String(), testcase.expected)
+			assert.Check(t, is.Equal(out.String(), testcase.expected))
 		}
 	}
 }
@@ -191,9 +192,9 @@ result2
 		testcase.context.Output = out
 		err := SearchWrite(testcase.context, results, true, 0)
 		if err != nil {
-			assert.Error(t, err, testcase.expected)
+			assert.Check(t, is.ErrorContains(err, testcase.expected))
 		} else {
-			assert.Equal(t, out.String(), testcase.expected)
+			assert.Check(t, is.Equal(out.String(), testcase.expected))
 		}
 	}
 }
@@ -226,9 +227,9 @@ result1
 		testcase.context.Output = out
 		err := SearchWrite(testcase.context, results, false, 6)
 		if err != nil {
-			assert.Error(t, err, testcase.expected)
+			assert.Check(t, is.ErrorContains(err, testcase.expected))
 		} else {
-			assert.Equal(t, out.String(), testcase.expected)
+			assert.Check(t, is.Equal(out.String(), testcase.expected))
 		}
 	}
 }
@@ -254,7 +255,7 @@ func TestSearchContextWriteJSON(t *testing.T) {
 		if err := json.Unmarshal([]byte(line), &m); err != nil {
 			t.Fatal(err)
 		}
-		assert.Equal(t, m, expectedJSONs[i])
+		assert.Check(t, is.DeepEqual(m, expectedJSONs[i]))
 	}
 }
 
@@ -274,6 +275,6 @@ func TestSearchContextWriteJSONField(t *testing.T) {
 		if err := json.Unmarshal([]byte(line), &s); err != nil {
 			t.Fatal(err)
 		}
-		assert.Equal(t, s, results[i].Name)
+		assert.Check(t, is.Equal(s, results[i].Name))
 	}
 }

components/cli/cli/command/formatter/secret_test.go

@@ -6,7 +6,8 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types/swarm"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestSecretContextFormatWrite(t *testing.T) {
@@ -55,9 +56,9 @@ id_rsa
 		out := bytes.NewBufferString("")
 		testcase.context.Output = out
 		if err := SecretWrite(testcase.context, secrets); err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }

components/cli/cli/command/formatter/service_test.go

@@ -8,9 +8,9 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestServiceContextWrite(t *testing.T) {
@@ -126,9 +126,9 @@ bar
 		testcase.context.Output = out
 		err := ServiceListWrite(testcase.context, services, info)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -192,8 +192,8 @@ func TestServiceContextWriteJSON(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var m map[string]interface{}
 		err := json.Unmarshal([]byte(line), &m)
-		require.NoError(t, err, msg)
-		assert.Equal(t, expectedJSONs[i], m, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.DeepEqual(expectedJSONs[i], m), msg)
 	}
 }
 func TestServiceContextWriteJSONField(t *testing.T) {
@@ -220,8 +220,8 @@ func TestServiceContextWriteJSONField(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var s string
 		err := json.Unmarshal([]byte(line), &s)
-		require.NoError(t, err, msg)
-		assert.Equal(t, services[i].Spec.Name, s, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.Equal(services[i].Spec.Name, s), msg)
 	}
 }
 
@@ -355,5 +355,5 @@ func TestServiceContext_Ports(t *testing.T) {
 		},
 	}
 
-	assert.Equal(t, "*:97-98->97-98/sctp, *:60-61->60-61/tcp, *:62->61/tcp, *:80-81->80/tcp, *:90-95->90-95/tcp, *:90-96->90-96/udp", c.Ports())
+	assert.Check(t, is.Equal("*:97-98->97-98/sctp, *:60-61->60-61/tcp, *:62->61/tcp, *:80-81->80/tcp, *:90-95->90-95/tcp, *:90-96->90-96/udp", c.Ports()))
 }

components/cli/cli/command/formatter/stack_test.go

@@ -4,7 +4,8 @@ import (
 	"bytes"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestStackContextWrite(t *testing.T) {
@@ -56,9 +57,9 @@ bar
 		testcase.context.Output = out
 		err := StackWrite(testcase.context, stacks)
 		if err != nil {
-			assert.Error(t, err, testcase.expected)
+			assert.Check(t, is.ErrorContains(err, testcase.expected))
 		} else {
-			assert.Equal(t, out.String(), testcase.expected)
+			assert.Check(t, is.Equal(out.String(), testcase.expected))
 		}
 	}
 }

components/cli/cli/command/formatter/stats_test.go

@@ -5,7 +5,8 @@ import (
 	"testing"
 
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestContainerStatsContext(t *testing.T) {
@@ -116,9 +117,9 @@ container2  --
 		te.context.Output = &out
 		err := ContainerStatsWrite(te.context, stats, "linux", false)
 		if err != nil {
-			assert.EqualError(t, err, te.expected)
+			assert.Error(t, err, te.expected)
 		} else {
-			assert.Equal(t, te.expected, out.String())
+			assert.Check(t, is.Equal(te.expected, out.String()))
 		}
 	}
 }
@@ -182,9 +183,9 @@ container2  --  --
 		te.context.Output = &out
 		err := ContainerStatsWrite(te.context, stats, "windows", false)
 		if err != nil {
-			assert.EqualError(t, err, te.expected)
+			assert.Error(t, err, te.expected)
 		} else {
-			assert.Equal(t, te.expected, out.String())
+			assert.Check(t, is.Equal(te.expected, out.String()))
 		}
 	}
 }
@@ -221,7 +222,7 @@ func TestContainerStatsContextWriteWithNoStats(t *testing.T) {
 
 	for _, context := range contexts {
 		ContainerStatsWrite(context.context, []StatsEntry{}, "linux", false)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}
@@ -259,7 +260,7 @@ func TestContainerStatsContextWriteWithNoStatsWindows(t *testing.T) {
 
 	for _, context := range contexts {
 		ContainerStatsWrite(context.context, []StatsEntry{}, "windows", false)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}
@@ -293,7 +294,7 @@ func TestContainerStatsContextWriteTrunc(t *testing.T) {
 
 	for _, context := range contexts {
 		ContainerStatsWrite(context.context, []StatsEntry{{ID: "b95a83497c9161c9b444e3d70e1a9dfba0c1840d41720e146a95a08ebf938afc"}}, "linux", context.trunc)
-		assert.Equal(t, context.expected, out.String())
+		assert.Check(t, is.Equal(context.expected, out.String()))
 		// Clean buffer
 		out.Reset()
 	}

components/cli/cli/command/formatter/task_test.go

@@ -7,8 +7,9 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestTaskContextWrite(t *testing.T) {
@@ -74,9 +75,9 @@ foobar_bar foo2
 		testcase.context.Output = out
 		err := TaskWrite(testcase.context, tasks, names, nodes)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -100,6 +101,6 @@ func TestTaskContextWriteJSONField(t *testing.T) {
 		if err := json.Unmarshal([]byte(line), &s); err != nil {
 			t.Fatal(err)
 		}
-		assert.Equal(t, tasks[i].ID, s)
+		assert.Check(t, is.Equal(tasks[i].ID, s))
 	}
 }

components/cli/cli/command/formatter/trust_test.go

@@ -5,7 +5,8 @@ import (
 	"testing"
 
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestTrustTag(t *testing.T) {
@@ -126,9 +127,9 @@ tag3                bbbbbbbb
 		testcase.context.Output = out
 		err := TrustTagWrite(testcase.context, signedTags)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -152,8 +153,8 @@ func TestTrustTagContextEmptyWrite(t *testing.T) {
 	out := bytes.NewBufferString("")
 	emptyCase.context.Output = out
 	err := TrustTagWrite(emptyCase.context, emptySignedTags)
-	assert.NoError(t, err)
-	assert.Equal(t, emptyCase.expected, out.String())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(emptyCase.expected, out.String()))
 }
 
 func TestSignerInfoContextEmptyWrite(t *testing.T) {
@@ -171,8 +172,8 @@ func TestSignerInfoContextEmptyWrite(t *testing.T) {
 	out := bytes.NewBufferString("")
 	emptyCase.context.Output = out
 	err := SignerInfoWrite(emptyCase.context, emptySignerInfo)
-	assert.NoError(t, err)
-	assert.Equal(t, emptyCase.expected, out.String())
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal(emptyCase.expected, out.String()))
 }
 
 func TestSignerInfoContextWrite(t *testing.T) {
@@ -230,9 +231,9 @@ eve                 foobarbazquxquux, key31, key32
 		testcase.context.Output = out
 		err := SignerInfoWrite(testcase.context, signerInfo)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }

components/cli/cli/command/formatter/volume_test.go

@@ -9,8 +9,8 @@ import (
 
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/stringid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestVolumeContext(t *testing.T) {
@@ -133,9 +133,9 @@ foobar_bar
 		testcase.context.Output = out
 		err := VolumeWrite(testcase.context, volumes)
 		if err != nil {
-			assert.EqualError(t, err, testcase.expected)
+			assert.Error(t, err, testcase.expected)
 		} else {
-			assert.Equal(t, testcase.expected, out.String())
+			assert.Check(t, is.Equal(testcase.expected, out.String()))
 		}
 	}
 }
@@ -158,8 +158,8 @@ func TestVolumeContextWriteJSON(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var m map[string]interface{}
 		err := json.Unmarshal([]byte(line), &m)
-		require.NoError(t, err, msg)
-		assert.Equal(t, expectedJSONs[i], m, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.DeepEqual(expectedJSONs[i], m), msg)
 	}
 }
 
@@ -177,7 +177,7 @@ func TestVolumeContextWriteJSONField(t *testing.T) {
 		msg := fmt.Sprintf("Output: line %d: %s", i, line)
 		var s string
 		err := json.Unmarshal([]byte(line), &s)
-		require.NoError(t, err, msg)
-		assert.Equal(t, volumes[i].Name, s, msg)
+		assert.NilError(t, err, msg)
+		assert.Check(t, is.Equal(volumes[i].Name, s), msg)
 	}
 }

components/cli/cli/command/idresolver/idresolver_test.go

@@ -4,10 +4,11 @@ import (
 	"testing"
 
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -21,7 +22,7 @@ func TestResolveError(t *testing.T) {
 	idResolver := New(cli, false)
 	_, err := idResolver.Resolve(context.Background(), struct{}{}, "nodeID")
 
-	assert.EqualError(t, err, "unsupported type")
+	assert.Error(t, err, "unsupported type")
 }
 
 func TestResolveWithNoResolveOption(t *testing.T) {
@@ -40,9 +41,9 @@ func TestResolveWithNoResolveOption(t *testing.T) {
 	idResolver := New(cli, true)
 	id, err := idResolver.Resolve(context.Background(), swarm.Node{}, "nodeID")
 
-	assert.NoError(t, err)
-	assert.Equal(t, "nodeID", id)
-	assert.False(t, resolved)
+	assert.NilError(t, err)
+	assert.Check(t, is.Equal("nodeID", id))
+	assert.Check(t, !resolved)
 }
 
 func TestResolveWithCache(t *testing.T) {
@@ -59,11 +60,11 @@ func TestResolveWithCache(t *testing.T) {
 	ctx := context.Background()
 	for i := 0; i < 2; i++ {
 		id, err := idResolver.Resolve(ctx, swarm.Node{}, "nodeID")
-		assert.NoError(t, err)
-		assert.Equal(t, "node-foo", id)
+		assert.NilError(t, err)
+		assert.Check(t, is.Equal("node-foo", id))
 	}
 
-	assert.Equal(t, 1, inspectCounter)
+	assert.Check(t, is.Equal(1, inspectCounter))
 }
 
 func TestResolveNode(t *testing.T) {
@@ -103,8 +104,8 @@ func TestResolveNode(t *testing.T) {
 		idResolver := New(cli, false)
 		id, err := idResolver.Resolve(ctx, swarm.Node{}, tc.nodeID)
 
-		assert.NoError(t, err)
-		assert.Equal(t, tc.expectedID, id)
+		assert.NilError(t, err)
+		assert.Check(t, is.Equal(tc.expectedID, id))
 	}
 }
 
@@ -138,7 +139,7 @@ func TestResolveService(t *testing.T) {
 		idResolver := New(cli, false)
 		id, err := idResolver.Resolve(ctx, swarm.Service{}, tc.serviceID)
 
-		assert.NoError(t, err)
-		assert.Equal(t, tc.expectedID, id)
+		assert.NilError(t, err)
+		assert.Check(t, is.Equal(tc.expectedID, id))
 	}
 }

components/cli/cli/command/image/build.go

@@ -67,6 +67,7 @@ type buildOptions struct {
 	imageIDFile    string
 	stream         bool
 	platform       string
+	untrusted      bool
 }
 
 // dockerfileFromStdin returns true when the user specified that the Dockerfile
@@ -137,7 +138,7 @@ func NewBuildCommand(dockerCli command.Cli) *cobra.Command {
 	flags.StringVar(&options.target, "target", "", "Set the target build stage to build.")
 	flags.StringVar(&options.imageIDFile, "iidfile", "", "Write the image ID to the file")
 
-	command.AddTrustVerificationFlags(flags)
+	command.AddTrustVerificationFlags(flags, &options.untrusted, dockerCli.ContentTrustEnabled())
 	command.AddPlatformFlag(flags, &options.platform)
 
 	flags.BoolVar(&options.squash, "squash", false, "Squash newly built layers into a single new layer")
@@ -285,7 +286,7 @@ func runBuild(dockerCli command.Cli, options buildOptions) error {
 	defer cancel()
 
 	var resolvedTags []*resolvedTag
-	if command.IsTrusted() {
+	if !options.untrusted {
 		translator := func(ctx context.Context, ref reference.NamedTagged) (reference.Canonical, error) {
 			return TrustedReference(ctx, dockerCli, ref, nil)
 		}
@@ -293,10 +294,10 @@ func runBuild(dockerCli command.Cli, options buildOptions) error {
 		if buildCtx != nil {
 			// Wrap the tar archive to replace the Dockerfile entry with the rewritten
 			// Dockerfile which uses trusted pulls.
-			buildCtx = replaceDockerfileTarWrapper(ctx, buildCtx, relDockerfile, translator, &resolvedTags)
+			buildCtx = replaceDockerfileForContentTrust(ctx, buildCtx, relDockerfile, translator, &resolvedTags)
 		} else if dockerfileCtx != nil {
 			// if there was not archive context still do the possible replacements in Dockerfile
-			newDockerfile, _, err := rewriteDockerfileFrom(ctx, dockerfileCtx, translator)
+			newDockerfile, _, err := rewriteDockerfileFromForContentTrust(ctx, dockerfileCtx, translator)
 			if err != nil {
 				return err
 			}
@@ -460,7 +461,7 @@ func runBuild(dockerCli command.Cli, options buildOptions) error {
 			return err
 		}
 	}
-	if command.IsTrusted() {
+	if !options.untrusted {
 		// Since the build was successful, now we must tag any of the resolved
 		// images from the above Dockerfile rewrite.
 		for _, resolved := range resolvedTags {
@@ -499,11 +500,12 @@ type resolvedTag struct {
 	tagRef    reference.NamedTagged
 }
 
