Merge pull request #6252 from thaJeztah/less_pkg_errors

reduce uses of pkg/errors

cli/cobra.go

@@ -12,7 +12,6 @@ import (
 	"github.com/fvbommel/sortorder"
 	"github.com/moby/term"
 	"github.com/morikuni/aec"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -204,7 +203,7 @@ var helpCommand = &cobra.Command{
 	RunE: func(c *cobra.Command, args []string) error {
 		cmd, args, e := c.Root().Find(args)
 		if cmd == nil || e != nil || len(args) > 0 {
-			return errors.Errorf("unknown help topic: %v", strings.Join(args, " "))
+			return fmt.Errorf("unknown help topic: %v", strings.Join(args, " "))
 		}
 		helpFunc := cmd.HelpFunc()
 		helpFunc(cmd, args)

cli/command/cli.go

@@ -5,6 +5,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -26,7 +27,6 @@ import (
 	"github.com/moby/moby/api/types/build"
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -168,7 +168,7 @@ func (cli *DockerCli) BuildKitEnabled() (bool, error) {
 	if v := os.Getenv("DOCKER_BUILDKIT"); v != "" {
 		enabled, err := strconv.ParseBool(v)
 		if err != nil {
-			return false, errors.Wrap(err, "DOCKER_BUILDKIT environment variable expects boolean value")
+			return false, fmt.Errorf("DOCKER_BUILDKIT environment variable expects boolean value: %w", err)
 		}
 		return enabled, nil
 	}
@@ -299,7 +299,7 @@ func NewAPIClientFromFlags(opts *cliflags.ClientOptions, configFile *configfile.
 	}
 	endpoint, err := resolveDockerEndpoint(contextStore, resolveContextName(opts, configFile))
 	if err != nil {
-		return nil, errors.Wrap(err, "unable to resolve docker endpoint")
+		return nil, fmt.Errorf("unable to resolve docker endpoint: %w", err)
 	}
 	return newAPIClientFromEndpoint(endpoint, configFile)
 }
@@ -478,7 +478,7 @@ func (cli *DockerCli) initialize() error {
 	cli.init.Do(func() {
 		cli.dockerEndpoint, cli.initErr = cli.getDockerEndPoint()
 		if cli.initErr != nil {
-			cli.initErr = errors.Wrap(cli.initErr, "unable to resolve docker endpoint")
+			cli.initErr = fmt.Errorf("unable to resolve docker endpoint: %w", cli.initErr)
 			return
 		}
 		if cli.client == nil {
@@ -546,7 +546,7 @@ func getServerHost(hosts []string, defaultToTLS bool) (string, error) {
 	case 1:
 		return dopts.ParseHost(defaultToTLS, hosts[0])
 	default:
-		return "", errors.New("Specify only one -H")
+		return "", errors.New("specify only one -H")
 	}
 }
 

cli/command/cli_options.go

@@ -3,6 +3,7 @@ package command
 import (
 	"context"
 	"encoding/csv"
+	"fmt"
 	"io"
 	"net/http"
 	"os"
@@ -12,7 +13,6 @@ import (
 	"github.com/docker/cli/cli/streams"
 	"github.com/moby/moby/client"
 	"github.com/moby/term"
-	"github.com/pkg/errors"
 )
 
 // CLIOption is a functional argument to apply options to a [DockerCli]. These
@@ -189,7 +189,7 @@ func withCustomHeadersFromEnv() client.Opt {
 		csvReader := csv.NewReader(strings.NewReader(value))
 		fields, err := csvReader.Read()
 		if err != nil {
-			return invalidParameter(errors.Errorf(
+			return invalidParameter(fmt.Errorf(
 				"failed to parse custom headers from %s environment variable: value must be formatted as comma-separated key=value pairs",
 				envOverrideHTTPHeaders,
 			))
@@ -206,7 +206,7 @@ func withCustomHeadersFromEnv() client.Opt {
 			k = strings.TrimSpace(k)
 
 			if k == "" {
-				return invalidParameter(errors.Errorf(
+				return invalidParameter(fmt.Errorf(
 					`failed to set custom headers from %s environment variable: value contains a key=value pair with an empty key: '%s'`,
 					envOverrideHTTPHeaders, kv,
 				))
@@ -217,7 +217,7 @@ func withCustomHeadersFromEnv() client.Opt {
 			// from an environment variable with the same name). In the meantime,
 			// produce an error to prevent users from depending on this.
 			if !hasValue {
-				return invalidParameter(errors.Errorf(
+				return invalidParameter(fmt.Errorf(
 					`failed to set custom headers from %s environment variable: missing "=" in key=value pair: '%s'`,
 					envOverrideHTTPHeaders, kv,
 				))

cli/command/config/create.go

@@ -2,6 +2,7 @@ package config
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/cli/opts"
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/sys/sequential"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -53,7 +53,7 @@ func RunConfigCreate(ctx context.Context, dockerCLI command.Cli, options CreateO
 
 	configData, err := readConfigData(dockerCLI.In(), options.File)
 	if err != nil {
-		return errors.Errorf("Error reading content from %q: %v", options.File, err)
+		return fmt.Errorf("error reading content from %q: %v", options.File, err)
 	}
 
 	spec := swarm.ConfigSpec{

cli/command/container/attach.go

@@ -2,6 +2,7 @@ package container
 
 import (
 	"context"
+	"errors"
 	"io"
 
 	"github.com/docker/cli/cli"
@@ -10,7 +11,6 @@ import (
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/client"
 	"github.com/moby/sys/signal"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -28,13 +28,13 @@ func inspectContainerAndCheckState(ctx context.Context, apiClient client.APIClie
 		return nil, err
 	}
 	if !c.State.Running {
-		return nil, errors.New("You cannot attach to a stopped container, start it first")
+		return nil, errors.New("cannot attach to a stopped container, start it first")
 	}
 	if c.State.Paused {
-		return nil, errors.New("You cannot attach to a paused container, unpause it first")
+		return nil, errors.New("cannot attach to a paused container, unpause it first")
 	}
 	if c.State.Restarting {
-		return nil, errors.New("You cannot attach to a restarting container, wait until it is running")
+		return nil, errors.New("cannot attach to a restarting container, wait until it is running")
 	}
 
 	return &c, nil

cli/command/container/attach_test.go

@@ -29,7 +29,7 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		{
 			name:          "client-stopped",
 			args:          []string{"5cb5bb5e4a3b"},
-			expectedError: "You cannot attach to a stopped container",
+			expectedError: "cannot attach to a stopped container",
 			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
 				return container.InspectResponse{
 					ContainerJSONBase: &container.ContainerJSONBase{
@@ -43,7 +43,7 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		{
 			name:          "client-paused",
 			args:          []string{"5cb5bb5e4a3b"},
-			expectedError: "You cannot attach to a paused container",
+			expectedError: "cannot attach to a paused container",
 			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
 				return container.InspectResponse{
 					ContainerJSONBase: &container.ContainerJSONBase{
@@ -58,7 +58,7 @@ func TestNewAttachCommandErrors(t *testing.T) {
 		{
 			name:          "client-restarting",
 			args:          []string{"5cb5bb5e4a3b"},
-			expectedError: "You cannot attach to a restarting container",
+			expectedError: "cannot attach to a restarting container",
 			containerInspectFunc: func(containerID string) (container.InspectResponse, error) {
 				return container.InspectResponse{
 					ContainerJSONBase: &container.ContainerJSONBase{

cli/command/container/cp.go

@@ -3,6 +3,7 @@ package container
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -19,7 +20,6 @@ import (
 	"github.com/moby/go-archive"
 	"github.com/moby/moby/api/types/container"
 	"github.com/morikuni/aec"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -331,7 +331,7 @@ func copyToContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cpCo
 
 	// Validate the destination path
 	if err := command.ValidateOutputPathFileMode(dstStat.Mode); err != nil {
-		return errors.Wrapf(err, `destination "%s:%s" must be a directory or a regular file`, copyConfig.container, dstPath)
+		return fmt.Errorf(`destination "%s:%s" must be a directory or a regular file: %w`, copyConfig.container, dstPath, err)
 	}
 