-// rewriteDockerfileFrom rewrites the given Dockerfile by resolving images in
+// rewriteDockerfileFromForContentTrust rewrites the given Dockerfile by resolving images in
 // "FROM <image>" instructions to a digest reference. `translator` is a
 // function that takes a repository name and tag reference and returns a
 // trusted digest reference.
-func rewriteDockerfileFrom(ctx context.Context, dockerfile io.Reader, translator translatorFunc) (newDockerfile []byte, resolvedTags []*resolvedTag, err error) {
+// This should be called *only* when content trust is enabled
+func rewriteDockerfileFromForContentTrust(ctx context.Context, dockerfile io.Reader, translator translatorFunc) (newDockerfile []byte, resolvedTags []*resolvedTag, err error) {
 	scanner := bufio.NewScanner(dockerfile)
 	buf := bytes.NewBuffer(nil)
 
@@ -520,7 +522,7 @@ func rewriteDockerfileFrom(ctx context.Context, dockerfile io.Reader, translator
 				return nil, nil, err
 			}
 			ref = reference.TagNameOnly(ref)
-			if ref, ok := ref.(reference.NamedTagged); ok && command.IsTrusted() {
+			if ref, ok := ref.(reference.NamedTagged); ok {
 				trustedRef, err := translator(ctx, ref)
 				if err != nil {
 					return nil, nil, err
@@ -543,11 +545,10 @@ func rewriteDockerfileFrom(ctx context.Context, dockerfile io.Reader, translator
 	return buf.Bytes(), resolvedTags, scanner.Err()
 }
 
-// replaceDockerfileTarWrapper wraps the given input tar archive stream and
-// replaces the entry with the given Dockerfile name with the contents of the
-// new Dockerfile. Returns a new tar archive stream with the replaced
-// Dockerfile.
-func replaceDockerfileTarWrapper(ctx context.Context, inputTarStream io.ReadCloser, dockerfileName string, translator translatorFunc, resolvedTags *[]*resolvedTag) io.ReadCloser {
+// replaceDockerfileForContentTrust wraps the given input tar archive stream and
+// uses the translator to replace the Dockerfile which uses a trusted reference.
+// Returns a new tar archive stream with the replaced Dockerfile.
+func replaceDockerfileForContentTrust(ctx context.Context, inputTarStream io.ReadCloser, dockerfileName string, translator translatorFunc, resolvedTags *[]*resolvedTag) io.ReadCloser {
 	pipeReader, pipeWriter := io.Pipe()
 	go func() {
 		tarReader := tar.NewReader(inputTarStream)
@@ -574,7 +575,7 @@ func replaceDockerfileTarWrapper(ctx context.Context, inputTarStream io.ReadClos
 				// generated from a directory on the local filesystem, the
 				// Dockerfile will only appear once in the archive.
 				var newDockerfile []byte
-				newDockerfile, *resolvedTags, err = rewriteDockerfileFrom(ctx, content, translator)
+				newDockerfile, *resolvedTags, err = rewriteDockerfileFromForContentTrust(ctx, content, translator)
 				if err != nil {
 					pipeWriter.CloseWithError(err)
 					return

components/cli/cli/command/image/build/context_test.go

@@ -11,10 +11,9 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/pkg/archive"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 const dockerfileContents = "FROM busybox"
@@ -38,7 +37,7 @@ func testValidateContextDirectory(t *testing.T, prepare func(t *testing.T) (stri
 	defer cleanup()
 
 	err := ValidateContextDirectory(contextDir, excludes)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 }
 
 func TestGetContextFromLocalDirNoDockerfile(t *testing.T) {
@@ -46,7 +45,7 @@ func TestGetContextFromLocalDirNoDockerfile(t *testing.T) {
 	defer cleanup()
 
 	_, _, err := GetContextFromLocalDir(contextDir, "")
-	testutil.ErrorContains(t, err, "Dockerfile")
+	assert.ErrorContains(t, err, "Dockerfile")
 }
 
 func TestGetContextFromLocalDirNotExistingDir(t *testing.T) {
@@ -56,7 +55,7 @@ func TestGetContextFromLocalDirNotExistingDir(t *testing.T) {
 	fakePath := filepath.Join(contextDir, "fake")
 
 	_, _, err := GetContextFromLocalDir(fakePath, "")
-	testutil.ErrorContains(t, err, "fake")
+	assert.ErrorContains(t, err, "fake")
 }
 
 func TestGetContextFromLocalDirNotExistingDockerfile(t *testing.T) {
@@ -66,7 +65,7 @@ func TestGetContextFromLocalDirNotExistingDockerfile(t *testing.T) {
 	fakePath := filepath.Join(contextDir, "fake")
 
 	_, _, err := GetContextFromLocalDir(contextDir, fakePath)
-	testutil.ErrorContains(t, err, "fake")
+	assert.ErrorContains(t, err, "fake")
 }
 
 func TestGetContextFromLocalDirWithNoDirectory(t *testing.T) {
@@ -79,10 +78,10 @@ func TestGetContextFromLocalDirWithNoDirectory(t *testing.T) {
 	defer chdirCleanup()
 
 	absContextDir, relDockerfile, err := GetContextFromLocalDir(contextDir, "")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
-	assert.Equal(t, contextDir, absContextDir)
-	assert.Equal(t, DefaultDockerfileName, relDockerfile)
+	assert.Check(t, is.Equal(contextDir, absContextDir))
+	assert.Check(t, is.Equal(DefaultDockerfileName, relDockerfile))
 }
 
 func TestGetContextFromLocalDirWithDockerfile(t *testing.T) {
@@ -92,10 +91,10 @@ func TestGetContextFromLocalDirWithDockerfile(t *testing.T) {
 	createTestTempFile(t, contextDir, DefaultDockerfileName, dockerfileContents, 0777)
 
 	absContextDir, relDockerfile, err := GetContextFromLocalDir(contextDir, "")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
-	assert.Equal(t, contextDir, absContextDir)
-	assert.Equal(t, DefaultDockerfileName, relDockerfile)
+	assert.Check(t, is.Equal(contextDir, absContextDir))
+	assert.Check(t, is.Equal(DefaultDockerfileName, relDockerfile))
 }
 
 func TestGetContextFromLocalDirLocalFile(t *testing.T) {
@@ -130,10 +129,10 @@ func TestGetContextFromLocalDirWithCustomDockerfile(t *testing.T) {
 	createTestTempFile(t, contextDir, DefaultDockerfileName, dockerfileContents, 0777)
 
 	absContextDir, relDockerfile, err := GetContextFromLocalDir(contextDir, DefaultDockerfileName)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
-	assert.Equal(t, contextDir, absContextDir)
-	assert.Equal(t, DefaultDockerfileName, relDockerfile)
+	assert.Check(t, is.Equal(contextDir, absContextDir))
+	assert.Check(t, is.Equal(DefaultDockerfileName, relDockerfile))
 }
 
 func TestGetContextFromReaderString(t *testing.T) {
@@ -161,7 +160,7 @@ func TestGetContextFromReaderString(t *testing.T) {
 		t.Fatalf("Tar stream too long: %s", err)
 	}
 
-	require.NoError(t, tarArchive.Close())
+	assert.NilError(t, tarArchive.Close())
 
 	if dockerfileContents != contents {
 		t.Fatalf("Uncompressed tar archive does not equal: %s, got: %s", dockerfileContents, contents)
@@ -179,15 +178,15 @@ func TestGetContextFromReaderTar(t *testing.T) {
 	createTestTempFile(t, contextDir, DefaultDockerfileName, dockerfileContents, 0777)
 
 	tarStream, err := archive.Tar(contextDir, archive.Uncompressed)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	tarArchive, relDockerfile, err := GetContextFromReader(tarStream, DefaultDockerfileName)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	tarReader := tar.NewReader(tarArchive)
 
 	header, err := tarReader.Next()
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	if header.Name != DefaultDockerfileName {
 		t.Fatalf("Dockerfile name should be: %s, got: %s", DefaultDockerfileName, header.Name)
@@ -203,7 +202,7 @@ func TestGetContextFromReaderTar(t *testing.T) {
 		t.Fatalf("Tar stream too long: %s", err)
 	}
 
-	require.NoError(t, tarArchive.Close())
+	assert.NilError(t, tarArchive.Close())
 
 	if dockerfileContents != contents {
 		t.Fatalf("Uncompressed tar archive does not equal: %s, got: %s", dockerfileContents, contents)
@@ -243,8 +242,8 @@ func TestValidateContextDirectoryWithOneFileExcludes(t *testing.T) {
 // When an error occurs, it terminates the test.
 func createTestTempDir(t *testing.T, dir, prefix string) (string, func()) {
 	path, err := ioutil.TempDir(dir, prefix)
-	require.NoError(t, err)
-	return path, func() { require.NoError(t, os.RemoveAll(path)) }
+	assert.NilError(t, err)
+	return path, func() { assert.NilError(t, os.RemoveAll(path)) }
 }
 
 // createTestTempFile creates a temporary file within dir with specific contents and permissions.
@@ -252,7 +251,7 @@ func createTestTempDir(t *testing.T, dir, prefix string) (string, func()) {
 func createTestTempFile(t *testing.T, dir, filename, contents string, perm os.FileMode) string {
 	filePath := filepath.Join(dir, filename)
 	err := ioutil.WriteFile(filePath, []byte(contents), perm)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	return filePath
 }
 
@@ -262,9 +261,9 @@ func createTestTempFile(t *testing.T, dir, filename, contents string, perm os.Fi
 // When an error occurs, it terminates the test.
 func chdir(t *testing.T, dir string) func() {
 	workingDirectory, err := os.Getwd()
-	require.NoError(t, err)
-	require.NoError(t, os.Chdir(dir))
-	return func() { require.NoError(t, os.Chdir(workingDirectory)) }
+	assert.NilError(t, err)
+	assert.NilError(t, os.Chdir(dir))
+	return func() { assert.NilError(t, os.Chdir(workingDirectory)) }
 }
 
 func TestIsArchive(t *testing.T) {
@@ -295,6 +294,6 @@ func TestIsArchive(t *testing.T) {
 		},
 	}
 	for _, testcase := range testcases {
-		assert.Equal(t, testcase.expected, IsArchive(testcase.header), testcase.doc)
+		assert.Check(t, is.Equal(testcase.expected, IsArchive(testcase.header)), testcase.doc)
 	}
 }

components/cli/cli/command/image/build_test.go

@@ -1,39 +1,66 @@
 package image
 
 import (
+	"archive/tar"
 	"bytes"
+	"compress/gzip"
 	"io"
 	"io/ioutil"
 	"os"
 	"path/filepath"
-	"runtime"
 	"sort"
-	"syscall"
 	"testing"
 
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/pkg/archive"
+	"github.com/google/go-cmp/cmp"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/fs"
 	"github.com/gotestyourself/gotestyourself/skip"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
-func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
-	skip.IfCondition(t, runtime.GOOS == "windows", "uid and gid not relevant on windows")
-	dest := fs.NewDir(t, "test-build-context-dest")
-	defer dest.Remove()
-
-	fakeImageBuild := func(_ context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-		assert.NoError(t, archive.Untar(context, dest.Path(), nil))
-
-		body := new(bytes.Buffer)
-		return types.ImageBuildResponse{Body: ioutil.NopCloser(body)}, nil
+func TestRunBuildDockerfileFromStdinWithCompress(t *testing.T) {
+	buffer := new(bytes.Buffer)
+	fakeBuild := newFakeBuild()
+	fakeImageBuild := func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
+		tee := io.TeeReader(context, buffer)
+		gzipReader, err := gzip.NewReader(tee)
+		assert.NilError(t, err)
+		return fakeBuild.build(ctx, gzipReader, options)
 	}
+
 	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeImageBuild})
+	dockerfile := bytes.NewBufferString(`
+		FROM alpine:3.6
+		COPY foo /
+	`)
+	cli.SetIn(command.NewInStream(ioutil.NopCloser(dockerfile)))
+
+	dir := fs.NewDir(t, t.Name(),
+		fs.WithFile("foo", "some content"))
+	defer dir.Remove()
+
+	options := newBuildOptions()
+	options.compress = true
+	options.dockerfileName = "-"
+	options.context = dir.Path()
+	options.untrusted = true
+	assert.NilError(t, runBuild(cli, options))
+
+	expected := []string{fakeBuild.options.Dockerfile, ".dockerignore", "foo"}
+	assert.DeepEqual(t, expected, fakeBuild.filenames(t))
+
+	header := buffer.Bytes()[:10]
+	assert.Equal(t, archive.Gzip, archive.DetectCompression(header))
+}
+
+func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
+	skip.If(t, os.Getuid() != 0, "root is required to chown files")
+	fakeBuild := newFakeBuild()
+	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeBuild.build})
 
 	dir := fs.NewDir(t, "test-build-context",
 		fs.WithFile("foo", "some content", fs.AsUser(65534, 65534)),
@@ -46,72 +73,23 @@ func TestRunBuildResetsUidAndGidInContext(t *testing.T) {
 
 	options := newBuildOptions()
 	options.context = dir.Path()
+	options.untrusted = true
+	assert.NilError(t, runBuild(cli, options))
 
-	err := runBuild(cli, options)
-	require.NoError(t, err)
-
-	files, err := ioutil.ReadDir(dest.Path())
-	require.NoError(t, err)
-	for _, fileInfo := range files {
-		assert.Equal(t, uint32(0), fileInfo.Sys().(*syscall.Stat_t).Uid)
-		assert.Equal(t, uint32(0), fileInfo.Sys().(*syscall.Stat_t).Gid)
+	headers := fakeBuild.headers(t)
+	expected := []*tar.Header{
+		{Name: "Dockerfile"},
+		{Name: "foo"},
 	}
-}
-func TestRunBuildDockerfileFromStdinWithCompress(t *testing.T) {
-	dest, err := ioutil.TempDir("", "test-build-compress-dest")
-	require.NoError(t, err)
-	defer os.RemoveAll(dest)
-
-	var dockerfileName string
-	fakeImageBuild := func(_ context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-		buffer := new(bytes.Buffer)
-		tee := io.TeeReader(context, buffer)
-
-		assert.NoError(t, archive.Untar(tee, dest, nil))
-		dockerfileName = options.Dockerfile
-
-		header := buffer.Bytes()[:10]
-		assert.Equal(t, archive.Gzip, archive.DetectCompression(header))
-
-		body := new(bytes.Buffer)
-		return types.ImageBuildResponse{Body: ioutil.NopCloser(body)}, nil
-	}
-
-	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeImageBuild})
-	dockerfile := bytes.NewBufferString(`
-		FROM alpine:3.6
-		COPY foo /
-	`)
-	cli.SetIn(command.NewInStream(ioutil.NopCloser(dockerfile)))
-
-	dir, err := ioutil.TempDir("", "test-build-compress")
-	require.NoError(t, err)
-	defer os.RemoveAll(dir)
-
-	ioutil.WriteFile(filepath.Join(dir, "foo"), []byte("some content"), 0644)
-
-	options := newBuildOptions()
-	options.compress = true
-	options.dockerfileName = "-"
-	options.context = dir
-
-	err = runBuild(cli, options)
-	require.NoError(t, err)
-
-	files, err := ioutil.ReadDir(dest)
-	require.NoError(t, err)
-	actual := []string{}
-	for _, fileInfo := range files {
-		actual = append(actual, fileInfo.Name())
-	}
-	sort.Strings(actual)
-	assert.Equal(t, []string{dockerfileName, ".dockerignore", "foo"}, actual)
+	var cmpTarHeaderNameAndOwner = cmp.Comparer(func(x, y tar.Header) bool {
+		return x.Name == y.Name && x.Uid == y.Uid && x.Gid == y.Gid
+	})
+	assert.DeepEqual(t, expected, headers, cmpTarHeaderNameAndOwner)
 }
 
 func TestRunBuildDockerfileOutsideContext(t *testing.T) {
 	dir := fs.NewDir(t, t.Name(),
-		fs.WithFile("data", "data file"),
-	)
+		fs.WithFile("data", "data file"))
 	defer dir.Remove()
 
 	// Dockerfile outside of build-context
@@ -123,51 +101,32 @@ COPY data /data
 	)
 	defer df.Remove()
 
-	dest, err := ioutil.TempDir("", t.Name())
-	require.NoError(t, err)
-	defer os.RemoveAll(dest)
-
-	var dockerfileName string
-	fakeImageBuild := func(_ context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-		buffer := new(bytes.Buffer)
-		tee := io.TeeReader(context, buffer)
-
-		assert.NoError(t, archive.Untar(tee, dest, nil))
-		dockerfileName = options.Dockerfile
-
-		body := new(bytes.Buffer)
-		return types.ImageBuildResponse{Body: ioutil.NopCloser(body)}, nil
-	}
-
-	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeImageBuild})
+	fakeBuild := newFakeBuild()
+	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeBuild.build})
 
 	options := newBuildOptions()
 	options.context = dir.Path()
 	options.dockerfileName = df.Path()
+	options.untrusted = true
+	assert.NilError(t, runBuild(cli, options))
 
-	err = runBuild(cli, options)
-	require.NoError(t, err)
-
-	files, err := ioutil.ReadDir(dest)
-	require.NoError(t, err)
-	var actual []string
-	for _, fileInfo := range files {
-		actual = append(actual, fileInfo.Name())
-	}
-	sort.Strings(actual)
-	assert.Equal(t, []string{dockerfileName, ".dockerignore", "data"}, actual)
+	expected := []string{fakeBuild.options.Dockerfile, ".dockerignore", "data"}
+	assert.DeepEqual(t, expected, fakeBuild.filenames(t))
 }
 
 // TestRunBuildFromLocalGitHubDirNonExistingRepo tests that build contexts
 // starting with `github.com/` are special-cased, and the build command attempts
 // to clone the remote repo.
+// TODO: test "context selection" logic directly when runBuild is refactored
+// to support testing (ex: docker/cli#294)
 func TestRunBuildFromGitHubSpecialCase(t *testing.T) {
 	cmd := NewBuildCommand(test.NewFakeCli(nil))
-	cmd.SetArgs([]string{"github.com/docker/no-such-repository"})
+	// Clone a small repo that exists so git doesn't prompt for credentials
+	cmd.SetArgs([]string{"github.com/docker/for-win"})
 	cmd.SetOutput(ioutil.Discard)
 	err := cmd.Execute()
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "unable to prepare context: unable to 'git clone'")
+	assert.ErrorContains(t, err, "unable to prepare context")
+	assert.ErrorContains(t, err, "docker-build-git")
 }
 
 // TestRunBuildFromLocalGitHubDirNonExistingRepo tests that a local directory
@@ -175,19 +134,83 @@ func TestRunBuildFromGitHubSpecialCase(t *testing.T) {
 // case.
 func TestRunBuildFromLocalGitHubDir(t *testing.T) {
 	tmpDir, err := ioutil.TempDir("", "docker-build-from-local-dir-")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	defer os.RemoveAll(tmpDir)
 
 	buildDir := filepath.Join(tmpDir, "github.com", "docker", "no-such-repository")
 	err = os.MkdirAll(buildDir, 0777)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	err = ioutil.WriteFile(filepath.Join(buildDir, "Dockerfile"), []byte("FROM busybox\n"), 0644)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	client := test.NewFakeCli(&fakeClient{})
 	cmd := NewBuildCommand(client)
 	cmd.SetArgs([]string{buildDir})
 	cmd.SetOutput(ioutil.Discard)
 	err = cmd.Execute()
-	require.NoError(t, err)
+	assert.NilError(t, err)
+}
+
+func TestRunBuildWithSymlinkedContext(t *testing.T) {
+	dockerfile := `
+FROM alpine:3.6
+RUN echo hello world
+`
+
+	tmpDir := fs.NewDir(t, t.Name(),
+		fs.WithDir("context",
+			fs.WithFile("Dockerfile", dockerfile)),
+		fs.WithSymlink("context-link", "context"))
+	defer tmpDir.Remove()
+
+	fakeBuild := newFakeBuild()
+	cli := test.NewFakeCli(&fakeClient{imageBuildFunc: fakeBuild.build})
+	options := newBuildOptions()
+	options.context = tmpDir.Join("context-link")
+	options.untrusted = true
+	assert.NilError(t, runBuild(cli, options))
+
+	assert.DeepEqual(t, fakeBuild.filenames(t), []string{"Dockerfile"})
+}
+
+type fakeBuild struct {
+	context *tar.Reader
+	options types.ImageBuildOptions
+}
+
+func newFakeBuild() *fakeBuild {
+	return &fakeBuild{}
+}
+
+func (f *fakeBuild) build(_ context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
+	f.context = tar.NewReader(context)
+	f.options = options
+	body := new(bytes.Buffer)
+	return types.ImageBuildResponse{Body: ioutil.NopCloser(body)}, nil
+}
+
+func (f *fakeBuild) headers(t *testing.T) []*tar.Header {
+	t.Helper()
+	headers := []*tar.Header{}
+	for {
+		hdr, err := f.context.Next()
+		switch err {
+		case io.EOF:
+			return headers
+		case nil:
+			headers = append(headers, hdr)
+		default:
+			assert.NilError(t, err)
+		}
+	}
+}
+
+func (f *fakeBuild) filenames(t *testing.T) []string {
+	t.Helper()
+	names := []string{}
+	for _, header := range f.headers(t) {
+		names = append(names, header.Name)
+	}
+	sort.Strings(names)
+	return names
 }

components/cli/cli/command/image/history_test.go

@@ -7,11 +7,11 @@ import (
 	"time"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types/image"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
+	"github.com/gotestyourself/gotestyourself/skip"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewHistoryCommandErrors(t *testing.T) {
@@ -39,15 +39,20 @@ func TestNewHistoryCommandErrors(t *testing.T) {
 		cmd := NewHistoryCommand(test.NewFakeCli(&fakeClient{imageHistoryFunc: tc.imageHistoryFunc}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
+func notUTCTimezone() bool {
+	now := time.Now()
+	return now != now.UTC()
+}
+
 func TestNewHistoryCommandSuccess(t *testing.T) {
+	skip.If(t, notUTCTimezone, "expected output requires UTC timezone")
 	testCases := []struct {
 		name             string
 		args             []string
-		outputRegex      string
 		imageHistoryFunc func(img string) ([]image.HistoryResponseItem, error)
 	}{
 		{
@@ -64,16 +69,17 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 			name: "quiet",
 			args: []string{"--quiet", "image:tag"},
 		},
-		// TODO: This test is failing since the output does not contain an RFC3339 date
-		//{
-		//	name:        "non-human",
-		//	args:        []string{"--human=false", "image:tag"},
-		//	outputRegex: "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}", // RFC3339 date format match
-		//},
 		{
-			name:        "non-human-header",
-			args:        []string{"--human=false", "image:tag"},
-			outputRegex: "CREATED\\sAT",
+			name: "non-human",
+			args: []string{"--human=false", "image:tag"},
+			imageHistoryFunc: func(img string) ([]image.HistoryResponseItem, error) {
+				return []image.HistoryResponseItem{{
+					ID:        "abcdef",
+					Created:   time.Date(2017, 1, 1, 12, 0, 3, 0, time.UTC).Unix(),
+					CreatedBy: "rose",
+					Comment:   "new history item!",
+				}}, nil
+			},
 		},
 		{
 			name: "quiet-no-trunc",
@@ -92,12 +98,8 @@ func TestNewHistoryCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		actual := cli.OutBuffer().String()
-		if tc.outputRegex == "" {
-			golden.Assert(t, actual, fmt.Sprintf("history-command-success.%s.golden", tc.name))
-		} else {
-			assert.Regexp(t, tc.outputRegex, actual)
-		}
+		golden.Assert(t, actual, fmt.Sprintf("history-command-success.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/image/import_test.go

@@ -7,10 +7,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewImportCommandErrors(t *testing.T) {
@@ -38,7 +38,7 @@ func TestNewImportCommandErrors(t *testing.T) {
 		cmd := NewImportCommand(test.NewFakeCli(&fakeClient{imageImportFunc: tc.imageImportFunc}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -46,7 +46,7 @@ func TestNewImportCommandInvalidFile(t *testing.T) {
 	cmd := NewImportCommand(test.NewFakeCli(&fakeClient{}))
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs([]string{"testdata/import-command-success.unexistent-file"})
-	testutil.ErrorContains(t, cmd.Execute(), "testdata/import-command-success.unexistent-file")
+	assert.ErrorContains(t, cmd.Execute(), "testdata/import-command-success.unexistent-file")
 }
 
 func TestNewImportCommandSuccess(t *testing.T) {
@@ -67,7 +67,7 @@ func TestNewImportCommandSuccess(t *testing.T) {
 			name: "double",
 			args: []string{"-", "image:local"},
 			imageImportFunc: func(source types.ImageImportSource, ref string, options types.ImageImportOptions) (io.ReadCloser, error) {
-				assert.Equal(t, "image:local", ref)
+				assert.Check(t, is.Equal("image:local", ref))
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 		},
@@ -75,7 +75,7 @@ func TestNewImportCommandSuccess(t *testing.T) {
 			name: "message",
 			args: []string{"--message", "test message", "-"},
 			imageImportFunc: func(source types.ImageImportSource, ref string, options types.ImageImportOptions) (io.ReadCloser, error) {
-				assert.Equal(t, "test message", options.Message)
+				assert.Check(t, is.Equal("test message", options.Message))
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 		},
@@ -83,7 +83,7 @@ func TestNewImportCommandSuccess(t *testing.T) {
 			name: "change",
 			args: []string{"--change", "ENV DEBUG true", "-"},
 			imageImportFunc: func(source types.ImageImportSource, ref string, options types.ImageImportOptions) (io.ReadCloser, error) {
-				assert.Equal(t, "ENV DEBUG true", options.Changes[0])
+				assert.Check(t, is.Equal("ENV DEBUG true", options.Changes[0]))
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 		},
@@ -92,6 +92,6 @@ func TestNewImportCommandSuccess(t *testing.T) {
 		cmd := NewImportCommand(test.NewFakeCli(&fakeClient{imageImportFunc: tc.imageImportFunc}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 	}
 }

components/cli/cli/command/image/inspect_test.go

@@ -6,10 +6,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewInspectCommandErrors(t *testing.T) {
@@ -28,7 +28,7 @@ func TestNewInspectCommandErrors(t *testing.T) {
 		cmd := newInspectCommand(test.NewFakeCli(&fakeClient{}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -46,7 +46,7 @@ func TestNewInspectCommandSuccess(t *testing.T) {
 			imageCount: 1,
 			imageInspectFunc: func(image string) (types.ImageInspect, []byte, error) {
 				imageInspectInvocationCount++
-				assert.Equal(t, "image", image)
+				assert.Check(t, is.Equal("image", image))
 				return types.ImageInspect{}, nil, nil
 			},
 		},
@@ -66,9 +66,9 @@ func TestNewInspectCommandSuccess(t *testing.T) {
 			imageInspectFunc: func(image string) (types.ImageInspect, []byte, error) {
 				imageInspectInvocationCount++
 				if imageInspectInvocationCount == 1 {
-					assert.Equal(t, "image1", image)
+					assert.Check(t, is.Equal("image1", image))
 				} else {
-					assert.Equal(t, "image2", image)
+					assert.Check(t, is.Equal("image2", image))
 				}
 				return types.ImageInspect{}, nil, nil
 			},
@@ -81,8 +81,8 @@ func TestNewInspectCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("inspect-command-success.%s.golden", tc.name))
-		assert.Equal(t, imageInspectInvocationCount, tc.imageCount)
+		assert.Check(t, is.Equal(imageInspectInvocationCount, tc.imageCount))
 	}
 }

components/cli/cli/command/image/list_test.go

@@ -7,11 +7,11 @@ import (
 
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewImagesCommandErrors(t *testing.T) {
@@ -38,7 +38,7 @@ func TestNewImagesCommandErrors(t *testing.T) {
 		cmd := NewImagesCommand(test.NewFakeCli(&fakeClient{imageListFunc: tc.imageListFunc}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -65,7 +65,7 @@ func TestNewImagesCommandSuccess(t *testing.T) {
 			name: "match-name",
 			args: []string{"image"},
 			imageListFunc: func(options types.ImageListOptions) ([]types.ImageSummary, error) {
-				assert.Equal(t, "image", options.Filters.Get("reference")[0])
+				assert.Check(t, is.Equal("image", options.Filters.Get("reference")[0]))
 				return []types.ImageSummary{{}}, nil
 			},
 		},
@@ -73,7 +73,7 @@ func TestNewImagesCommandSuccess(t *testing.T) {
 			name: "filters",
 			args: []string{"--filter", "name=value"},
 			imageListFunc: func(options types.ImageListOptions) ([]types.ImageSummary, error) {
-				assert.Equal(t, "value", options.Filters.Get("name")[0])
+				assert.Check(t, is.Equal("value", options.Filters.Get("name")[0]))
 				return []types.ImageSummary{{}}, nil
 			},
 		},
@@ -85,14 +85,14 @@ func TestNewImagesCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("list-command-success.%s.golden", tc.name))
 	}
 }
 
 func TestNewListCommandAlias(t *testing.T) {
 	cmd := newListCommand(test.NewFakeCli(&fakeClient{}))
-	assert.True(t, cmd.HasAlias("images"))
-	assert.True(t, cmd.HasAlias("list"))
-	assert.False(t, cmd.HasAlias("other"))
+	assert.Check(t, cmd.HasAlias("images"))
+	assert.Check(t, cmd.HasAlias("list"))
+	assert.Check(t, !cmd.HasAlias("other"))
 }

components/cli/cli/command/image/load_test.go

@@ -8,11 +8,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewLoadCommandErrors(t *testing.T) {
@@ -47,7 +46,7 @@ func TestNewLoadCommandErrors(t *testing.T) {
 		cmd := NewLoadCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -57,7 +56,7 @@ func TestNewLoadCommandInvalidInput(t *testing.T) {
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs([]string{"--input", "*"})
 	err := cmd.Execute()
-	testutil.ErrorContains(t, err, expectedError)
+	assert.ErrorContains(t, err, expectedError)
 }
 
 func TestNewLoadCommandSuccess(t *testing.T) {
@@ -96,7 +95,7 @@ func TestNewLoadCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("load-command-success.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/image/prune_test.go