 	// Ignore any error and assume that the parent directory of the destination
@@ -354,7 +354,7 @@ func copyToContainer(ctx context.Context, dockerCLI command.Cli, copyConfig cpCo
 		content = os.Stdin
 		resolvedDstPath = dstInfo.Path
 		if !dstInfo.IsDir {
-			return errors.Errorf("destination \"%s:%s\" must be a directory", copyConfig.container, dstPath)
+			return fmt.Errorf(`destination "%s:%s" must be a directory`, copyConfig.container, dstPath)
 		}
 	} else {
 		// Prepare source copy info.

cli/command/container/create.go

@@ -4,6 +4,7 @@ import (
 	"archive/tar"
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net/netip"
@@ -30,7 +31,6 @@ import (
 	"github.com/moby/moby/api/types/versions"
 	"github.com/moby/moby/client"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -80,7 +80,7 @@ func NewCreateCommand(dockerCli command.Cli) *cobra.Command {
 	flags.StringVar(&options.pull, "pull", PullImageMissing, `Pull image before creating ("`+PullImageAlways+`", "|`+PullImageMissing+`", "`+PullImageNever+`")`)
 	flags.BoolVarP(&options.quiet, "quiet", "q", false, "Suppress the pull output")
 	flags.BoolVarP(&options.useAPISocket, "use-api-socket", "", false, "Bind mount Docker API socket and required auth")
-	flags.SetAnnotation("use-api-socket", "experimentalCLI", nil) // Marks flag as experimental for now.
+	_ = flags.SetAnnotation("use-api-socket", "experimentalCLI", nil) // Mark flag as experimental for now.
 
 	// Add an explicit help that doesn't have a `-h` to prevent the conflict
 	// with hostname
@@ -113,7 +113,7 @@ func runCreate(ctx context.Context, dockerCli command.Cli, flags *pflag.FlagSet,
 		}
 	}
 	proxyConfig := dockerCli.ConfigFile().ParseProxyConfig(dockerCli.Client().DaemonHost(), opts.ConvertKVStringsToMapWithNil(copts.env.GetSlice()))
-	newEnv := []string{}
+	newEnv := make([]string, 0, len(proxyConfig))
 	for k, v := range proxyConfig {
 		if v == nil {
 			newEnv = append(newEnv, k)
@@ -151,7 +151,9 @@ func pullImage(ctx context.Context, dockerCli command.Cli, img string, options *
 	if err != nil {
 		return err
 	}
-	defer responseBody.Close()
+	defer func() {
+		_ = responseBody.Close()
+	}()
 
 	out := dockerCli.Err()
 	if options.quiet {
@@ -170,13 +172,13 @@ func (cid *cidFile) Close() error {
 	if cid.file == nil {
 		return nil
 	}
-	cid.file.Close()
+	_ = cid.file.Close()
 
 	if cid.written {
 		return nil
 	}
 	if err := os.Remove(cid.path); err != nil {
-		return errors.Wrapf(err, "failed to remove the CID file '%s'", cid.path)
+		return fmt.Errorf("failed to remove the CID file '%s': %w", cid.path, err)
 	}
 
 	return nil
@@ -187,7 +189,7 @@ func (cid *cidFile) Write(id string) error {
 		return nil
 	}
 	if _, err := cid.file.Write([]byte(id)); err != nil {
-		return errors.Wrap(err, "failed to write the container ID to the file")
+		return fmt.Errorf("failed to write the container ID to the file: %w", err)
 	}
 	cid.written = true
 	return nil
@@ -198,12 +200,12 @@ func newCIDFile(cidPath string) (*cidFile, error) {
 		return &cidFile{}, nil
 	}
 	if _, err := os.Stat(cidPath); err == nil {
-		return nil, errors.Errorf("container ID file found, make sure the other container isn't running or delete %s", cidPath)
+		return nil, errors.New("container ID file found, make sure the other container isn't running or delete " + cidPath)
 	}
 
 	f, err := os.Create(cidPath)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create the container ID file")
+		return nil, fmt.Errorf("failed to create the container ID file: %w", err)
 	}
 
 	return &cidFile{path: cidPath, file: f}, nil
@@ -224,7 +226,9 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 	if err != nil {
 		return "", err
 	}
-	defer containerIDFile.Close()
+	defer func() {
+		_ = containerIDFile.Close()
+	}()
 
 	ref, err := reference.ParseAnyReference(config.Image)
 	if err != nil {
@@ -318,7 +322,7 @@ func createContainer(ctx context.Context, dockerCli command.Cli, containerCfg *c
 	if options.platform != "" && versions.GreaterThanOrEqualTo(dockerCli.Client().ClientVersion(), "1.41") {
 		p, err := platforms.Parse(options.platform)
 		if err != nil {
-			return "", errors.Wrap(invalidParameter(err), "error parsing specified platform")
+			return "", invalidParameter(fmt.Errorf("error parsing specified platform: %w", err))
 		}
 		platform = &p
 	}
@@ -431,7 +435,7 @@ func copyDockerConfigIntoContainer(ctx context.Context, dockerAPI client.APIClie
 	// We don't need to get super fancy with the tar creation.
 	var tarBuf bytes.Buffer
 	tarWriter := tar.NewWriter(&tarBuf)
-	tarWriter.WriteHeader(&tar.Header{
+	_ = tarWriter.WriteHeader(&tar.Header{
 		Name: configPath,
 		Size: int64(configBuf.Len()),
 		Mode: 0o600,

cli/command/defaultcontextstore.go

@@ -4,10 +4,12 @@
 package command
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/docker/cli/cli/context/docker"
 	"github.com/docker/cli/cli/context/store"
 	cliflags "github.com/docker/cli/cli/flags"
-	"github.com/pkg/errors"
 )
 
 const (
@@ -185,7 +187,7 @@ func (s *ContextStoreWithDefault) GetTLSData(contextName, endpointName, fileName
 			return nil, err
 		}
 		if defaultContext.TLS.Endpoints[endpointName].Files[fileName] == nil {
-			return nil, notFound(errors.Errorf("TLS data for %s/%s/%s does not exist", DefaultContextName, endpointName, fileName))
+			return nil, notFound(fmt.Errorf("TLS data for %s/%s/%s does not exist", DefaultContextName, endpointName, fileName))
 		}
 		return defaultContext.TLS.Endpoints[endpointName].Files[fileName], nil
 	}

cli/command/formatter/formatter.go

@@ -5,13 +5,13 @@ package formatter
 
 import (
 	"bytes"
+	"fmt"
 	"io"
 	"strings"
 	"text/template"
 
 	"github.com/docker/cli/cli/command/formatter/tabwriter"
 	"github.com/docker/cli/templates"
-	"github.com/pkg/errors"
 )
 
 // Format keys used to specify certain kinds of output formats
@@ -76,7 +76,7 @@ func (c *Context) preFormat() {
 func (c *Context) parseFormat() (*template.Template, error) {
 	tmpl, err := templates.Parse(c.finalFormat)
 	if err != nil {
-		return nil, errors.Wrap(err, "template parsing error")
+		return nil, fmt.Errorf("template parsing error: %w", err)
 	}
 	return tmpl, nil
 }
@@ -100,7 +100,7 @@ func (c *Context) postFormat(tmpl *template.Template, subContext SubContext) {
 
 func (c *Context) contextFormat(tmpl *template.Template, subContext SubContext) error {
 	if err := tmpl.Execute(c.buffer, subContext); err != nil {
-		return errors.Wrap(err, "template parsing error")
+		return fmt.Errorf("template parsing error: %w", err)
 	}
 	if c.Format.IsTable() && c.header != nil {
 		c.header = subContext.FullHeader()

cli/command/formatter/reflect.go

@@ -5,10 +5,10 @@ package formatter
 
 import (
 	"encoding/json"
+	"errors"
+	"fmt"
 	"reflect"
 	"unicode"
-
-	"github.com/pkg/errors"
 )
 
 // MarshalJSON marshals x into json
@@ -25,14 +25,14 @@ func MarshalJSON(x any) ([]byte, error) {
 func marshalMap(x any) (map[string]any, error) {
 	val := reflect.ValueOf(x)
 	if val.Kind() != reflect.Ptr {
-		return nil, errors.Errorf("expected a pointer to a struct, got %v", val.Kind())
+		return nil, fmt.Errorf("expected a pointer to a struct, got %v", val.Kind())
 	}
 	if val.IsNil() {
-		return nil, errors.Errorf("expected a pointer to a struct, got nil pointer")
+		return nil, errors.New("expected a pointer to a struct, got nil pointer")
 	}
 	valElem := val.Elem()
 	if valElem.Kind() != reflect.Struct {
-		return nil, errors.Errorf("expected a pointer to a struct, got a pointer to %v", valElem.Kind())
+		return nil, fmt.Errorf("expected a pointer to a struct, got a pointer to %v", valElem.Kind())
 	}
 	typ := val.Type()
 	m := make(map[string]any)
@@ -54,7 +54,7 @@ var unmarshallableNames = map[string]struct{}{"FullHeader": {}}
 // It returns ("", nil, nil) for valid but non-marshallable parameter. (e.g. "unexportedFunc()")
 func marshalForMethod(typ reflect.Method, val reflect.Value) (string, any, error) {
 	if val.Kind() != reflect.Func {
-		return "", nil, errors.Errorf("expected func, got %v", val.Kind())
+		return "", nil, fmt.Errorf("expected func, got %v", val.Kind())
 	}
 	name, numIn, numOut := typ.Name, val.Type().NumIn(), val.Type().NumOut()
 	_, blackListed := unmarshallableNames[name]

cli/command/idresolver/idresolver.go

@@ -5,10 +5,10 @@ package idresolver
 
 import (
 	"context"
+	"errors"
 
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 )
 
 // IDResolver provides ID to Name resolution.
@@ -50,7 +50,7 @@ func (r *IDResolver) get(ctx context.Context, t any, id string) (string, error)
 		}
 		return service.Spec.Annotations.Name, nil
 	default:
-		return "", errors.Errorf("unsupported type")
+		return "", errors.New("unsupported type")
 	}
 }
 

cli/command/image/build/internal/git/gitutils.go

@@ -1,6 +1,7 @@
 package git
 
 import (
+	"fmt"
 	"net/http"
 	"net/url"
 	"os"
@@ -9,7 +10,6 @@ import (
 	"strings"
 
 	"github.com/moby/sys/symlink"
-	"github.com/pkg/errors"
 )
 
 type gitRepo struct {
@@ -61,17 +61,17 @@ func (repo gitRepo) clone() (checkoutDir string, retErr error) {
 	}()
 
 	if out, err := repo.gitWithinDir(root, "init"); err != nil {
-		return "", errors.Wrapf(err, "failed to init repo at %s: %s", root, out)
+		return "", fmt.Errorf("failed to init repo at %s: %s: %w", root, out, err)
 	}
 
 	// Add origin remote for compatibility with previous implementation that
 	// used "git clone" and also to make sure local refs are created for branches
 	if out, err := repo.gitWithinDir(root, "remote", "add", "origin", repo.remote); err != nil {
-		return "", errors.Wrapf(err, "failed add origin repo at %s: %s", repo.remote, out)
+		return "", fmt.Errorf("failed add origin repo at %s: %s: %w", repo.remote, out, err)
 	}
 
 	if output, err := repo.gitWithinDir(root, fetch...); err != nil {
-		return "", errors.Wrapf(err, "error fetching: %s", output)
+		return "", fmt.Errorf("error fetching: %s: %w", output, err)
 	}
 
 	checkoutDir, err = repo.checkout(root)
@@ -83,7 +83,7 @@ func (repo gitRepo) clone() (checkoutDir string, retErr error) {
 	cmd.Dir = root
 	output, err := cmd.CombinedOutput()
 	if err != nil {
-		return "", errors.Wrapf(err, "error initializing submodules: %s", output)
+		return "", fmt.Errorf("error initializing submodules: %s: %w", output, err)
 	}
 
 	return checkoutDir, nil
@@ -113,7 +113,7 @@ func parseRemoteURL(remoteURL string) (gitRepo, error) {
 	}
 
 	if strings.HasPrefix(repo.ref, "-") {
-		return gitRepo{}, errors.Errorf("invalid refspec: %s", repo.ref)
+		return gitRepo{}, fmt.Errorf("invalid refspec: %s", repo.ref)
 	}
 
 	return repo, nil
@@ -178,14 +178,14 @@ func (repo gitRepo) checkout(root string) (string, error) {
 	if output, err := repo.gitWithinDir(root, "checkout", repo.ref); err != nil {
 		// If checking out by branch name fails check out the last fetched ref
 		if _, err2 := repo.gitWithinDir(root, "checkout", "FETCH_HEAD"); err2 != nil {
-			return "", errors.Wrapf(err, "error checking out %s: %s", repo.ref, output)
+			return "", fmt.Errorf("error checking out %s: %s: %w", repo.ref, output, err)
 		}
 	}
 
 	if repo.subdir != "" {
 		newCtx, err := symlink.FollowSymlinkInScope(filepath.Join(root, repo.subdir), root)
 		if err != nil {
-			return "", errors.Wrapf(err, "error setting git context, %q not within git root", repo.subdir)
+			return "", fmt.Errorf("error setting git context, %q not within git root: %w", repo.subdir, err)
 		}
 
 		fi, err := os.Stat(newCtx)
@@ -193,7 +193,7 @@ func (repo gitRepo) checkout(root string) (string, error) {
 			return "", err
 		}
 		if !fi.IsDir() {
-			return "", errors.Errorf("error setting git context, not a directory: %s", newCtx)
+			return "", fmt.Errorf("error setting git context, not a directory: %s", newCtx)
 		}
 		root = newCtx
 	}

cli/command/manifest/annotate.go

@@ -12,7 +12,6 @@ import (
 	registryclient "github.com/docker/cli/cli/registry/client"
 	"github.com/moby/moby/api/types/registry"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -86,11 +85,11 @@ func newAnnotateCommand(dockerCli command.Cli) *cobra.Command {
 func runManifestAnnotate(dockerCLI command.Cli, opts annotateOptions) error {
 	targetRef, err := normalizeReference(opts.target)
 	if err != nil {
-		return errors.Wrapf(err, "annotate: error parsing name for manifest list %s", opts.target)
+		return fmt.Errorf("annotate: error parsing name for manifest list %s: %w", opts.target, err)
 	}
 	imgRef, err := normalizeReference(opts.image)
 	if err != nil {
-		return errors.Wrapf(err, "annotate: error parsing name for manifest %s", opts.image)
+		return fmt.Errorf("annotate: error parsing name for manifest %s: %w", opts.image, err)
 	}
 
 	manifestStore := newManifestStore(dockerCLI)
@@ -123,7 +122,7 @@ func runManifestAnnotate(dockerCLI command.Cli, opts annotateOptions) error {
 	}
 
 	if !isValidOSArch(imageManifest.Descriptor.Platform.OS, imageManifest.Descriptor.Platform.Architecture) {
-		return errors.Errorf("manifest entry for image has unsupported os/arch combination: %s/%s", opts.os, opts.arch)
+		return fmt.Errorf("manifest entry for image has unsupported os/arch combination: %s/%s", opts.os, opts.arch)
 	}
 	return manifestStore.Save(targetRef, imgRef, imageManifest)
 }

cli/command/manifest/create_list.go

@@ -2,12 +2,12 @@ package manifest
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/manifest/store"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -38,7 +38,7 @@ func createManifestList(ctx context.Context, dockerCLI command.Cli, args []strin
 	newRef := args[0]
 	targetRef, err := normalizeReference(newRef)
 	if err != nil {
-		return errors.Wrapf(err, "error parsing name for manifest list %s", newRef)
+		return fmt.Errorf("error parsing name for manifest list %s: %w", newRef, err)
 	}
 
 	manifestStore := newManifestStore(dockerCLI)
@@ -49,7 +49,7 @@ func createManifestList(ctx context.Context, dockerCLI command.Cli, args []strin
 	case err != nil:
 		return err
 	case !opts.amend:
-		return errors.Errorf("refusing to amend an existing manifest list with no --amend flag")
+		return errors.New("refusing to amend an existing manifest list with no --amend flag")
 	}
 