@@ -6,12 +6,12 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewPruneCommandErrors(t *testing.T) {
@@ -41,7 +41,7 @@ func TestNewPruneCommandErrors(t *testing.T) {
 		}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -55,7 +55,7 @@ func TestNewPruneCommandSuccess(t *testing.T) {
 			name: "all",
 			args: []string{"--all"},
 			imagesPruneFunc: func(pruneFilter filters.Args) (types.ImagesPruneReport, error) {
-				assert.Equal(t, "false", pruneFilter.Get("dangling")[0])
+				assert.Check(t, is.Equal("false", pruneFilter.Get("dangling")[0]))
 				return types.ImagesPruneReport{}, nil
 			},
 		},
@@ -63,7 +63,7 @@ func TestNewPruneCommandSuccess(t *testing.T) {
 			name: "force-deleted",
 			args: []string{"--force"},
 			imagesPruneFunc: func(pruneFilter filters.Args) (types.ImagesPruneReport, error) {
-				assert.Equal(t, "true", pruneFilter.Get("dangling")[0])
+				assert.Check(t, is.Equal("true", pruneFilter.Get("dangling")[0]))
 				return types.ImagesPruneReport{
 					ImagesDeleted:  []types.ImageDeleteResponseItem{{Deleted: "image1"}},
 					SpaceReclaimed: 1,
@@ -74,7 +74,7 @@ func TestNewPruneCommandSuccess(t *testing.T) {
 			name: "force-untagged",
 			args: []string{"--force"},
 			imagesPruneFunc: func(pruneFilter filters.Args) (types.ImagesPruneReport, error) {
-				assert.Equal(t, "true", pruneFilter.Get("dangling")[0])
+				assert.Check(t, is.Equal("true", pruneFilter.Get("dangling")[0]))
 				return types.ImagesPruneReport{
 					ImagesDeleted:  []types.ImageDeleteResponseItem{{Untagged: "image1"}},
 					SpaceReclaimed: 2,
@@ -88,7 +88,7 @@ func TestNewPruneCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("prune-command-success.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/image/pull.go

@@ -14,9 +14,10 @@ import (
 )
 
 type pullOptions struct {
-	remote   string
-	all      bool
-	platform string
+	remote    string
+	all       bool
+	platform  string
+	untrusted bool
 }
 
 // NewPullCommand creates a new `docker pull` command
@@ -38,7 +39,7 @@ func NewPullCommand(dockerCli command.Cli) *cobra.Command {
 	flags.BoolVarP(&opts.all, "all-tags", "a", false, "Download all tagged images in the repository")
 
 	command.AddPlatformFlag(flags, &opts.platform)
-	command.AddTrustVerificationFlags(flags)
+	command.AddTrustVerificationFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 
 	return cmd
 }
@@ -58,14 +59,14 @@ func runPull(cli command.Cli, opts pullOptions) error {
 	}
 
 	ctx := context.Background()
-	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), distributionRef.String())
+	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, AuthResolver(cli), distributionRef.String())
 	if err != nil {
 		return err
 	}
 
 	// Check if reference has a digest
 	_, isCanonical := distributionRef.(reference.Canonical)
-	if command.IsTrusted() && !isCanonical {
+	if !opts.untrusted && !isCanonical {
 		err = trustedPull(ctx, cli, imgRefAndAuth, opts.platform)
 	} else {
 		err = imagePullPrivileged(ctx, cli, imgRefAndAuth, opts.all, opts.platform)

components/cli/cli/command/image/pull_test.go

@@ -8,10 +8,11 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/docker/cli/internal/test/notary"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewPullCommandErrors(t *testing.T) {
@@ -41,7 +42,7 @@ func TestNewPullCommandErrors(t *testing.T) {
 		cmd := NewPullCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -65,7 +66,7 @@ func TestNewPullCommandSuccess(t *testing.T) {
 	for _, tc := range testCases {
 		cli := test.NewFakeCli(&fakeClient{
 			imagePullFunc: func(ref string, options types.ImagePullOptions) (io.ReadCloser, error) {
-				assert.Equal(t, tc.expectedTag, ref, tc.name)
+				assert.Check(t, is.Equal(tc.expectedTag, ref), tc.name)
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 		})
@@ -73,7 +74,48 @@ func TestNewPullCommandSuccess(t *testing.T) {
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
 		err := cmd.Execute()
-		assert.NoError(t, err)
+		assert.NilError(t, err)
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("pull-command-success.%s.golden", tc.name))
 	}
 }
+
+func TestNewPullCommandWithContentTrustErrors(t *testing.T) {
+	testCases := []struct {
+		name          string
+		args          []string
+		expectedError string
+		notaryFunc    test.NotaryClientFuncType
+	}{
+		{
+			name:          "offline-notary-server",
+			notaryFunc:    notary.GetOfflineNotaryRepository,
+			expectedError: "client is offline",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "uninitialized-notary-server",
+			notaryFunc:    notary.GetUninitializedNotaryRepository,
+			expectedError: "remote trust data does not exist",
+			args:          []string{"image:tag"},
+		},
+		{
+			name:          "empty-notary-server",
+			notaryFunc:    notary.GetEmptyTargetsNotaryRepository,
+			expectedError: "No valid trust data for tag",
+			args:          []string{"image:tag"},
+		},
+	}
+	for _, tc := range testCases {
+		cli := test.NewFakeCli(&fakeClient{
+			imagePullFunc: func(ref string, options types.ImagePullOptions) (io.ReadCloser, error) {
+				return ioutil.NopCloser(strings.NewReader("")), fmt.Errorf("shouldn't try to pull image")
+			},
+		}, test.EnableContentTrust)
+		cli.SetNotaryClient(tc.notaryFunc)
+		cmd := NewPullCommand(cli)
+		cmd.SetOutput(ioutil.Discard)
+		cmd.SetArgs(tc.args)
+		err := cmd.Execute()
+		assert.ErrorContains(t, err, tc.expectedError)
+	}
+}

components/cli/cli/command/image/push.go

@@ -11,26 +11,34 @@ import (
 	"github.com/spf13/cobra"
 )
 
+type pushOptions struct {
+	remote    string
+	untrusted bool
+}
+
 // NewPushCommand creates a new `docker push` command
 func NewPushCommand(dockerCli command.Cli) *cobra.Command {
+	var opts pushOptions
+
 	cmd := &cobra.Command{
 		Use:   "push [OPTIONS] NAME[:TAG]",
 		Short: "Push an image or a repository to a registry",
 		Args:  cli.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runPush(dockerCli, args[0])
+			opts.remote = args[0]
+			return runPush(dockerCli, opts)
 		},
 	}
 
 	flags := cmd.Flags()
 
-	command.AddTrustSigningFlags(flags)
+	command.AddTrustSigningFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 
 	return cmd
 }
 
-func runPush(dockerCli command.Cli, remote string) error {
-	ref, err := reference.ParseNormalizedNamed(remote)
+func runPush(dockerCli command.Cli, opts pushOptions) error {
+	ref, err := reference.ParseNormalizedNamed(opts.remote)
 	if err != nil {
 		return err
 	}
@@ -47,7 +55,7 @@ func runPush(dockerCli command.Cli, remote string) error {
 	authConfig := command.ResolveAuthConfig(ctx, dockerCli, repoInfo.Index)
 	requestPrivilege := command.RegistryAuthenticationPrivilegedFunc(dockerCli, repoInfo.Index, "push")
 
-	if command.IsTrusted() {
+	if !opts.untrusted {
 		return TrustedPush(ctx, dockerCli, repoInfo, ref, authConfig, requestPrivilege)
 	}
 

components/cli/cli/command/image/push_test.go

@@ -7,10 +7,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNewPushCommandErrors(t *testing.T) {
@@ -38,18 +37,13 @@ func TestNewPushCommandErrors(t *testing.T) {
 				return ioutil.NopCloser(strings.NewReader("")), errors.Errorf("Failed to push")
 			},
 		},
-		{
-			name:          "trust-error",
-			args:          []string{"--disable-content-trust=false", "image:repo"},
-			expectedError: "you are not authorized to perform this operation: server returned 401.",
-		},
 	}
 	for _, tc := range testCases {
 		cli := test.NewFakeCli(&fakeClient{imagePushFunc: tc.imagePushFunc})
 		cmd := NewPushCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -72,6 +66,6 @@ func TestNewPushCommandSuccess(t *testing.T) {
 		cmd := NewPushCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 	}
 }

components/cli/cli/command/image/remove_test.go

@@ -6,11 +6,11 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 type notFound struct {
@@ -27,9 +27,9 @@ func (n notFound) NotFound() bool {
 
 func TestNewRemoveCommandAlias(t *testing.T) {
 	cmd := newRemoveCommand(test.NewFakeCli(&fakeClient{}))
-	assert.True(t, cmd.HasAlias("rmi"))
-	assert.True(t, cmd.HasAlias("remove"))
-	assert.False(t, cmd.HasAlias("other"))
+	assert.Check(t, cmd.HasAlias("rmi"))
+	assert.Check(t, cmd.HasAlias("remove"))
+	assert.Check(t, !cmd.HasAlias("other"))
 }
 
 func TestNewRemoveCommandErrors(t *testing.T) {
@@ -48,7 +48,7 @@ func TestNewRemoveCommandErrors(t *testing.T) {
 			args:          []string{"-f", "image1"},
 			expectedError: "error removing image",
 			imageRemoveFunc: func(image string, options types.ImageRemoveOptions) ([]types.ImageDeleteResponseItem, error) {
-				assert.Equal(t, "image1", image)
+				assert.Check(t, is.Equal("image1", image))
 				return []types.ImageDeleteResponseItem{}, errors.Errorf("error removing image")
 			},
 		},
@@ -57,8 +57,8 @@ func TestNewRemoveCommandErrors(t *testing.T) {
 			args:          []string{"arg1"},
 			expectedError: "error removing image",
 			imageRemoveFunc: func(image string, options types.ImageRemoveOptions) ([]types.ImageDeleteResponseItem, error) {
-				assert.False(t, options.Force)
-				assert.True(t, options.PruneChildren)
+				assert.Check(t, !options.Force)
+				assert.Check(t, options.PruneChildren)
 				return []types.ImageDeleteResponseItem{}, errors.Errorf("error removing image")
 			},
 		},
@@ -70,7 +70,7 @@ func TestNewRemoveCommandErrors(t *testing.T) {
 			}))
 			cmd.SetOutput(ioutil.Discard)
 			cmd.SetArgs(tc.args)
-			testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+			assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 		})
 	}
 }
@@ -86,7 +86,7 @@ func TestNewRemoveCommandSuccess(t *testing.T) {
 			name: "Image Deleted",
 			args: []string{"image1"},
 			imageRemoveFunc: func(image string, options types.ImageRemoveOptions) ([]types.ImageDeleteResponseItem, error) {
-				assert.Equal(t, "image1", image)
+				assert.Check(t, is.Equal("image1", image))
 				return []types.ImageDeleteResponseItem{{Deleted: image}}, nil
 			},
 		},
@@ -94,8 +94,8 @@ func TestNewRemoveCommandSuccess(t *testing.T) {
 			name: "Image not found with force option",
 			args: []string{"-f", "image1"},
 			imageRemoveFunc: func(image string, options types.ImageRemoveOptions) ([]types.ImageDeleteResponseItem, error) {
-				assert.Equal(t, "image1", image)
-				assert.Equal(t, true, options.Force)
+				assert.Check(t, is.Equal("image1", image))
+				assert.Check(t, is.Equal(true, options.Force))
 				return []types.ImageDeleteResponseItem{}, notFound{"image1"}
 			},
 			expectedStderr: "Error: No such image: image1\n",
@@ -105,7 +105,7 @@ func TestNewRemoveCommandSuccess(t *testing.T) {
 			name: "Image Untagged",
 			args: []string{"image1"},
 			imageRemoveFunc: func(image string, options types.ImageRemoveOptions) ([]types.ImageDeleteResponseItem, error) {
-				assert.Equal(t, "image1", image)
+				assert.Check(t, is.Equal("image1", image))
 				return []types.ImageDeleteResponseItem{{Untagged: image}}, nil
 			},
 		},
@@ -126,8 +126,8 @@ func TestNewRemoveCommandSuccess(t *testing.T) {
 			cmd := NewRemoveCommand(cli)
 			cmd.SetOutput(ioutil.Discard)
 			cmd.SetArgs(tc.args)
-			assert.NoError(t, cmd.Execute())
-			assert.Equal(t, tc.expectedStderr, cli.ErrBuffer().String())
+			assert.NilError(t, cmd.Execute())
+			assert.Check(t, is.Equal(tc.expectedStderr, cli.ErrBuffer().String()))
 			golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("remove-command-success.%s.golden", tc.name))
 		})
 	}

components/cli/cli/command/image/save_test.go

@@ -8,10 +8,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNewSaveCommandErrors(t *testing.T) {
@@ -54,7 +53,7 @@ func TestNewSaveCommandErrors(t *testing.T) {
 		cmd := NewSaveCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -69,8 +68,8 @@ func TestNewSaveCommandSuccess(t *testing.T) {
 			args:       []string{"-o", "save_tmp_file", "arg1"},
 			isTerminal: true,
 			imageSaveFunc: func(images []string) (io.ReadCloser, error) {
-				require.Len(t, images, 1)
-				assert.Equal(t, "arg1", images[0])
+				assert.Assert(t, is.Len(images, 1))
+				assert.Check(t, is.Equal("arg1", images[0]))
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 			deferredFunc: func() {
@@ -81,9 +80,9 @@ func TestNewSaveCommandSuccess(t *testing.T) {
 			args:       []string{"arg1", "arg2"},
 			isTerminal: false,
 			imageSaveFunc: func(images []string) (io.ReadCloser, error) {
-				require.Len(t, images, 2)
-				assert.Equal(t, "arg1", images[0])
-				assert.Equal(t, "arg2", images[1])
+				assert.Assert(t, is.Len(images, 2))
+				assert.Check(t, is.Equal("arg1", images[0]))
+				assert.Check(t, is.Equal("arg2", images[1]))
 				return ioutil.NopCloser(strings.NewReader("")), nil
 			},
 		},
@@ -96,7 +95,7 @@ func TestNewSaveCommandSuccess(t *testing.T) {
 		}))
 		cmd.SetOutput(ioutil.Discard)
 		cmd.SetArgs(tc.args)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		if tc.deferredFunc != nil {
 			tc.deferredFunc()
 		}

components/cli/cli/command/image/tag_test.go

@@ -5,8 +5,8 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestCliNewTagCommandErrors(t *testing.T) {
@@ -20,7 +20,7 @@ func TestCliNewTagCommandErrors(t *testing.T) {
 		cmd := NewTagCommand(test.NewFakeCli(&fakeClient{}))
 		cmd.SetArgs(args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), expectedError)
+		assert.ErrorContains(t, cmd.Execute(), expectedError)
 	}
 }
 