 	// Now create the local manifest list transaction by looking up the manifest schemas

cli/command/manifest/inspect.go

@@ -11,7 +11,6 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/manifest/types"
 	"github.com/docker/distribution/manifest/manifestlist"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -99,14 +98,14 @@ func printManifest(dockerCli command.Cli, manifest types.ImageManifest, opts ins
 		if err := json.Indent(buffer, raw, "", "\t"); err != nil {
 			return err
 		}
-		fmt.Fprintln(dockerCli.Out(), buffer.String())
+		_, _ = fmt.Fprintln(dockerCli.Out(), buffer.String())
 		return nil
 	}
 	jsonBytes, err := json.MarshalIndent(manifest, "", "\t")
 	if err != nil {
 		return err
 	}
-	dockerCli.Out().Write(append(jsonBytes, '\n'))
+	_, _ = dockerCli.Out().Write(append(jsonBytes, '\n'))
 	return nil
 }
 
@@ -114,12 +113,12 @@ func printManifestList(dockerCli command.Cli, namedRef reference.Named, list []t
 	if !opts.verbose {
 		targetRepo := reference.TrimNamed(namedRef)
 
-		manifests := []manifestlist.ManifestDescriptor{}
+		manifests := make([]manifestlist.ManifestDescriptor, 0, len(list))
 		// More than one response. This is a manifest list.
 		for _, img := range list {
 			mfd, err := buildManifestDescriptor(targetRepo, img)
 			if err != nil {
-				return errors.Wrap(err, "failed to assemble ManifestDescriptor")
+				return fmt.Errorf("failed to assemble ManifestDescriptor: %w", err)
 			}
 			manifests = append(manifests, mfd)
 		}
@@ -131,13 +130,13 @@ func printManifestList(dockerCli command.Cli, namedRef reference.Named, list []t
 		if err != nil {
 			return err
 		}
-		fmt.Fprintln(dockerCli.Out(), string(jsonBytes))
+		_, _ = fmt.Fprintln(dockerCli.Out(), string(jsonBytes))
 		return nil
 	}
 	jsonBytes, err := json.MarshalIndent(list, "", "\t")
 	if err != nil {
 		return err
 	}
-	dockerCli.Out().Write(append(jsonBytes, '\n'))
+	_, _ = dockerCli.Out().Write(append(jsonBytes, '\n'))
 	return nil
 }

cli/command/manifest/push.go

@@ -15,7 +15,6 @@ import (
 	"github.com/docker/distribution/manifest/manifestlist"
 	"github.com/docker/distribution/manifest/ocischema"
 	"github.com/docker/distribution/manifest/schema2"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
@@ -73,7 +72,7 @@ func runPush(ctx context.Context, dockerCli command.Cli, opts pushOpts) error {
 		return err
 	}
 	if len(manifests) == 0 {
-		return errors.Errorf("%s not found", targetRef)
+		return fmt.Errorf("%s not found", targetRef)
 	}
 
 	req, err := buildPushRequest(manifests, targetRef, opts.insecure)
@@ -123,13 +122,12 @@ func buildPushRequest(manifests []types.ImageManifest, targetRef reference.Named
 
 func buildManifestList(manifests []types.ImageManifest, targetRef reference.Named) (*manifestlist.DeserializedManifestList, error) {
 	targetRepo := reference.TrimNamed(targetRef)
-	descriptors := []manifestlist.ManifestDescriptor{}
+	descriptors := make([]manifestlist.ManifestDescriptor, 0, len(manifests))
 	for _, imageManifest := range manifests {
 		if imageManifest.Descriptor.Platform == nil ||
 			imageManifest.Descriptor.Platform.Architecture == "" ||
 			imageManifest.Descriptor.Platform.OS == "" {
-			return nil, errors.Errorf(
-				"manifest %s must have an OS and Architecture to be pushed to a registry", imageManifest.Ref)
+			return nil, fmt.Errorf("manifest %s must have an OS and Architecture to be pushed to a registry", imageManifest.Ref)
 		}
 		descriptor, err := buildManifestDescriptor(targetRepo, imageManifest)
 		if err != nil {
@@ -145,7 +143,7 @@ func buildManifestDescriptor(targetRepo reference.Named, imageManifest types.Ima
 	manifestRepoHostname := reference.Domain(reference.TrimNamed(imageManifest.Ref))
 	targetRepoHostname := reference.Domain(reference.TrimNamed(targetRepo))
 	if manifestRepoHostname != targetRepoHostname {
-		return manifestlist.ManifestDescriptor{}, errors.Errorf("cannot use source images from a different registry than the target image: %s != %s", manifestRepoHostname, targetRepoHostname)
+		return manifestlist.ManifestDescriptor{}, fmt.Errorf("cannot use source images from a different registry than the target image: %s != %s", manifestRepoHostname, targetRepoHostname)
 	}
 
 	manifest := manifestlist.ManifestDescriptor{
@@ -162,8 +160,7 @@ func buildManifestDescriptor(targetRepo reference.Named, imageManifest types.Ima
 	}
 
 	if err := manifest.Descriptor.Digest.Validate(); err != nil {
-		return manifestlist.ManifestDescriptor{}, errors.Wrapf(err,
-			"digest parse of image %q failed", imageManifest.Ref)
+		return manifestlist.ManifestDescriptor{}, fmt.Errorf("digest parse of image %q failed: %w", imageManifest.Ref, err)
 	}
 
 	return manifest, nil
@@ -215,7 +212,7 @@ func buildPutManifestRequest(imageManifest types.ImageManifest, targetRef refere
 
 		dig := imageManifest.Descriptor.Digest
 		if dig2 := dig.Algorithm().FromBytes(dt); dig != dig2 {
-			return mountRequest{}, errors.Errorf("internal digest mismatch for %s: expected %s, got %s", imageManifest.Ref, dig, dig2)
+			return mountRequest{}, fmt.Errorf("internal digest mismatch for %s: expected %s, got %s", imageManifest.Ref, dig, dig2)
 		}
 
 		var manifest schema2.DeserializedManifest
@@ -234,7 +231,7 @@ func buildPutManifestRequest(imageManifest types.ImageManifest, targetRef refere
 
 		dig := imageManifest.Descriptor.Digest
 		if dig2 := dig.Algorithm().FromBytes(dt); dig != dig2 {
-			return mountRequest{}, errors.Errorf("internal digest mismatch for %s: expected %s, got %s", imageManifest.Ref, dig, dig2)
+			return mountRequest{}, fmt.Errorf("internal digest mismatch for %s: expected %s, got %s", imageManifest.Ref, dig, dig2)
 		}
 
 		var manifest ocischema.DeserializedManifest
@@ -248,15 +245,15 @@ func buildPutManifestRequest(imageManifest types.ImageManifest, targetRef refere
 }
 
 func pushList(ctx context.Context, dockerCLI command.Cli, req pushRequest) error {
-	rclient := newRegistryClient(dockerCLI, req.insecure)
+	registryClient := newRegistryClient(dockerCLI, req.insecure)
 
-	if err := mountBlobs(ctx, rclient, req.targetRef, req.manifestBlobs); err != nil {
+	if err := mountBlobs(ctx, registryClient, req.targetRef, req.manifestBlobs); err != nil {
 		return err
 	}
-	if err := pushReferences(ctx, dockerCLI.Out(), rclient, req.mountRequests); err != nil {
+	if err := pushReferences(ctx, dockerCLI.Out(), registryClient, req.mountRequests); err != nil {
 		return err
 	}
-	dgst, err := rclient.PutManifest(ctx, req.targetRef, req.list)
+	dgst, err := registryClient.PutManifest(ctx, req.targetRef, req.list)
 	if err != nil {
 		return err
 	}

cli/command/registry.go

@@ -2,6 +2,7 @@ package command
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -17,7 +18,6 @@ import (
 	"github.com/docker/cli/internal/tui"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/morikuni/aec"
-	"github.com/pkg/errors"
 )
 
 const (
@@ -151,7 +151,7 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword
 			argUser = defaultUsername
 		}
 		if argUser == "" {
-			return registrytypes.AuthConfig{}, errors.Errorf("Error: Non-null Username Required")
+			return registrytypes.AuthConfig{}, errors.New("error: username is required")
 		}
 	}
 