@@ -28,14 +28,14 @@ func TestCliNewTagCommand(t *testing.T) {
 	cmd := NewTagCommand(
 		test.NewFakeCli(&fakeClient{
 			imageTagFunc: func(image string, ref string) error {
-				assert.Equal(t, "image1", image)
-				assert.Equal(t, "image2", ref)
+				assert.Check(t, is.Equal("image1", image))
+				assert.Check(t, is.Equal("image2", ref))
 				return nil
 			},
 		}))
 	cmd.SetArgs([]string{"image1", "image2"})
 	cmd.SetOutput(ioutil.Discard)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	value, _ := cmd.Flags().GetBool("interspersed")
-	assert.False(t, value)
+	assert.Check(t, !value)
 }

components/cli/cli/command/image/testdata/history-command-success.non-human.golden

@@ -0,0 +1,2 @@
+IMAGE               CREATED AT             CREATED BY          SIZE                COMMENT
+abcdef              2017-01-01T12:00:03Z   rose                0                   new history item!

components/cli/cli/command/image/trust.go

@@ -198,7 +198,7 @@ func trustedPull(ctx context.Context, cli command.Cli, imgRefAndAuth trust.Image
 		if err != nil {
 			return err
 		}
-		updatedImgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, AuthResolver(cli), trustedRef.String())
+		updatedImgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, nil, AuthResolver(cli), trustedRef.String())
 		if err != nil {
 			return err
 		}
@@ -293,35 +293,24 @@ func imagePullPrivileged(ctx context.Context, cli command.Cli, imgRefAndAuth tru
 
 // TrustedReference returns the canonical trusted reference for an image reference
 func TrustedReference(ctx context.Context, cli command.Cli, ref reference.NamedTagged, rs registry.Service) (reference.Canonical, error) {
-	var (
-		repoInfo *registry.RepositoryInfo
-		err      error
-	)
-	if rs != nil {
-		repoInfo, err = rs.ResolveRepository(ref)
-	} else {
-		repoInfo, err = registry.ParseRepositoryInfo(ref)
-	}
+	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, rs, AuthResolver(cli), ref.String())
 	if err != nil {
 		return nil, err
 	}
 
-	// Resolve the Auth config relevant for this server
-	authConfig := command.ResolveAuthConfig(ctx, cli, repoInfo.Index)
-
-	notaryRepo, err := trust.GetNotaryRepository(cli.In(), cli.Out(), command.UserAgent(), repoInfo, &authConfig, "pull")
+	notaryRepo, err := cli.NotaryClient(imgRefAndAuth, []string{"pull"})
 	if err != nil {
 		return nil, errors.Wrap(err, "error establishing connection to trust repository")
 	}
 
 	t, err := notaryRepo.GetTargetByName(ref.Tag(), trust.ReleasesRole, data.CanonicalTargetsRole)
 	if err != nil {
-		return nil, trust.NotaryError(repoInfo.Name.Name(), err)
+		return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), err)
 	}
 	// Only list tags in the top level targets role or the releases delegation role - ignore
 	// all other delegation roles
 	if t.Role != trust.ReleasesRole && t.Role != data.CanonicalTargetsRole {
-		return nil, trust.NotaryError(repoInfo.Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
+		return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
 	}
 	r, err := convertTarget(t.Target)
 	if err != nil {

components/cli/cli/command/image/trust_test.go

@@ -7,9 +7,7 @@ import (
 
 	"github.com/docker/cli/cli/trust"
 	registrytypes "github.com/docker/docker/api/types/registry"
-	"github.com/docker/docker/registry"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/passphrase"
 	"github.com/theupdateframework/notary/trustpinning"
@@ -48,8 +46,8 @@ func TestHTTPENVTrustServer(t *testing.T) {
 func TestOfficialTrustServer(t *testing.T) {
 	indexInfo := &registrytypes.IndexInfo{Name: "testserver", Official: true}
 	output, err := trust.Server(indexInfo)
-	if err != nil || output != registry.NotaryServer {
-		t.Fatalf("Expected server to be %s, got %s", registry.NotaryServer, output)
+	if err != nil || output != trust.NotaryServer {
+		t.Fatalf("Expected server to be %s, got %s", trust.NotaryServer, output)
 	}
 }
 
@@ -64,12 +62,12 @@ func TestNonOfficialTrustServer(t *testing.T) {
 
 func TestAddTargetToAllSignableRolesError(t *testing.T) {
 	tmpDir, err := ioutil.TempDir("", "notary-test-")
-	assert.NoError(t, err)
+	assert.NilError(t, err)
 	defer os.RemoveAll(tmpDir)
 
 	notaryRepo, err := client.NewFileCachedRepository(tmpDir, "gun", "https://localhost", nil, passphrase.ConstantRetriever("password"), trustpinning.TrustPinConfig{})
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	target := client.Target{}
 	err = AddTargetToAllSignableRoles(notaryRepo, &target)
-	assert.EqualError(t, err, "client is offline")
+	assert.Error(t, err, "client is offline")
 }

components/cli/cli/command/inspect/inspector_test.go

@@ -6,8 +6,8 @@ import (
 	"testing"
 
 	"github.com/docker/cli/templates"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 type testElement struct {
@@ -243,17 +243,17 @@ func TestTemplateInspectorRawFallbackNumber(t *testing.T) {
 	}
 	b := new(bytes.Buffer)
 	tmpl, err := templates.Parse("{{.Size}} {{.Id}}")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	i := NewTemplateInspector(b, tmpl)
 	for _, tc := range testcases {
 		err = i.Inspect(typedElem, tc.raw)
-		require.NoError(t, err)
+		assert.NilError(t, err)
 
 		err = i.Flush()
-		require.NoError(t, err)
+		assert.NilError(t, err)
 
-		assert.Equal(t, tc.exp, b.String())
+		assert.Check(t, is.Equal(tc.exp, b.String()))
 		b.Reset()
 	}
 }

components/cli/cli/command/manifest/annotate_test.go

@@ -5,10 +5,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestManifestAnnotateError(t *testing.T) {
@@ -35,7 +34,7 @@ func TestManifestAnnotateError(t *testing.T) {
 		cmd := newAnnotateCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -48,13 +47,13 @@ func TestManifestAnnotate(t *testing.T) {
 	namedRef := ref(t, "alpine:3.0")
 	imageManifest := fullImageManifest(t, namedRef)
 	err := store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	cmd := newAnnotateCommand(cli)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/fake:0.0"})
 	cmd.SetOutput(ioutil.Discard)
 	expectedError := "manifest for image example.com/fake:0.0 does not exist"
-	testutil.ErrorContains(t, cmd.Execute(), expectedError)
+	assert.ErrorContains(t, cmd.Execute(), expectedError)
 
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
 	cmd.Flags().Set("os", "freebsd")
@@ -62,17 +61,17 @@ func TestManifestAnnotate(t *testing.T) {
 	cmd.Flags().Set("os-features", "feature1")
 	cmd.Flags().Set("variant", "v7")
 	expectedError = "manifest entry for image has unsupported os/arch combination"
-	testutil.ErrorContains(t, cmd.Execute(), expectedError)
+	assert.ErrorContains(t, cmd.Execute(), expectedError)
 
 	cmd.Flags().Set("arch", "arm")
-	require.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 
 	cmd = newInspectCommand(cli)
 	err = cmd.Flags().Set("verbose", "true")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
-	require.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	actual := cli.OutBuffer()
 	expected := golden.Get(t, "inspect-annotate.golden")
-	assert.Equal(t, string(expected), actual.String())
+	assert.Check(t, is.Equal(string(expected), actual.String()))
 }

components/cli/cli/command/manifest/client_test.go

@@ -10,7 +10,6 @@ import (
 )
 
 type fakeRegistryClient struct {
-	client.RegistryClient
 	getManifestFunc     func(ctx context.Context, ref reference.Named) (manifesttypes.ImageManifest, error)
 	getManifestListFunc func(ctx context.Context, ref reference.Named) ([]manifesttypes.ImageManifest, error)
 	mountBlobFunc       func(ctx context.Context, source reference.Canonical, target reference.Named) error
@@ -44,3 +43,5 @@ func (c *fakeRegistryClient) PutManifest(ctx context.Context, ref reference.Name
 	}
 	return digest.Digest(""), nil
 }
+
+var _ client.RegistryClient = &fakeRegistryClient{}

components/cli/cli/command/manifest/create_test.go

@@ -6,12 +6,11 @@ import (
 
 	manifesttypes "github.com/docker/cli/cli/manifest/types"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/distribution/reference"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
@@ -35,7 +34,7 @@ func TestManifestCreateErrors(t *testing.T) {
 		cmd := newCreateListCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -50,28 +49,28 @@ func TestManifestCreateAmend(t *testing.T) {
 	namedRef := ref(t, "alpine:3.0")
 	imageManifest := fullImageManifest(t, namedRef)
 	err := store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	namedRef = ref(t, "alpine:3.1")
 	imageManifest = fullImageManifest(t, namedRef)
 	err = store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	cmd := newCreateListCommand(cli)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.1"})
 	cmd.Flags().Set("amend", "true")
 	cmd.SetOutput(ioutil.Discard)
 	err = cmd.Execute()
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	// make a new cli to clear the buffers
 	cli = test.NewFakeCli(nil)
 	cli.SetManifestStore(store)
 	inspectCmd := newInspectCommand(cli)
 	inspectCmd.SetArgs([]string{"example.com/list:v1"})
-	require.NoError(t, inspectCmd.Execute())
+	assert.NilError(t, inspectCmd.Execute())
 	actual := cli.OutBuffer()
 	expected := golden.Get(t, "inspect-manifest-list.golden")
-	assert.Equal(t, string(expected), actual.String())
+	assert.Check(t, is.Equal(string(expected), actual.String()))
 }
 
 // attempt to overwrite a saved manifest and get refused
@@ -84,13 +83,13 @@ func TestManifestCreateRefuseAmend(t *testing.T) {
 	namedRef := ref(t, "alpine:3.0")
 	imageManifest := fullImageManifest(t, namedRef)
 	err := store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	cmd := newCreateListCommand(cli)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
 	cmd.SetOutput(ioutil.Discard)
 	err = cmd.Execute()
-	assert.EqualError(t, err, "refusing to amend an existing manifest list with no --amend flag")
+	assert.Error(t, err, "refusing to amend an existing manifest list with no --amend flag")
 }
 
 // attempt to make a manifest list without valid images
@@ -113,5 +112,5 @@ func TestManifestCreateNoManifest(t *testing.T) {
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
 	cmd.SetOutput(ioutil.Discard)
 	err := cmd.Execute()
-	assert.EqualError(t, err, "No such image: example.com/alpine:3.0")
+	assert.Error(t, err, "No such image: example.com/alpine:3.0")
 }

components/cli/cli/command/manifest/inspect_test.go

@@ -12,24 +12,24 @@ import (
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/manifest/schema2"
 	"github.com/docker/distribution/reference"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/opencontainers/go-digest"
+	digest "github.com/opencontainers/go-digest"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
 func newTempManifestStore(t *testing.T) (store.Store, func()) {
 	tmpdir, err := ioutil.TempDir("", "test-manifest-storage")
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	return store.NewStore(tmpdir), func() { os.RemoveAll(tmpdir) }
 }
 
 func ref(t *testing.T, name string) reference.Named {
 	named, err := reference.ParseNamed("example.com/" + name)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	return named
 }
 
@@ -49,7 +49,7 @@ func fullImageManifest(t *testing.T, ref reference.Named) types.ImageManifest {
 			},
 		},
 	})
-	require.NoError(t, err)
+	assert.NilError(t, err)
 	// TODO: include image data for verbose inspect
 	return types.NewImageManifest(ref, digest.Digest("sha256:7328f6f8b41890597575cbaadc884e7386ae0acc53b747401ebce5cf0d62abcd"), types.Image{OS: "linux", Architecture: "amd64"}, man)
 }
@@ -65,7 +65,7 @@ func TestInspectCommandLocalManifestNotFound(t *testing.T) {
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
 	err := cmd.Execute()
-	assert.EqualError(t, err, "No such manifest: example.com/alpine:3.0")
+	assert.Error(t, err, "No such manifest: example.com/alpine:3.0")
 }
 
 func TestInspectCommandNotFound(t *testing.T) {
@@ -87,7 +87,7 @@ func TestInspectCommandNotFound(t *testing.T) {
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs([]string{"example.com/alpine:3.0"})
 	err := cmd.Execute()
-	assert.EqualError(t, err, "No such manifest: example.com/alpine:3.0")
+	assert.Error(t, err, "No such manifest: example.com/alpine:3.0")
 }
 
 func TestInspectCommandLocalManifest(t *testing.T) {
@@ -99,14 +99,14 @@ func TestInspectCommandLocalManifest(t *testing.T) {
 	namedRef := ref(t, "alpine:3.0")
 	imageManifest := fullImageManifest(t, namedRef)
 	err := store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	cmd := newInspectCommand(cli)
 	cmd.SetArgs([]string{"example.com/list:v1", "example.com/alpine:3.0"})
-	require.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	actual := cli.OutBuffer()
 	expected := golden.Get(t, "inspect-manifest.golden")
-	assert.Equal(t, string(expected), actual.String())
+	assert.Check(t, is.Equal(string(expected), actual.String()))
 }
 
 func TestInspectcommandRemoteManifest(t *testing.T) {
@@ -124,8 +124,8 @@ func TestInspectcommandRemoteManifest(t *testing.T) {
 	cmd := newInspectCommand(cli)
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs([]string{"example.com/alpine:3.0"})
-	require.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	actual := cli.OutBuffer()
 	expected := golden.Get(t, "inspect-manifest.golden")
-	assert.Equal(t, string(expected), actual.String())
+	assert.Check(t, is.Equal(string(expected), actual.String()))
 }

components/cli/cli/command/manifest/push_test.go

@@ -6,16 +6,13 @@ import (
 
 	manifesttypes "github.com/docker/cli/cli/manifest/types"
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/distribution/reference"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
-func newFakeRegistryClient(t *testing.T) *fakeRegistryClient {
-	require.NoError(t, nil)
-
+func newFakeRegistryClient() *fakeRegistryClient {
 	return &fakeRegistryClient{
 		getManifestFunc: func(_ context.Context, _ reference.Named) (manifesttypes.ImageManifest, error) {
 			return manifesttypes.ImageManifest{}, errors.New("")
@@ -46,16 +43,15 @@ func TestManifestPushErrors(t *testing.T) {
 		cmd := newPushListCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
-// store a one-image manifest list and puah it
 func TestManifestPush(t *testing.T) {
 	store, sCleanup := newTempManifestStore(t)
 	defer sCleanup()
 