@@ -183,7 +183,7 @@ func PromptUserForCredentials(ctx context.Context, cli Cli, argUser, argPassword
 		}
 		_, _ = fmt.Fprintln(cli.Out())
 		if argPassword == "" {
-			return registrytypes.AuthConfig{}, errors.Errorf("Error: Password Required")
+			return registrytypes.AuthConfig{}, errors.New("error: password is required")
 		}
 	}
 

cli/command/registry/login.go

@@ -2,6 +2,7 @@ package registry
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -19,7 +20,6 @@ import (
 	"github.com/docker/cli/internal/tui"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 )
@@ -200,7 +200,7 @@ func loginUser(ctx context.Context, dockerCLI command.Cli, opts loginOptions, de
 	// will hit this if you attempt docker login from mintty where stdin
 	// is a pipe, not a character based console.
 	if (opts.user == "" || opts.password == "") && !dockerCLI.In().IsTerminal() {
-		return "", errors.Errorf("Error: Cannot perform an interactive login from a non TTY device")
+		return "", errors.New("error: cannot perform an interactive login from a non TTY device")
 	}
 
 	// If we're logging into the index server and the user didn't provide a username or password, use the device flow
@@ -263,7 +263,7 @@ func loginWithDeviceCodeFlow(ctx context.Context, dockerCLI command.Cli) (msg st
 func storeCredentials(cfg *configfile.ConfigFile, authConfig registrytypes.AuthConfig) error {
 	creds := cfg.GetCredentialsStore(authConfig.ServerAddress)
 	if err := creds.Store(configtypes.AuthConfig(authConfig)); err != nil {
-		return errors.Errorf("Error saving credentials: %v", err)
+		return fmt.Errorf("error saving credentials: %v", err)
 	}
 
 	return nil

cli/command/registry/login_test.go

@@ -128,7 +128,7 @@ func TestRunLogin(t *testing.T) {
 			input: loginOptions{
 				serverAddress: "reg1",
 			},
-			expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+			expectedErr: "error: cannot perform an interactive login from a non TTY device",
 		},
 		{
 			doc:              "store valid username and password",
@@ -335,19 +335,19 @@ func TestLoginNonInteractive(t *testing.T) {
 				doc:         "error - w/o user w/o pass ",
 				username:    false,
 				password:    false,
-				expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+				expectedErr: "error: cannot perform an interactive login from a non TTY device",
 			},
 			{
 				doc:         "error - w/ user w/o pass",
 				username:    true,
 				password:    false,
-				expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+				expectedErr: "error: cannot perform an interactive login from a non TTY device",
 			},
 			{
 				doc:         "error - w/o user w/ pass",
 				username:    false,
 				password:    true,
-				expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+				expectedErr: "error: cannot perform an interactive login from a non TTY device",
 			},
 		}
 
@@ -404,13 +404,13 @@ func TestLoginNonInteractive(t *testing.T) {
 				doc:         "error - w/ user w/o pass",
 				username:    true,
 				password:    false,
-				expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+				expectedErr: "error: cannot perform an interactive login from a non TTY device",
 			},
 			{
 				doc:         "error - w/o user w/ pass",
 				username:    false,
 				password:    true,
-				expectedErr: "Error: Cannot perform an interactive login from a non TTY device",
+				expectedErr: "error: cannot perform an interactive login from a non TTY device",
 			},
 		}
 

cli/command/telemetry_docker.go

@@ -14,7 +14,6 @@ import (
 	"strings"
 	"unicode"
 
-	"github.com/pkg/errors"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
@@ -48,7 +47,7 @@ func dockerExporterOTLPEndpoint(cli Cli) (endpoint string, secure bool) {
 	if otelCfg != nil {
 		otelMap, ok := otelCfg.(map[string]any)
 		if !ok {
-			otel.Handle(errors.Errorf(
+			otel.Handle(fmt.Errorf(
 				"unexpected type for field %q: %T (expected: %T)",
 				otelContextFieldName,
 				otelCfg,
@@ -76,7 +75,7 @@ func dockerExporterOTLPEndpoint(cli Cli) (endpoint string, secure bool) {
 	// We pretend we're the same as the environment reader.
 	u, err := url.Parse(endpoint)
 	if err != nil {
-		otel.Handle(errors.Errorf("docker otel endpoint is invalid: %s", err))
+		otel.Handle(fmt.Errorf("docker otel endpoint is invalid: %s", err))
 		return "", false
 	}
 

cli/command/telemetry_utils.go

@@ -2,12 +2,12 @@ package command
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
 
 	"github.com/docker/cli/cli/version"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"

cli/command/trust/key_generate.go

@@ -11,7 +11,6 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/internal/lazyregexp"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/theupdateframework/notary"
 	"github.com/theupdateframework/notary/trustmanager"
@@ -88,7 +87,7 @@ func validateAndGenerateKey(streams command.Streams, keyName string, workingDir
 	pubPEM, err := generateKeyAndOutputPubPEM(keyName, privKeyFileStore)
 	if err != nil {
 		_, _ = fmt.Fprint(streams.Out(), err)
-		return errors.Wrapf(err, "failed to generate key for %s", keyName)
+		return fmt.Errorf("failed to generate key for %s: %w", keyName, err)
 	}
 
 	// Output the public key to a file in the CWD or specified dir
@@ -126,7 +125,7 @@ func writePubKeyPEMToDir(pubPEM pem.Block, keyName, workingDir string) (string,
 	pubFileName := strings.Join([]string{keyName, "pub"}, ".")
 	pubFilePath := filepath.Join(workingDir, pubFileName)
 	if err := os.WriteFile(pubFilePath, pem.EncodeToMemory(&pubPEM), notary.PrivNoExecPerms); err != nil {
-		return "", errors.Wrapf(err, "failed to write public key to %s", pubFilePath)
+		return "", fmt.Errorf("failed to write public key to %s: %w", pubFilePath, err)
 	}
 	return pubFilePath, nil
 }

cli/command/trust/key_load.go

@@ -3,6 +3,7 @@ package trust
 import (
 	"bytes"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/cli/cli"
 	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/trust"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/theupdateframework/notary"
 	"github.com/theupdateframework/notary/storage"
@@ -60,10 +60,10 @@ func loadPrivKey(streams command.Streams, keyPath string, options keyLoadOptions
 	passRet := trust.GetPassphraseRetriever(streams.In(), streams.Out())
 	keyBytes, err := getPrivKeyBytesFromPath(keyPath)
 	if err != nil {
-		return errors.Wrapf(err, "refusing to load key from %s", keyPath)
+		return fmt.Errorf("refusing to load key from %s: %w", keyPath, err)
 	}
 	if err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {
-		return errors.Wrapf(err, "error importing key from %s", keyPath)
+		return fmt.Errorf("error importing key from %s: %w", keyPath, err)
 	}
 	_, _ = fmt.Fprintln(streams.Out(), "Successfully imported key from", keyPath)
 	return nil
@@ -95,7 +95,7 @@ func loadPrivKeyBytesToStore(privKeyBytes []byte, privKeyImporters []trustmanage
 		return fmt.Errorf("provided file %s is not a supported private key - to add a signer's public key use docker trust signer add", keyPath)
 	}
 	if privKeyBytes, err = decodePrivKeyIfNecessary(privKeyBytes, passRet); err != nil {
-		return errors.Wrapf(err, "cannot load key from provided file %s", keyPath)
+		return fmt.Errorf("cannot load key from provided file %s: %w", keyPath, err)
 	}
 	// Make a reader, rewind the file pointer
 	return trustmanager.ImportKeys(bytes.NewReader(privKeyBytes), privKeyImporters, keyName, "", passRet)

cli/command/trust/revoke.go

@@ -2,6 +2,7 @@ package trust
 
 import (
 	"context"
+	"errors"
 	"fmt"
 
 	"github.com/docker/cli/cli"
@@ -9,7 +10,6 @@ import (
 	"github.com/docker/cli/cli/command/image"
 	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/internal/prompt"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/tuf/data"
@@ -63,7 +63,7 @@ func revokeTrust(ctx context.Context, dockerCLI command.Cli, remote string, opti
 	}
 	defer clearChangeList(notaryRepo)
 	if err := revokeSignature(notaryRepo, tag); err != nil {
-		return errors.Wrapf(err, "could not remove signature for %s", remote)
+		return fmt.Errorf("could not remove signature for %s: %w", remote, err)
 	}
 	_, _ = fmt.Fprintf(dockerCLI.Out(), "Successfully deleted signature for %s\n", remote)
 	return nil

cli/command/trust/sign.go

@@ -2,6 +2,7 @@ package trust
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"path"
@@ -16,7 +17,6 @@ import (
 	imagetypes "github.com/moby/moby/api/types/image"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	notaryclient "github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/tuf/data"
@@ -127,7 +127,7 @@ func signAndPublishToTarget(out io.Writer, imgRefAndAuth trust.ImageRefAndAuth,
 		err = notaryRepo.Publish()
 	}
 	if err != nil {
-		return errors.Wrapf(err, "failed to sign %s:%s", imgRefAndAuth.RepoInfo().Name.Name(), tag)
+		return fmt.Errorf("failed to sign %s:%s: %w", imgRefAndAuth.RepoInfo().Name.Name(), tag, err)
 	}
 	_, _ = fmt.Fprintf(out, "Successfully signed %s:%s\n", imgRefAndAuth.RepoInfo().Name.Name(), tag)
 	return nil
@@ -212,7 +212,7 @@ func initNotaryRepoWithSigners(notaryRepo notaryclient.Repository, newSigner dat
 		return err
 	}
 	if err := addStagedSigner(notaryRepo, newSigner, []data.PublicKey{signerKey}); err != nil {
-		return errors.Wrapf(err, "could not add signer to repo: %s", strings.TrimPrefix(newSigner.String(), "targets/"))
+		return fmt.Errorf("could not add signer to repo: %s: %w", strings.TrimPrefix(newSigner.String(), "targets/"), err)
 	}
 
 	return notaryRepo.Publish()

cli/command/trust/signer_add.go

@@ -2,6 +2,7 @@ package trust
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -14,7 +15,6 @@ import (
 	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/internal/lazyregexp"
 	"github.com/docker/cli/opts"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/tuf/data"
@@ -106,7 +106,7 @@ func addSignerToRepo(ctx context.Context, dockerCLI command.Cli, signerName stri
 	newSignerRoleName := data.RoleName(path.Join(data.CanonicalTargetsRole.String(), signerName))
 
 	if err := addStagedSigner(notaryRepo, newSignerRoleName, signerPubKeys); err != nil {
-		return errors.Wrapf(err, "could not add signer to repo: %s", strings.TrimPrefix(newSignerRoleName.String(), "targets/"))
+		return fmt.Errorf("could not add signer to repo: %s: %w", strings.TrimPrefix(newSignerRoleName.String(), "targets/"), err)
 	}
 
 	return notaryRepo.Publish()
@@ -118,20 +118,20 @@ func ingestPublicKeys(pubKeyPaths []string) ([]data.PublicKey, error) {
 		// Read public key bytes from PEM file, limit to 1 KiB
 		pubKeyFile, err := os.OpenFile(pubKeyPath, os.O_RDONLY, 0o666)
 		if err != nil {
-			return nil, errors.Wrap(err, "unable to read public key from file")
+			return nil, fmt.Errorf("unable to read public key from file: %w", err)
 		}
 		defer pubKeyFile.Close()
 		// limit to
 		l := io.LimitReader(pubKeyFile, 1<<20)
 		pubKeyBytes, err := io.ReadAll(l)
 		if err != nil {
-			return nil, errors.Wrap(err, "unable to read public key from file")
+			return nil, fmt.Errorf("unable to read public key from file: %w", err)
 		}
 
 		// Parse PEM bytes into type PublicKey
 		pubKey, err := tufutils.ParsePEMPublicKey(pubKeyBytes)
 		if err != nil {
-			return nil, errors.Wrapf(err, "could not parse public key from file: %s", pubKeyPath)
+			return nil, fmt.Errorf("could not parse public key from file: %s: %w", pubKeyPath, err)
 		}
 		pubKeys = append(pubKeys, pubKey)
 	}

cli/command/trust/signer_remove.go

@@ -2,6 +2,7 @@ package trust
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/cli/cli/command/image"
 	"github.com/docker/cli/cli/trust"
 	"github.com/docker/cli/internal/prompt"
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/tuf/data"
@@ -49,7 +49,7 @@ func removeSigner(ctx context.Context, dockerCLI command.Cli, options signerRemo
 		}
 	}
 	if len(errRepos) > 0 {
-		return errors.Errorf("error removing signer from: %s", strings.Join(errRepos, ", "))
+		return fmt.Errorf("error removing signer from: %s", strings.Join(errRepos, ", "))
 	}
 	return nil
 }
@@ -98,7 +98,7 @@ func removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, si
 
 	signerDelegation := data.RoleName("targets/" + signerName)
 	if signerDelegation == releasesRoleTUFName {
-		return false, errors.Errorf("releases is a reserved keyword and cannot be removed")
+		return false, errors.New("releases is a reserved keyword and cannot be removed")
 	}
 	notaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull)
 	if err != nil {
@@ -106,7 +106,7 @@ func removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, si
 	}
 	delegationRoles, err := notaryRepo.GetDelegationRoles()
 	if err != nil {
-		return false, errors.Wrapf(err, "error retrieving signers for %s", repoName)
+		return false, fmt.Errorf("error retrieving signers for %s: %w", repoName, err)
 	}
 	var role data.Role
 	for _, delRole := range delegationRoles {
@@ -116,7 +116,7 @@ func removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, si
 		}
 	}
 	if role.Name == "" {
-		return false, errors.Errorf("no signer %s for repository %s", signerName, repoName)
+		return false, fmt.Errorf("no signer %s for repository %s", signerName, repoName)
 	}
 	allRoles, err := notaryRepo.ListRoles()
 	if err != nil {

cli/command/utils.go

@@ -4,13 +4,14 @@
 package command
 
 import (
+	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"github.com/docker/cli/cli/config"
 	"github.com/moby/moby/api/types/filters"
-	"github.com/pkg/errors"
 )
 
 // PruneFilters merges prune filters specified in config.json with those specified
@@ -59,7 +60,7 @@ func ValidateOutputPath(path string) error {
 	dir := filepath.Dir(filepath.Clean(path))
 	if dir != "" && dir != "." {
 		if _, err := os.Stat(dir); os.IsNotExist(err) {
-			return errors.Errorf("invalid output path: directory %q does not exist", dir)
+			return fmt.Errorf("invalid output path: directory %q does not exist", dir)
 		}
 	}
 	// check whether `path` points to a regular file
@@ -74,7 +75,7 @@ func ValidateOutputPath(path string) error {
 		}
 
 		if err := ValidateOutputPathFileMode(fileInfo.Mode()); err != nil {
-			return errors.Wrapf(err, "invalid output path: %q must be a directory or a regular file", path)
+			return fmt.Errorf("invalid output path: %q must be a directory or a regular file: %w", path, err)
 		}
 	}
 	return nil

cli/compose/convert/service.go

@@ -2,6 +2,8 @@ package convert
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"os"
 	"sort"
 	"strings"
@@ -14,7 +16,6 @@ import (
 	"github.com/moby/moby/api/types/swarm"
 	"github.com/moby/moby/api/types/versions"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 )
 
 const (
@@ -34,16 +35,16 @@ func Services(
 	for _, service := range config.Services {
 		secrets, err := convertServiceSecrets(ctx, apiClient, namespace, service.Secrets, config.Secrets)
 		if err != nil {
-			return nil, errors.Wrapf(err, "service %s", service.Name)
+			return nil, fmt.Errorf("service %s: %w", service.Name, err)
 		}
 		configs, err := convertServiceConfigObjs(ctx, apiClient, namespace, service, config.Configs)
 		if err != nil {
-			return nil, errors.Wrapf(err, "service %s", service.Name)
+			return nil, fmt.Errorf("service %s: %w", service.Name, err)
 		}
 
 		serviceSpec, err := Service(apiClient.ClientVersion(), namespace, service, config.Networks, config.Volumes, secrets, configs)
 		if err != nil {
-			return nil, errors.Wrapf(err, "service %s", service.Name)
+			return nil, fmt.Errorf("service %s: %w", service.Name, err)
 		}
 		result[service.Name] = serviceSpec
 	}
@@ -212,7 +213,7 @@ func convertServiceNetworks(
 	for networkName, network := range networks {
 		networkConfig, ok := networkConfigs[networkName]
 		if !ok && networkName != defaultNetwork {
-			return nil, errors.Errorf("undefined network %q", networkName)
+			return nil, fmt.Errorf("undefined network %q", networkName)
 		}
 		var aliases []string
 		var driverOpts map[string]string
@@ -256,7 +257,7 @@ func convertServiceSecrets(
 	lookup := func(key string) (composetypes.FileObjectConfig, error) {
 		secretSpec, exists := secretSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.Errorf("undefined secret %q", key)
+			return composetypes.FileObjectConfig{}, fmt.Errorf("undefined secret %q", key)
 		}
 		return composetypes.FileObjectConfig(secretSpec), nil
 	}
@@ -301,7 +302,7 @@ func convertServiceConfigObjs(
 	lookup := func(key string) (composetypes.FileObjectConfig, error) {
 		configSpec, exists := configSpecs[key]
 		if !exists {
-			return composetypes.FileObjectConfig{}, errors.Errorf("undefined config %q", key)
+			return composetypes.FileObjectConfig{}, fmt.Errorf("undefined config %q", key)
 		}
 		return composetypes.FileObjectConfig(configSpec), nil
 	}
@@ -318,7 +319,7 @@ func convertServiceConfigObjs(
 		})
 	}
 