-	registry := newFakeRegistryClient(t)
+	registry := newFakeRegistryClient()
 
 	cli := test.NewFakeCli(nil)
 	cli.SetManifestStore(store)
@@ -64,10 +60,10 @@ func TestManifestPush(t *testing.T) {
 	namedRef := ref(t, "alpine:3.0")
 	imageManifest := fullImageManifest(t, namedRef)
 	err := store.Save(ref(t, "list:v1"), namedRef, imageManifest)
-	require.NoError(t, err)
+	assert.NilError(t, err)
 
 	cmd := newPushListCommand(cli)
 	cmd.SetArgs([]string{"example.com/list:v1"})
 	err = cmd.Execute()
-	require.NoError(t, err)
+	assert.NilError(t, err)
 }

components/cli/cli/command/network/connect_test.go

@@ -5,10 +5,10 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types/network"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -38,7 +38,7 @@ func TestNetworkConnectErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 
 	}
 }
@@ -54,7 +54,7 @@ func TestNetworkConnectWithFlags(t *testing.T) {
 	}
 	cli := test.NewFakeCli(&fakeClient{
 		networkConnectFunc: func(ctx context.Context, networkID, container string, config *network.EndpointSettings) error {
-			assert.Equal(t, expectedOpts, config.IPAMConfig, "not expected driver error")
+			assert.Check(t, is.DeepEqual(expectedOpts, config.IPAMConfig), "not expected driver error")
 			return nil
 		},
 	})
@@ -66,5 +66,5 @@ func TestNetworkConnectWithFlags(t *testing.T) {
 	cmd.Flags().Set("ip-range", "192.168.4.0/24")
 	cmd.Flags().Set("gateway", "192.168.4.1/24")
 	cmd.Flags().Set("subnet", "192.168.4.0/24")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }

components/cli/cli/command/network/create_test.go

@@ -6,12 +6,11 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/network"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 	"golang.org/x/net/context"
 )
 
@@ -136,10 +135,10 @@ func TestNetworkCreateErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		for key, value := range tc.flags {
-			require.NoError(t, cmd.Flags().Set(key, value))
+			assert.NilError(t, cmd.Flags().Set(key, value))
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 
 	}
 }
@@ -155,8 +154,8 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 	}
 	cli := test.NewFakeCli(&fakeClient{
 		networkCreateFunc: func(ctx context.Context, name string, createBody types.NetworkCreate) (types.NetworkCreateResponse, error) {
-			assert.Equal(t, expectedDriver, createBody.Driver, "not expected driver error")
-			assert.Equal(t, expectedOpts, createBody.IPAM.Config, "not expected driver error")
+			assert.Check(t, is.Equal(expectedDriver, createBody.Driver), "not expected driver error")
+			assert.Check(t, is.DeepEqual(expectedOpts, createBody.IPAM.Config), "not expected driver error")
 			return types.NetworkCreateResponse{
 				ID: name,
 			}, nil
@@ -170,6 +169,6 @@ func TestNetworkCreateWithFlags(t *testing.T) {
 	cmd.Flags().Set("ip-range", "192.168.4.0/24")
 	cmd.Flags().Set("gateway", "192.168.4.1/24")
 	cmd.Flags().Set("subnet", "192.168.4.0/24")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "banana", strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("banana", strings.TrimSpace(cli.OutBuffer().String())))
 }

components/cli/cli/command/network/disconnect_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
 	"golang.org/x/net/context"
 )
@@ -36,6 +36,6 @@ func TestNetworkDisconnectErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }

components/cli/cli/command/network/list_test.go

@@ -1,20 +1,19 @@
 package network
 
 import (
-	"testing"
-
 	"io/ioutil"
-
 	"strings"
+	"testing"
 
 	"github.com/docker/cli/internal/test"
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/filters"
+	"github.com/google/go-cmp/cmp"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 )
 
@@ -38,23 +37,18 @@ func TestNetworkListErrors(t *testing.T) {
 			}),
 		)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
-
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
 func TestNetworkListWithFlags(t *testing.T) {
-
-	filterArgs := filters.NewArgs()
-	filterArgs.Add("image.name", "ubuntu")
-
 	expectedOpts := types.NetworkListOptions{
-		Filters: filterArgs,
+		Filters: filters.NewArgs(filters.Arg("image.name", "ubuntu")),
 	}
 
 	cli := test.NewFakeCli(&fakeClient{
 		networkListFunc: func(ctx context.Context, options types.NetworkListOptions) ([]types.NetworkResource, error) {
-			assert.Equal(t, expectedOpts, options, "not expected options error")
+			assert.Check(t, is.DeepEqual(expectedOpts, options, cmp.AllowUnexported(filters.Args{})))
 			return []types.NetworkResource{*NetworkResource(NetworkResourceID("123454321"),
 				NetworkResourceName("network_1"),
 				NetworkResourceDriver("09.7.01"),
@@ -64,6 +58,6 @@ func TestNetworkListWithFlags(t *testing.T) {
 	cmd := newListCommand(cli)
 
 	cmd.Flags().Set("filter", "image.name=ubuntu")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, strings.TrimSpace(cli.OutBuffer().String()), "network-list.golden")
 }

components/cli/cli/command/node/demote_test.go

@@ -6,11 +6,10 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodeDemoteErrors(t *testing.T) {
@@ -46,7 +45,7 @@ func TestNodeDemoteErrors(t *testing.T) {
 			}))
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -64,7 +63,7 @@ func TestNodeDemoteNoChange(t *testing.T) {
 			},
 		}))
 	cmd.SetArgs([]string{"nodeID"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }
 
 func TestNodeDemoteMultipleNode(t *testing.T) {
@@ -81,5 +80,5 @@ func TestNodeDemoteMultipleNode(t *testing.T) {
 			},
 		}))
 	cmd.SetArgs([]string{"nodeID1", "nodeID2"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }

components/cli/cli/command/node/inspect_test.go

@@ -11,9 +11,8 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodeInspectErrors(t *testing.T) {
@@ -76,7 +75,7 @@ func TestNodeInspectErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -113,7 +112,7 @@ func TestNodeInspectPretty(t *testing.T) {
 		cmd := newInspectCommand(cli)
 		cmd.SetArgs([]string{"nodeID"})
 		cmd.Flags().Set("pretty", "true")
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("node-inspect-pretty.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/node/list_test.go

@@ -8,11 +8,12 @@ import (
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodeListErrorOnAPIFailure(t *testing.T) {
@@ -48,7 +49,7 @@ func TestNodeListErrorOnAPIFailure(t *testing.T) {
 		})
 		cmd := newListCommand(cli)
 		cmd.SetOutput(ioutil.Discard)
-		assert.EqualError(t, cmd.Execute(), tc.expectedError)
+		assert.Error(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -71,7 +72,7 @@ func TestNodeList(t *testing.T) {
 	})
 
 	cmd := newListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "node-list-sort.golden")
 }
 
@@ -85,8 +86,8 @@ func TestNodeListQuietShouldOnlyPrintIDs(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("quiet", "true")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, cli.OutBuffer().String(), "nodeID1\n")
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal(cli.OutBuffer().String(), "nodeID1\n"))
 }
 
 func TestNodeListDefaultFormatFromConfig(t *testing.T) {
@@ -110,7 +111,7 @@ func TestNodeListDefaultFormatFromConfig(t *testing.T) {
 		NodesFormat: "{{.ID}}: {{.Hostname}} {{.Status}}/{{.ManagerStatus}}",
 	})
 	cmd := newListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "node-list-format-from-config.golden")
 }
 
@@ -135,6 +136,6 @@ func TestNodeListFormat(t *testing.T) {
 	})
 	cmd := newListCommand(cli)
 	cmd.Flags().Set("format", "{{.Hostname}}: {{.ManagerStatus}}")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "node-list-format-flag.golden")
 }

components/cli/cli/command/node/promote_test.go

@@ -6,11 +6,10 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodePromoteErrors(t *testing.T) {
@@ -46,7 +45,7 @@ func TestNodePromoteErrors(t *testing.T) {
 			}))
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -64,7 +63,7 @@ func TestNodePromoteNoChange(t *testing.T) {
 			},
 		}))
 	cmd.SetArgs([]string{"nodeID"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }
 
 func TestNodePromoteMultipleNode(t *testing.T) {
@@ -81,5 +80,5 @@ func TestNodePromoteMultipleNode(t *testing.T) {
 			},
 		}))
 	cmd.SetArgs([]string{"nodeID1", "nodeID2"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }

components/cli/cli/command/node/ps_test.go

@@ -12,8 +12,8 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodePsErrors(t *testing.T) {
@@ -60,7 +60,7 @@ func TestNodePsErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		assert.EqualError(t, cmd.Execute(), tc.expectedError)
+		assert.Error(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -122,7 +122,7 @@ func TestNodePs(t *testing.T) {
 		for key, value := range tc.flags {
 			cmd.Flags().Set(key, value)
 		}
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("node-ps.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/node/remove_test.go

@@ -5,9 +5,8 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodeRemoveErrors(t *testing.T) {
@@ -34,12 +33,12 @@ func TestNodeRemoveErrors(t *testing.T) {
 			}))
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
 func TestNodeRemoveMultiple(t *testing.T) {
 	cmd := newRemoveCommand(test.NewFakeCli(&fakeClient{}))
 	cmd.SetArgs([]string{"nodeID1", "nodeID2"})
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 }

components/cli/cli/command/node/update_test.go

@@ -6,11 +6,10 @@ import (
 
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestNodeUpdateErrors(t *testing.T) {
@@ -66,7 +65,7 @@ func TestNodeUpdateErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -165,6 +164,6 @@ func TestNodeUpdate(t *testing.T) {
 		for key, value := range tc.flags {
 			cmd.Flags().Set(key, value)
 		}
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 	}
 }

components/cli/cli/command/plugin/create_test.go

@@ -4,17 +4,21 @@ import (
 	"fmt"
 	"io"
 	"io/ioutil"
+	"runtime"
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/fs"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestCreateErrors(t *testing.T) {
-
+	noSuchFile := "no such file or directory"
+	if runtime.GOOS == "windows" {
+		noSuchFile = "The system cannot find the file specified."
+	}
 	testCases := []struct {
 		args          []string
 		expectedError string
@@ -29,7 +33,7 @@ func TestCreateErrors(t *testing.T) {
 		},
 		{
 			args:          []string{"plugin-foo", "nonexistent_context_dir"},
-			expectedError: "no such file or directory",
+			expectedError: noSuchFile,
 		},
 	}
 
@@ -38,7 +42,7 @@ func TestCreateErrors(t *testing.T) {
 		cmd := newCreateCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -50,7 +54,7 @@ func TestCreateErrorOnFileAsContextDir(t *testing.T) {
 	cmd := newCreateCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo", tmpFile.Path()})
 	cmd.SetOutput(ioutil.Discard)
-	testutil.ErrorContains(t, cmd.Execute(), "context must be a directory")
+	assert.ErrorContains(t, cmd.Execute(), "context must be a directory")
 }
 
 func TestCreateErrorOnContextDirWithoutConfig(t *testing.T) {
@@ -61,7 +65,12 @@ func TestCreateErrorOnContextDirWithoutConfig(t *testing.T) {
 	cmd := newCreateCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo", tmpDir.Path()})
 	cmd.SetOutput(ioutil.Discard)
-	testutil.ErrorContains(t, cmd.Execute(), "config.json: no such file or directory")
+
+	expectedErr := "config.json: no such file or directory"
+	if runtime.GOOS == "windows" {
+		expectedErr = "config.json: The system cannot find the file specified."
+	}
+	assert.ErrorContains(t, cmd.Execute(), expectedErr)
 }
 
 func TestCreateErrorOnInvalidConfig(t *testing.T) {
@@ -74,7 +83,7 @@ func TestCreateErrorOnInvalidConfig(t *testing.T) {
 	cmd := newCreateCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo", tmpDir.Path()})
 	cmd.SetOutput(ioutil.Discard)
-	testutil.ErrorContains(t, cmd.Execute(), "invalid")
+	assert.ErrorContains(t, cmd.Execute(), "invalid")
 }
 
 func TestCreateErrorFromDaemon(t *testing.T) {
@@ -92,7 +101,7 @@ func TestCreateErrorFromDaemon(t *testing.T) {
 	cmd := newCreateCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo", tmpDir.Path()})
 	cmd.SetOutput(ioutil.Discard)
-	testutil.ErrorContains(t, cmd.Execute(), "Error creating plugin")
+	assert.ErrorContains(t, cmd.Execute(), "Error creating plugin")
 }
 
 func TestCreatePlugin(t *testing.T) {
@@ -109,6 +118,6 @@ func TestCreatePlugin(t *testing.T) {
 
 	cmd := newCreateCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo", tmpDir.Path()})
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "plugin-foo\n", cli.OutBuffer().String())
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("plugin-foo\n", cli.OutBuffer().String()))
 }

components/cli/cli/command/plugin/disable_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestPluginDisableErrors(t *testing.T) {
@@ -41,7 +41,7 @@ func TestPluginDisableErrors(t *testing.T) {
 			}))
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -53,6 +53,6 @@ func TestPluginDisable(t *testing.T) {
 	})
 	cmd := newDisableCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo"})
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "plugin-foo\n", cli.OutBuffer().String())
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("plugin-foo\n", cli.OutBuffer().String()))
 }

components/cli/cli/command/plugin/enable_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestPluginEnableErrors(t *testing.T) {
@@ -52,7 +52,7 @@ func TestPluginEnableErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -65,6 +65,6 @@ func TestPluginEnable(t *testing.T) {
 
 	cmd := newEnableCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo"})
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "plugin-foo\n", cli.OutBuffer().String())
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("plugin-foo\n", cli.OutBuffer().String()))
 }

components/cli/cli/command/plugin/install.go

@@ -24,11 +24,12 @@ type pluginOptions struct {
 	disable         bool
 	args            []string
 	skipRemoteCheck bool
+	untrusted       bool
 }
 
-func loadPullFlags(opts *pluginOptions, flags *pflag.FlagSet) {
+func loadPullFlags(dockerCli command.Cli, opts *pluginOptions, flags *pflag.FlagSet) {
 	flags.BoolVar(&opts.grantPerms, "grant-all-permissions", false, "Grant all permissions necessary to run the plugin")
-	command.AddTrustVerificationFlags(flags)
+	command.AddTrustVerificationFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 }
 
 func newInstallCommand(dockerCli command.Cli) *cobra.Command {
@@ -47,7 +48,7 @@ func newInstallCommand(dockerCli command.Cli) *cobra.Command {
 	}
 
 	flags := cmd.Flags()
-	loadPullFlags(&options, flags)
+	loadPullFlags(dockerCli, &options, flags)
 	flags.BoolVar(&options.disable, "disable", false, "Do not enable the plugin on install")
 	flags.StringVar(&options.localName, "alias", "", "Local name for plugin")
 	return cmd
@@ -90,7 +91,7 @@ func buildPullConfig(ctx context.Context, dockerCli command.Cli, opts pluginOpti
 	remote := ref.String()
 
 	_, isCanonical := ref.(reference.Canonical)
-	if command.IsTrusted() && !isCanonical {
+	if !opts.untrusted && !isCanonical {
 		ref = reference.TagNameOnly(ref)
 		nt, ok := ref.(reference.NamedTagged)
 		if !ok {

components/cli/cli/command/plugin/push.go

@@ -13,30 +13,37 @@ import (
 	"github.com/spf13/cobra"
 )
 
+type pushOptions struct {
+	name      string
+	untrusted bool
+}
+
 func newPushCommand(dockerCli command.Cli) *cobra.Command {
+	var opts pushOptions
 	cmd := &cobra.Command{
 		Use:   "push [OPTIONS] PLUGIN[:TAG]",
 		Short: "Push a plugin to a registry",
 		Args:  cli.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return runPush(dockerCli, args[0])
+			opts.name = args[0]
+			return runPush(dockerCli, opts)
 		},
 	}
 
 	flags := cmd.Flags()
 