-	// finally, after converting all of the file objects, create any
+	// finally, after converting all file objects, create any
 	// Runtime-type configs that are needed. these are configs that are not
 	// mounted into the container, but are used in some other way by the
 	// container runtime. Currently, this only means CredentialSpecs, but in
@@ -442,7 +443,7 @@ func convertHealthcheck(healthcheck *composetypes.HealthCheckConfig) (*container
 	)
 	if healthcheck.Disable {
 		if len(healthcheck.Test) != 0 {
-			return nil, errors.Errorf("test and disable can't be set at the same time")
+			return nil, errors.New("test and disable can't be set at the same time")
 		}
 		return &container.HealthConfig{
 			Test: []string{"NONE"},
@@ -494,7 +495,7 @@ func convertRestartPolicy(restart string, source *composetypes.RestartPolicy) (*
 				MaxAttempts: &attempts,
 			}, nil
 		default:
-			return nil, errors.Errorf("unknown restart policy: %s", restart)
+			return nil, fmt.Errorf("unknown restart policy: %s", restart)
 		}
 	}
 
@@ -618,12 +619,12 @@ func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error)
 	switch mode {
 	case "global-job":
 		if replicas != nil {
-			return serviceMode, errors.Errorf("replicas can only be used with replicated or replicated-job mode")
+			return serviceMode, errors.New("replicas can only be used with replicated or replicated-job mode")
 		}
 		serviceMode.GlobalJob = &swarm.GlobalJob{}
 	case "global":
 		if replicas != nil {
-			return serviceMode, errors.Errorf("replicas can only be used with replicated or replicated-job mode")
+			return serviceMode, errors.New("replicas can only be used with replicated or replicated-job mode")
 		}
 		serviceMode.Global = &swarm.GlobalService{}
 	case "replicated-job":
@@ -634,7 +635,7 @@ func convertDeployMode(mode string, replicas *uint64) (swarm.ServiceMode, error)
 	case "replicated", "":
 		serviceMode.Replicated = &swarm.ReplicatedService{Replicas: replicas}
 	default:
-		return serviceMode, errors.Errorf("Unknown mode: %s", mode)
+		return serviceMode, fmt.Errorf("unknown mode: %s", mode)
 	}
 	return serviceMode, nil
 }
@@ -667,9 +668,9 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 	case l == 0:
 		return nil, nil
 	case l == 2:
-		return nil, errors.Errorf("invalid credential spec: cannot specify both %s and %s", o[0], o[1])
+		return nil, fmt.Errorf("invalid credential spec: cannot specify both %s and %s", o[0], o[1])
 	case l > 2:
-		return nil, errors.Errorf("invalid credential spec: cannot specify both %s, and %s", strings.Join(o[:l-1], ", "), o[l-1])
+		return nil, fmt.Errorf("invalid credential spec: cannot specify both %s, and %s", strings.Join(o[:l-1], ", "), o[l-1])
 	}
 	swarmCredSpec := swarm.CredentialSpec(spec)
 	// if we're using a swarm Config for the credential spec, over-write it
@@ -688,7 +689,7 @@ func convertCredentialSpec(namespace Namespace, spec composetypes.CredentialSpec
 				return &swarmCredSpec, nil
 			}
 		}
-		return nil, errors.Errorf("invalid credential spec: spec specifies config %v, but no such config can be found", swarmCredSpec.Config)
+		return nil, fmt.Errorf("invalid credential spec: spec specifies config %v, but no such config can be found", swarmCredSpec.Config)
 	}
 	return &swarmCredSpec, nil
 }

cli/compose/convert/volume.go

@@ -1,11 +1,12 @@
 package convert
 
 import (
+	"errors"
+	"fmt"
 	"strings"
 
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/moby/moby/api/types/mount"
-	"github.com/pkg/errors"
 )
 
 type volumes map[string]composetypes.VolumeConfig
@@ -59,7 +60,7 @@ func handleVolumeToMount(
 
 	stackVolume, exists := stackVolumes[volume.Source]
 	if !exists {
-		return mount.Mount{}, errors.Errorf("undefined volume %q", volume.Source)
+		return mount.Mount{}, fmt.Errorf("undefined volume %q", volume.Source)
 	}
 
 	result.Source = namespace.Scope(volume.Source)
@@ -219,7 +220,7 @@ func handleClusterToMount(
 		// external volumes with a given group exist.
 		stackVolume, exists := stackVolumes[volume.Source]
 		if !exists {
-			return mount.Mount{}, errors.Errorf("undefined volume %q", volume.Source)
+			return mount.Mount{}, fmt.Errorf("undefined volume %q", volume.Source)
 		}
 
 		// if the volume is not specified with a group source, we may namespace

cli/compose/interpolation/interpolation.go

@@ -4,11 +4,11 @@
 package interpolation
 
 import (
+	"fmt"
 	"os"
 	"strings"
 
 	"github.com/docker/cli/cli/compose/template"
-	"github.com/pkg/errors"
 )
 
 // Options supported by Interpolate
@@ -68,7 +68,7 @@ func recursiveInterpolate(value any, path Path, opts Options) (any, error) {
 		}
 		casted, err := caster(newValue)
 		if err != nil {
-			return casted, newPathError(path, errors.Wrap(err, "failed to cast to expected type"))
+			return casted, newPathError(path, fmt.Errorf("failed to cast to expected type: %w", err))
 		}
 		return casted, nil
 
@@ -104,11 +104,11 @@ func newPathError(path Path, err error) error {
 	case nil:
 		return nil
 	case *template.InvalidTemplateError:
-		return errors.Errorf(
+		return fmt.Errorf(
 			"invalid interpolation format for %s: %#v; you may need to escape any $ with another $",
 			path, err.Template)
 	default:
-		return errors.Wrapf(err, "error while interpolating %s", path)
+		return fmt.Errorf("error while interpolating %s: %w", path, err)
 	}
 }
 

cli/compose/loader/interpolate.go

@@ -4,11 +4,11 @@
 package loader
 
 import (
+	"fmt"
 	"strconv"
 	"strings"
 
 	interp "github.com/docker/cli/cli/compose/interpolation"
-	"github.com/pkg/errors"
 )
 
 var interpolateTypeCastMapping = map[interp.Path]interp.Cast{
@@ -67,7 +67,7 @@ func toBoolean(value string) (any, error) {
 	case "n", "no", "false", "off":
 		return false, nil
 	default:
-		return nil, errors.Errorf("invalid boolean: %s", value)
+		return nil, fmt.Errorf("invalid boolean: %s", value)
 	}
 }
 