-	command.AddTrustSigningFlags(flags)
+	command.AddTrustSigningFlags(flags, &opts.untrusted, dockerCli.ContentTrustEnabled())
 
 	return cmd
 }
 
-func runPush(dockerCli command.Cli, name string) error {
-	named, err := reference.ParseNormalizedNamed(name)
+func runPush(dockerCli command.Cli, opts pushOptions) error {
+	named, err := reference.ParseNormalizedNamed(opts.name)
 	if err != nil {
 		return err
 	}
 	if _, ok := named.(reference.Canonical); ok {
-		return errors.Errorf("invalid name: %s", name)
+		return errors.Errorf("invalid name: %s", opts.name)
 	}
 
 	named = reference.TagNameOnly(named)
@@ -60,7 +67,7 @@ func runPush(dockerCli command.Cli, name string) error {
 	}
 	defer responseBody.Close()
 
-	if command.IsTrusted() {
+	if !opts.untrusted {
 		repoInfo.Class = "plugin"
 		return image.PushTrustedReference(dockerCli, repoInfo, named, authConfig, responseBody)
 	}

components/cli/cli/command/plugin/remove_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
-	"github.com/stretchr/testify/assert"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 )
 
 func TestRemoveErrors(t *testing.T) {
@@ -38,7 +38,7 @@ func TestRemoveErrors(t *testing.T) {
 		cmd := newRemoveCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -50,8 +50,8 @@ func TestRemove(t *testing.T) {
 	})
 	cmd := newRemoveCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo"})
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "plugin-foo\n", cli.OutBuffer().String())
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("plugin-foo\n", cli.OutBuffer().String()))
 }
 
 func TestRemoveWithForceOption(t *testing.T) {
@@ -65,7 +65,7 @@ func TestRemoveWithForceOption(t *testing.T) {
 	cmd := newRemoveCommand(cli)
 	cmd.SetArgs([]string{"plugin-foo"})
 	cmd.Flags().Set("force", "true")
-	assert.NoError(t, cmd.Execute())
-	assert.True(t, force)
-	assert.Equal(t, "plugin-foo\n", cli.OutBuffer().String())
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, force)
+	assert.Check(t, is.Equal("plugin-foo\n", cli.OutBuffer().String()))
 }

components/cli/cli/command/plugin/upgrade.go

@@ -30,7 +30,7 @@ func newUpgradeCommand(dockerCli command.Cli) *cobra.Command {
 	}
 
 	flags := cmd.Flags()
-	loadPullFlags(&options, flags)
+	loadPullFlags(dockerCli, &options, flags)
 	flags.BoolVar(&options.skipRemoteCheck, "skip-remote-check", false, "Do not check if specified remote plugin matches existing plugin image")
 	return cmd
 }

components/cli/cli/command/registry.go

@@ -52,11 +52,15 @@ func RegistryAuthenticationPrivilegedFunc(cli Cli, index *registrytypes.IndexInf
 		fmt.Fprintf(cli.Out(), "\nPlease login prior to %s:\n", cmdName)
 		indexServer := registry.GetAuthConfigKey(index)
 		isDefaultRegistry := indexServer == ElectAuthServer(context.Background(), cli)
-		authConfig, err := ConfigureAuth(cli, "", "", indexServer, isDefaultRegistry)
+		authConfig, err := GetDefaultAuthConfig(cli, true, indexServer, isDefaultRegistry)
+		if err != nil {
+			fmt.Fprintf(cli.Err(), "Unable to retrieve stored credentials for %s, error: %s.\n", indexServer, err)
+		}
+		err = ConfigureAuth(cli, "", "", authConfig, isDefaultRegistry)
 		if err != nil {
 			return "", err
 		}
-		return EncodeAuthToBase64(authConfig)
+		return EncodeAuthToBase64(*authConfig)
 	}
 }
 
@@ -73,20 +77,29 @@ func ResolveAuthConfig(ctx context.Context, cli Cli, index *registrytypes.IndexI
 	return a
 }
 
-// ConfigureAuth returns an AuthConfig from the specified user, password and server.
-func ConfigureAuth(cli Cli, flUser, flPassword, serverAddress string, isDefaultRegistry bool) (types.AuthConfig, error) {
-	// On Windows, force the use of the regular OS stdin stream. Fixes #14336/#14210
-	if runtime.GOOS == "windows" {
-		cli.SetIn(NewInStream(os.Stdin))
-	}
-
+// GetDefaultAuthConfig gets the default auth config given a serverAddress
+// If credentials for given serverAddress exists in the credential store, the configuration will be populated with values in it
+func GetDefaultAuthConfig(cli Cli, checkCredStore bool, serverAddress string, isDefaultRegistry bool) (*types.AuthConfig, error) {
 	if !isDefaultRegistry {
 		serverAddress = registry.ConvertToHostname(serverAddress)
 	}
+	var authconfig types.AuthConfig
+	var err error
+	if checkCredStore {
+		authconfig, err = cli.ConfigFile().GetAuthConfig(serverAddress)
+	} else {
+		authconfig = types.AuthConfig{}
+	}
+	authconfig.ServerAddress = serverAddress
+	authconfig.IdentityToken = ""
+	return &authconfig, err
+}
 
-	authconfig, err := cli.ConfigFile().GetAuthConfig(serverAddress)
-	if err != nil {
-		return authconfig, err
+// ConfigureAuth handles prompting of user's username and password if needed
+func ConfigureAuth(cli Cli, flUser, flPassword string, authconfig *types.AuthConfig, isDefaultRegistry bool) error {
+	// On Windows, force the use of the regular OS stdin stream. Fixes #14336/#14210
+	if runtime.GOOS == "windows" {
+		cli.SetIn(NewInStream(os.Stdin))
 	}
 
 	// Some links documenting this:
@@ -97,7 +110,7 @@ func ConfigureAuth(cli Cli, flUser, flPassword, serverAddress string, isDefaultR
 	// will hit this if you attempt docker login from mintty where stdin
 	// is a pipe, not a character based console.
 	if flPassword == "" && !cli.In().IsTerminal() {
-		return authconfig, errors.Errorf("Error: Cannot perform an interactive login from a non TTY device")
+		return errors.Errorf("Error: Cannot perform an interactive login from a non TTY device")
 	}
 
 	authconfig.Username = strings.TrimSpace(authconfig.Username)
@@ -115,12 +128,12 @@ func ConfigureAuth(cli Cli, flUser, flPassword, serverAddress string, isDefaultR
 		}
 	}
 	if flUser == "" {
-		return authconfig, errors.Errorf("Error: Non-null Username Required")
+		return errors.Errorf("Error: Non-null Username Required")
 	}
 	if flPassword == "" {
 		oldState, err := term.SaveState(cli.In().FD())
 		if err != nil {
-			return authconfig, err
+			return err
 		}
 		fmt.Fprintf(cli.Out(), "Password: ")
 		term.DisableEcho(cli.In().FD(), oldState)
@@ -130,16 +143,14 @@ func ConfigureAuth(cli Cli, flUser, flPassword, serverAddress string, isDefaultR
 
 		term.RestoreTerminal(cli.In().FD(), oldState)
 		if flPassword == "" {
-			return authconfig, errors.Errorf("Error: Password Required")
+			return errors.Errorf("Error: Password Required")
 		}
 	}
 
 	authconfig.Username = flUser
 	authconfig.Password = flPassword
-	authconfig.ServerAddress = serverAddress
-	authconfig.IdentityToken = ""
 
-	return authconfig, nil
+	return nil
 }
 
 func readInput(in io.Reader, out io.Writer) string {

components/cli/cli/command/registry/login.go

@@ -9,11 +9,19 @@ import (
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
+	"github.com/docker/docker/api/types"
+	registrytypes "github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/client"
 	"github.com/docker/docker/registry"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
+const unencryptedWarning = `WARNING! Your password will be stored unencrypted in %s.
+Configure a credential helper to remove this warning. See
+https://docs.docker.com/engine/reference/commandline/login/#credentials-store
+`
+
 type loginOptions struct {
 	serverAddress string
 	user          string
@@ -47,10 +55,30 @@ func NewLoginCommand(dockerCli command.Cli) *cobra.Command {
 	return cmd
 }
 
-func runLogin(dockerCli command.Cli, opts loginOptions) error {
-	ctx := context.Background()
-	clnt := dockerCli.Client()
+// unencryptedPrompt prompts the user to find out whether they want to continue
+// with insecure credential storage. If stdin is not a terminal, we assume they
+// want it (sadly), because people may have been scripting insecure logins and
+// we don't want to break them. Maybe they'll see the warning in their logs and
+// fix things.
+func unencryptedPrompt(dockerCli command.Streams, filename string) error {
+	fmt.Fprintln(dockerCli.Err(), fmt.Sprintf(unencryptedWarning, filename))
 
+	if dockerCli.In().IsTerminal() {
+		if command.PromptForConfirmation(dockerCli.In(), dockerCli.Out(), "") {
+			return nil
+		}
+		return errors.Errorf("User refused unencrypted credentials storage.")
+	}
+
+	return nil
+}
+
+type isFileStore interface {
+	IsFileStore() bool
+	GetFilename() string
+}
+
+func verifyloginOptions(dockerCli command.Cli, opts *loginOptions) error {
 	if opts.password != "" {
 		fmt.Fprintln(dockerCli.Err(), "WARNING! Using --password via the CLI is insecure. Use --password-stdin.")
 		if opts.passwordStdin {
@@ -71,7 +99,15 @@ func runLogin(dockerCli command.Cli, opts loginOptions) error {
 		opts.password = strings.TrimSuffix(string(contents), "\n")
 		opts.password = strings.TrimSuffix(opts.password, "\r")
 	}
+	return nil
+}
 
+func runLogin(dockerCli command.Cli, opts loginOptions) error { //nolint: gocyclo
+	ctx := context.Background()
+	clnt := dockerCli.Client()
+	if err := verifyloginOptions(dockerCli, &opts); err != nil {
+		return err
+	}
 	var (
 		serverAddress string
 		authServer    = command.ElectAuthServer(ctx, dockerCli)
@@ -82,21 +118,41 @@ func runLogin(dockerCli command.Cli, opts loginOptions) error {
 		serverAddress = authServer
 	}
 
+	var err error
+	var authConfig *types.AuthConfig
+	var response registrytypes.AuthenticateOKBody
 	isDefaultRegistry := serverAddress == authServer
-
-	authConfig, err := command.ConfigureAuth(dockerCli, opts.user, opts.password, serverAddress, isDefaultRegistry)
-	if err != nil {
-		return err
+	authConfig, err = command.GetDefaultAuthConfig(dockerCli, opts.user == "" && opts.password == "", serverAddress, isDefaultRegistry)
+	if err == nil && authConfig.Username != "" && authConfig.Password != "" {
+		response, err = loginWithCredStoreCreds(ctx, dockerCli, authConfig)
 	}
-	response, err := clnt.RegistryLogin(ctx, authConfig)
-	if err != nil {
-		return err
+	if err != nil || authConfig.Username == "" || authConfig.Password == "" {
+		err = command.ConfigureAuth(dockerCli, opts.user, opts.password, authConfig, isDefaultRegistry)
+		if err != nil {
+			return err
+		}
+
+		response, err = clnt.RegistryLogin(ctx, *authConfig)
+		if err != nil {
+			return err
+		}
 	}
 	if response.IdentityToken != "" {
 		authConfig.Password = ""
 		authConfig.IdentityToken = response.IdentityToken
 	}
-	if err := dockerCli.ConfigFile().GetCredentialsStore(serverAddress).Store(authConfig); err != nil {
+
+	creds := dockerCli.ConfigFile().GetCredentialsStore(serverAddress)
+
+	store, isDefault := creds.(isFileStore)
+	if isDefault {
+		err = unencryptedPrompt(dockerCli, store.GetFilename())
+		if err != nil {
+			return err
+		}
+	}
+
+	if err := creds.Store(*authConfig); err != nil {
 		return errors.Errorf("Error saving credentials: %v", err)
 	}
 
@@ -105,3 +161,17 @@ func runLogin(dockerCli command.Cli, opts loginOptions) error {
 	}
 	return nil
 }
+
+func loginWithCredStoreCreds(ctx context.Context, dockerCli command.Cli, authConfig *types.AuthConfig) (registrytypes.AuthenticateOKBody, error) {
+	fmt.Fprintf(dockerCli.Out(), "Authenticating with existing credentials...\n")
+	cliClient := dockerCli.Client()
+	response, err := cliClient.RegistryLogin(ctx, *authConfig)
+	if err != nil {
+		if client.IsErrUnauthorized(err) {
+			fmt.Fprintf(dockerCli.Err(), "Stored credentials invalid or expired\n")
+		} else {
+			fmt.Fprintf(dockerCli.Err(), "Login did not succeed, error: %s\n", err)
+		}
+	}
+	return response, err
+}

components/cli/cli/command/registry/login_test.go

@@ -0,0 +1,157 @@
+package registry
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+
+	"github.com/docker/cli/internal/test"
+	"github.com/docker/docker/api/types"
+	registrytypes "github.com/docker/docker/api/types/registry"
+	"github.com/docker/docker/client"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
+	"github.com/gotestyourself/gotestyourself/fs"
+	"golang.org/x/net/context"
+)
+
+const userErr = "userunknownError"
+const testAuthErrMsg = "UNKNOWN_ERR"
+
+var testAuthErrors = map[string]error{
+	userErr: fmt.Errorf(testAuthErrMsg),
+}
+
+var expiredPassword = "I_M_EXPIRED"
+
+type fakeClient struct {
+	client.Client
+}
+
+// nolint: unparam
+func (c fakeClient) RegistryLogin(ctx context.Context, auth types.AuthConfig) (registrytypes.AuthenticateOKBody, error) {
+	if auth.Password == expiredPassword {
+		return registrytypes.AuthenticateOKBody{}, fmt.Errorf("Invalid Username or Password")
+	}
+	err := testAuthErrors[auth.Username]
+	return registrytypes.AuthenticateOKBody{}, err
+}
+
+func TestLoginWithCredStoreCreds(t *testing.T) {
+	testCases := []struct {
+		inputAuthConfig types.AuthConfig
+		expectedMsg     string
+		expectedErr     string
+	}{
+		{
+			inputAuthConfig: types.AuthConfig{},
+			expectedMsg:     "Authenticating with existing credentials...\n",
+		},
+		{
+			inputAuthConfig: types.AuthConfig{
+				Username: userErr,
+			},
+			expectedMsg: "Authenticating with existing credentials...\n",
+			expectedErr: fmt.Sprintf("Login did not succeed, error: %s\n", testAuthErrMsg),
+		},
+		// can't easily test the 401 case because client.IsErrUnauthorized(err) involving
+		// creating an error of a private type
+	}
+	ctx := context.Background()
+	for _, tc := range testCases {
+		cli := (*test.FakeCli)(test.NewFakeCli(&fakeClient{}))
+		errBuf := new(bytes.Buffer)
+		cli.SetErr(errBuf)
+		loginWithCredStoreCreds(ctx, cli, &tc.inputAuthConfig)
+		outputString := cli.OutBuffer().String()
+		assert.Check(t, is.Equal(tc.expectedMsg, outputString))
+		errorString := errBuf.String()
+		assert.Check(t, is.Equal(tc.expectedErr, errorString))
+	}
+}
+
+func TestRunLogin(t *testing.T) {
+	const storedServerAddress = "reg1"
+	const validUsername = "u1"
+	const validPassword = "p1"
+	const validPassword2 = "p2"
+
+	validAuthConfig := types.AuthConfig{
+		ServerAddress: storedServerAddress,
+		Username:      validUsername,
+		Password:      validPassword,
+	}
+	expiredAuthConfig := types.AuthConfig{
+		ServerAddress: storedServerAddress,
+		Username:      validUsername,
+		Password:      expiredPassword,
+	}
+	testCases := []struct {
+		inputLoginOption  loginOptions
+		inputStoredCred   *types.AuthConfig
+		expectedErr       string
+		expectedSavedCred types.AuthConfig
+	}{
+		{
+			inputLoginOption: loginOptions{
+				serverAddress: storedServerAddress,
+			},
+			inputStoredCred:   &validAuthConfig,
+			expectedErr:       "",
+			expectedSavedCred: validAuthConfig,
+		},
+		{
+			inputLoginOption: loginOptions{
+				serverAddress: storedServerAddress,
+			},
+			inputStoredCred: &expiredAuthConfig,
+			expectedErr:     "Error: Cannot perform an interactive login from a non TTY device",
+		},
+		{
+			inputLoginOption: loginOptions{
+				serverAddress: storedServerAddress,
+				user:          validUsername,
+				password:      validPassword2,
+			},
+			inputStoredCred: &validAuthConfig,
+			expectedErr:     "",
+			expectedSavedCred: types.AuthConfig{
+				ServerAddress: storedServerAddress,
+				Username:      validUsername,
+				Password:      validPassword2,
+			},
+		},
+		{
+			inputLoginOption: loginOptions{
+				serverAddress: storedServerAddress,
+				user:          userErr,
+				password:      validPassword,
+			},
+			inputStoredCred: &validAuthConfig,
+			expectedErr:     testAuthErrMsg,
+		},
+	}
+	for i, tc := range testCases {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			tmpFile := fs.NewFile(t, "test-run-login")
+			defer tmpFile.Remove()
+			cli := test.NewFakeCli(&fakeClient{})
+			configfile := cli.ConfigFile()
+			configfile.Filename = tmpFile.Path()
+
+			if tc.inputStoredCred != nil {
+				cred := *tc.inputStoredCred
+				configfile.GetCredentialsStore(cred.ServerAddress).Store(cred)
+			}
+			loginErr := runLogin(cli, tc.inputLoginOption)
+			if tc.expectedErr != "" {
+				assert.Error(t, loginErr, tc.expectedErr)
+				return
+			}
+			assert.NilError(t, loginErr)
+			savedCred, credStoreErr := configfile.GetCredentialsStore(tc.inputStoredCred.ServerAddress).Get(tc.inputStoredCred.ServerAddress)
+			assert.Check(t, credStoreErr)
+			assert.DeepEqual(t, tc.expectedSavedCred, savedCred)
+		})
+	}
+}

components/cli/cli/command/registry_test.go

@@ -1,13 +1,17 @@
 package command_test
 
 import (
+	"bytes"
+	"fmt"
 	"testing"
 
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 	"golang.org/x/net/context"
 
 	// Prevents a circular import with "github.com/docker/cli/internal/test"
+
 	. "github.com/docker/cli/cli/command"
 	"github.com/docker/cli/internal/test"
 	"github.com/docker/docker/api/types"
@@ -19,6 +23,19 @@ type fakeClient struct {
 	infoFunc func() (types.Info, error)
 }
 
+var testAuthConfigs = []types.AuthConfig{
+	{
+		ServerAddress: "https://index.docker.io/v1/",
+		Username:      "u0",
+		Password:      "p0",
+	},
+	{
+		ServerAddress: "server1.io",
+		Username:      "u1",
+		Password:      "p1",
+	},
+}
+
 func (cli *fakeClient) Info(_ context.Context) (types.Info, error) {
 	if cli.infoFunc != nil {
 		return cli.infoFunc()
@@ -64,12 +81,67 @@ func TestElectAuthServer(t *testing.T) {
 	for _, tc := range testCases {
 		cli := test.NewFakeCli(&fakeClient{infoFunc: tc.infoFunc})
 		server := ElectAuthServer(context.Background(), cli)
-		assert.Equal(t, tc.expectedAuthServer, server)
+		assert.Check(t, is.Equal(tc.expectedAuthServer, server))
 		actual := cli.ErrBuffer().String()
 		if tc.expectedWarning == "" {
-			assert.Empty(t, actual)
+			assert.Check(t, is.Len(actual, 0))
 		} else {
-			assert.Contains(t, actual, tc.expectedWarning)
+			assert.Check(t, is.Contains(actual, tc.expectedWarning))
+		}
+	}
+}
+
+func TestGetDefaultAuthConfig(t *testing.T) {
+	testCases := []struct {
+		checkCredStore     bool
+		inputServerAddress string
+		expectedErr        string
+		expectedAuthConfig types.AuthConfig
+	}{
+		{
+			checkCredStore:     false,
+			inputServerAddress: "",
+			expectedErr:        "",
+			expectedAuthConfig: types.AuthConfig{
+				ServerAddress: "",
+				Username:      "",
+				Password:      "",
+			},
+		},
+		{
+			checkCredStore:     true,
+			inputServerAddress: testAuthConfigs[0].ServerAddress,
+			expectedErr:        "",
+			expectedAuthConfig: testAuthConfigs[0],
+		},
+		{
+			checkCredStore:     true,
+			inputServerAddress: testAuthConfigs[1].ServerAddress,
+			expectedErr:        "",
+			expectedAuthConfig: testAuthConfigs[1],
+		},
+		{
+			checkCredStore:     true,
+			inputServerAddress: fmt.Sprintf("https://%s", testAuthConfigs[1].ServerAddress),
+			expectedErr:        "",
+			expectedAuthConfig: testAuthConfigs[1],
+		},
+	}
+	cli := test.NewFakeCli(&fakeClient{})
+	errBuf := new(bytes.Buffer)
+	cli.SetErr(errBuf)
+	for _, authconfig := range testAuthConfigs {
+		cli.ConfigFile().GetCredentialsStore(authconfig.ServerAddress).Store(authconfig)
+	}
+	for _, tc := range testCases {
+		serverAddress := tc.inputServerAddress
+		authconfig, err := GetDefaultAuthConfig(cli, tc.checkCredStore, serverAddress, serverAddress == "https://index.docker.io/v1/")
+		if tc.expectedErr != "" {
+			assert.Check(t, err != nil)
+			assert.Check(t, is.Equal(tc.expectedErr, err.Error()))
+		} else {
+			assert.NilError(t, err)
+			assert.Check(t, is.DeepEqual(tc.expectedAuthConfig, *authconfig))
 		}
 	}
 }

components/cli/cli/command/secret/create_test.go

@@ -8,11 +8,11 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/swarm"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 const secretDataFile = "secret-create-with-name.golden"
@@ -45,14 +45,14 @@ func TestSecretCreateErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
 func TestSecretCreateWithName(t *testing.T) {
 	name := "foo"
 	data, err := ioutil.ReadFile(filepath.Join("testdata", secretDataFile))
-	assert.NoError(t, err)
+	assert.NilError(t, err)
 
 	expected := swarm.SecretSpec{
 		Annotations: swarm.Annotations{
@@ -75,8 +75,8 @@ func TestSecretCreateWithName(t *testing.T) {
 
 	cmd := newSecretCreateCommand(cli)
 	cmd.SetArgs([]string{name, filepath.Join("testdata", secretDataFile)})
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }
 
 func TestSecretCreateWithDriver(t *testing.T) {
@@ -104,8 +104,8 @@ func TestSecretCreateWithDriver(t *testing.T) {
 	cmd := newSecretCreateCommand(cli)
 	cmd.SetArgs([]string{name})
 	cmd.Flags().Set("driver", expectedDriver.Name)
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }
 
 func TestSecretCreateWithTemplatingDriver(t *testing.T) {
@@ -133,8 +133,8 @@ func TestSecretCreateWithTemplatingDriver(t *testing.T) {
 	cmd := newSecretCreateCommand(cli)
 	cmd.SetArgs([]string{name})
 	cmd.Flags().Set("template-driver", expectedDriver.Name)
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }
 
 func TestSecretCreateWithLabels(t *testing.T) {
@@ -164,6 +164,6 @@ func TestSecretCreateWithLabels(t *testing.T) {
 	cmd.SetArgs([]string{name, filepath.Join("testdata", secretDataFile)})
 	cmd.Flags().Set("label", "lbl1=Label-foo")
 	cmd.Flags().Set("label", "lbl2=Label-bar")
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, "ID-"+name, strings.TrimSpace(cli.OutBuffer().String()))
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.Equal("ID-"+name, strings.TrimSpace(cli.OutBuffer().String())))
 }

components/cli/cli/command/secret/inspect_test.go

@@ -11,9 +11,8 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestSecretInspectErrors(t *testing.T) {
@@ -62,7 +61,7 @@ func TestSecretInspectErrors(t *testing.T) {
 			cmd.Flags().Set(key, value)
 		}
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -98,7 +97,7 @@ func TestSecretInspectWithoutFormat(t *testing.T) {
 		})
 		cmd := newSecretInspectCommand(cli)
 		cmd.SetArgs(tc.args)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("secret-inspect-without-format.%s.golden", tc.name))
 	}
 }
@@ -135,7 +134,7 @@ func TestSecretInspectWithFormat(t *testing.T) {
 		cmd := newSecretInspectCommand(cli)
 		cmd.SetArgs(tc.args)
 		cmd.Flags().Set("format", tc.format)
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("secret-inspect-with-format.%s.golden", tc.name))
 	}
 }
@@ -168,7 +167,7 @@ func TestSecretInspectPretty(t *testing.T) {
 		cmd := newSecretInspectCommand(cli)
 		cmd.SetArgs([]string{"secretID"})
 		cmd.Flags().Set("pretty", "true")
-		assert.NoError(t, cmd.Execute())
+		assert.NilError(t, cmd.Execute())
 		golden.Assert(t, cli.OutBuffer().String(), fmt.Sprintf("secret-inspect-pretty.%s.golden", tc.name))
 	}
 }

components/cli/cli/command/secret/ls_test.go

@@ -12,9 +12,9 @@ import (
 	"github.com/pkg/errors"
 	// Import builders to get the builder function as package function
 	. "github.com/docker/cli/internal/test/builders"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/gotestyourself/gotestyourself/golden"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestSecretListErrors(t *testing.T) {
@@ -42,7 +42,7 @@ func TestSecretListErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -74,7 +74,7 @@ func TestSecretList(t *testing.T) {
 		},
 	})
 	cmd := newSecretListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "secret-list-sort.golden")
 }
 
@@ -91,7 +91,7 @@ func TestSecretListWithQuietOption(t *testing.T) {
 	})
 	cmd := newSecretListCommand(cli)
 	cmd.Flags().Set("quiet", "true")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "secret-list-with-quiet-option.golden")
 }
 
@@ -110,7 +110,7 @@ func TestSecretListWithConfigFormat(t *testing.T) {
 		SecretFormat: "{{ .Name }} {{ .Labels }}",
 	})
 	cmd := newSecretListCommand(cli)
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "secret-list-with-config-format.golden")
 }
 
@@ -127,15 +127,15 @@ func TestSecretListWithFormat(t *testing.T) {
 	})
 	cmd := newSecretListCommand(cli)
 	cmd.Flags().Set("format", "{{ .Name }} {{ .Labels }}")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "secret-list-with-format.golden")
 }
 
 func TestSecretListWithFilter(t *testing.T) {
 	cli := test.NewFakeCli(&fakeClient{
 		secretListFunc: func(options types.SecretListOptions) ([]swarm.Secret, error) {
-			assert.Equal(t, "foo", options.Filters.Get("name")[0], "foo")
-			assert.Equal(t, "lbl1=Label-bar", options.Filters.Get("label")[0])
+			assert.Check(t, is.Equal("foo", options.Filters.Get("name")[0]), "foo")
+			assert.Check(t, is.Equal("lbl1=Label-bar", options.Filters.Get("label")[0]))
 			return []swarm.Secret{
 				*Secret(SecretID("ID-foo"),
 					SecretName("foo"),
@@ -155,6 +155,6 @@ func TestSecretListWithFilter(t *testing.T) {
 	cmd := newSecretListCommand(cli)
 	cmd.Flags().Set("filter", "name=foo")
 	cmd.Flags().Set("filter", "label=lbl1=Label-bar")
-	assert.NoError(t, cmd.Execute())
+	assert.NilError(t, cmd.Execute())
 	golden.Assert(t, cli.OutBuffer().String(), "secret-list-with-filter.golden")
 }

components/cli/cli/command/secret/remove_test.go

@@ -6,9 +6,9 @@ import (
 	"testing"
 
 	"github.com/docker/cli/internal/test"
-	"github.com/docker/cli/internal/test/testutil"
+	"github.com/gotestyourself/gotestyourself/assert"
+	is "github.com/gotestyourself/gotestyourself/assert/cmp"
 	"github.com/pkg/errors"
-	"github.com/stretchr/testify/assert"
 )
 
 func TestSecretRemoveErrors(t *testing.T) {
@@ -37,7 +37,7 @@ func TestSecretRemoveErrors(t *testing.T) {
 		)
 		cmd.SetArgs(tc.args)
 		cmd.SetOutput(ioutil.Discard)
-		testutil.ErrorContains(t, cmd.Execute(), tc.expectedError)
+		assert.ErrorContains(t, cmd.Execute(), tc.expectedError)
 	}
 }
 
@@ -52,9 +52,9 @@ func TestSecretRemoveWithName(t *testing.T) {
 	})
 	cmd := newSecretRemoveCommand(cli)
 	cmd.SetArgs(names)
-	assert.NoError(t, cmd.Execute())
-	assert.Equal(t, names, strings.Split(strings.TrimSpace(cli.OutBuffer().String()), "\n"))
-	assert.Equal(t, names, removedSecrets)
+	assert.NilError(t, cmd.Execute())
+	assert.Check(t, is.DeepEqual(names, strings.Split(strings.TrimSpace(cli.OutBuffer().String()), "\n")))
+	assert.Check(t, is.DeepEqual(names, removedSecrets))
 }
 
 func TestSecretRemoveContinueAfterError(t *testing.T) {
@@ -74,6 +74,6 @@ func TestSecretRemoveContinueAfterError(t *testing.T) {
 	cmd := newSecretRemoveCommand(cli)
 	cmd.SetOutput(ioutil.Discard)
 	cmd.SetArgs(names)
-	assert.EqualError(t, cmd.Execute(), "error removing secret: foo")
-	assert.Equal(t, names, removedSecrets)
+	assert.Error(t, cmd.Execute(), "error removing secret: foo")
+	assert.Check(t, is.DeepEqual(names, removedSecrets))
 }