cli/compose/loader/loader.go

@@ -4,6 +4,7 @@
 package loader
 
 import (
+	"errors"
 	"fmt"
 	"path"
 	"path/filepath"
@@ -26,7 +27,6 @@ import (
 	"github.com/google/shlex"
 	"github.com/moby/moby/api/types/container"
 	"github.com/moby/moby/api/types/versions"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
 )
@@ -65,7 +65,7 @@ func ParseYAML(source []byte) (map[string]any, error) {
 	}
 	_, ok := cfg.(map[string]any)
 	if !ok {
-		return nil, errors.Errorf("top-level object must be a mapping")
+		return nil, errors.New("top-level object must be a mapping")
 	}
 	converted, err := convertToStringKeysRecursive(cfg, "")
 	if err != nil {
@@ -77,7 +77,7 @@ func ParseYAML(source []byte) (map[string]any, error) {
 // Load reads a ConfigDetails and returns a fully loaded configuration
 func Load(configDetails types.ConfigDetails, opt ...func(*Options)) (*types.Config, error) {
 	if len(configDetails.ConfigFiles) < 1 {
-		return nil, errors.Errorf("No files specified")
+		return nil, errors.New("no files specified")
 	}
 
 	options := &Options{
@@ -102,7 +102,7 @@ func Load(configDetails types.ConfigDetails, opt ...func(*Options)) (*types.Conf
 			configDetails.Version = version
 		}
 		if configDetails.Version != version {
-			return nil, errors.Errorf("version mismatched between two composefiles : %v and %v", configDetails.Version, version)
+			return nil, fmt.Errorf("version mismatched between two composefiles : %v and %v", configDetails.Version, version)
 		}
 
 		if err := validateForbidden(configDict); err != nil {
@@ -533,7 +533,7 @@ func transformUlimits(data any) (any, error) {
 		ulimit.Hard = value["hard"].(int)
 		return ulimit, nil
 	default:
-		return data, errors.Errorf("invalid type %T for ulimits", value)
+		return data, fmt.Errorf("invalid type %T for ulimits", value)
 	}
 }
 
@@ -552,7 +552,7 @@ func LoadNetworks(source map[string]any, version string) (map[string]types.Netwo
 		switch {
 		case network.External.Name != "":
 			if network.Name != "" {
-				return nil, errors.Errorf("network %s: network.external.name and network.name conflict; only use network.name", name)
+				return nil, fmt.Errorf("network %s: network.external.name and network.name conflict; only use network.name", name)
 			}
 			if versions.GreaterThanOrEqualTo(version, "3.5") {
 				logrus.Warnf("network %s: network.external.name is deprecated in favor of network.name", name)
@@ -569,9 +569,7 @@ func LoadNetworks(source map[string]any, version string) (map[string]types.Netwo
 }
 
 func externalVolumeError(volume, key string) error {
-	return errors.Errorf(
-		"conflicting parameters \"external\" and %q specified for volume %q",
-		key, volume)
+	return fmt.Errorf(`conflicting parameters "external" and %q specified for volume %q`, key, volume)
 }
 
 // LoadVolumes produces a VolumeConfig map from a compose file Dict
@@ -595,7 +593,7 @@ func LoadVolumes(source map[string]any, version string) (map[string]types.Volume
 			return nil, externalVolumeError(name, "labels")
 		case volume.External.Name != "":
 			if volume.Name != "" {
-				return nil, errors.Errorf("volume %s: volume.external.name and volume.name conflict; only use volume.name", name)
+				return nil, fmt.Errorf("volume %s: volume.external.name and volume.name conflict; only use volume.name", name)
 			}
 			if versions.GreaterThanOrEqualTo(version, "3.4") {
 				logrus.Warnf("volume %s: volume.external.name is deprecated in favor of volume.name", name)
@@ -656,7 +654,7 @@ func loadFileObjectConfig(name string, objType string, obj types.FileObjectConfi
 		// handle deprecated external.name
 		if obj.External.Name != "" {
 			if obj.Name != "" {
-				return obj, errors.Errorf("%[1]s %[2]s: %[1]s.external.name and %[1]s.name conflict; only use %[1]s.name", objType, name)
+				return obj, fmt.Errorf("%[1]s %[2]s: %[1]s.external.name and %[1]s.name conflict; only use %[1]s.name", objType, name)
 			}
 			if versions.GreaterThanOrEqualTo(details.Version, "3.5") {
 				logrus.Warnf("%[1]s %[2]s: %[1]s.external.name is deprecated in favor of %[1]s.name", objType, name)
@@ -669,7 +667,7 @@ func loadFileObjectConfig(name string, objType string, obj types.FileObjectConfi
 		// if not "external: true"
 	case obj.Driver != "":
 		if obj.File != "" {
-			return obj, errors.Errorf("%[1]s %[2]s: %[1]s.driver and %[1]s.file conflict; only use %[1]s.driver", objType, name)
+			return obj, fmt.Errorf("%[1]s %[2]s: %[1]s.driver and %[1]s.file conflict; only use %[1]s.driver", objType, name)
 		}
 	default:
 		obj.File = absPath(details.WorkingDir, obj.File)
@@ -692,7 +690,7 @@ var transformMapStringString TransformerFunc = func(data any) (any, error) {
 	case map[string]string:
 		return value, nil
 	default:
-		return data, errors.Errorf("invalid type %T for map[string]string", value)
+		return data, fmt.Errorf("invalid type %T for map[string]string", value)
 	}
 }
 
@@ -703,7 +701,7 @@ var transformExternal TransformerFunc = func(data any) (any, error) {
 	case map[string]any:
 		return map[string]any{"external": true, "name": value["name"]}, nil
 	default:
-		return data, errors.Errorf("invalid type %T for external", value)
+		return data, fmt.Errorf("invalid type %T for external", value)
 	}
 }
 
@@ -731,12 +729,12 @@ var transformServicePort TransformerFunc = func(data any) (any, error) {
 			case map[string]any:
 				ports = append(ports, value)
 			default:
-				return data, errors.Errorf("invalid type %T for port", value)
+				return data, fmt.Errorf("invalid type %T for port", value)
 			}
 		}
 		return ports, nil
 	default:
-		return data, errors.Errorf("invalid type %T for port", entries)
+		return data, fmt.Errorf("invalid type %T for port", entries)
 	}
 }
 
@@ -747,7 +745,7 @@ var transformStringSourceMap TransformerFunc = func(data any) (any, error) {
 	case map[string]any:
 		return data, nil
 	default:
-		return data, errors.Errorf("invalid type %T for secret", value)
+		return data, fmt.Errorf("invalid type %T for secret", value)
 	}
 }
 
@@ -758,7 +756,7 @@ var transformBuildConfig TransformerFunc = func(data any) (any, error) {
 	case map[string]any:
 		return data, nil
 	default:
-		return data, errors.Errorf("invalid type %T for service build", value)
+		return data, fmt.Errorf("invalid type %T for service build", value)
 	}
 }
 
@@ -769,7 +767,7 @@ var transformServiceVolumeConfig TransformerFunc = func(data any) (any, error) {
 	case map[string]any:
 		return data, nil
 	default:
-		return data, errors.Errorf("invalid type %T for service volume", value)
+		return data, fmt.Errorf("invalid type %T for service volume", value)
 	}
 }
 
@@ -800,7 +798,7 @@ var transformStringList TransformerFunc = func(data any) (any, error) {
 	case []any:
 		return value, nil
 	default:
-		return data, errors.Errorf("invalid type %T for string list", value)
+		return data, fmt.Errorf("invalid type %T for string list", value)
 	}
 }
 
@@ -847,7 +845,7 @@ func transformListOrMapping(listOrMapping any, sep string, allowNil bool, allowS
 		}
 		return result
 	}
-	panic(errors.Errorf("expected a map or a list, got %T: %#v", listOrMapping, listOrMapping))
+	panic(fmt.Errorf("expected a map or a list, got %T: %#v", listOrMapping, listOrMapping))
 }
 
 func transformMappingOrListFunc(sep string, allowNil bool) TransformerFunc {
@@ -875,7 +873,7 @@ func transformMappingOrList(mappingOrList any, sep string, allowNil bool) any {
 		}
 		return result
 	}
-	panic(errors.Errorf("expected a map or a list, got %T: %#v", mappingOrList, mappingOrList))
+	panic(fmt.Errorf("expected a map or a list, got %T: %#v", mappingOrList, mappingOrList))
 }
 
 var transformShellCommand TransformerFunc = func(value any) (any, error) {
@@ -892,7 +890,7 @@ var transformHealthCheckTest TransformerFunc = func(data any) (any, error) {
 	case []any:
 		return value, nil
 	default:
-		return value, errors.Errorf("invalid type %T for healthcheck.test", value)
+		return value, fmt.Errorf("invalid type %T for healthcheck.test", value)
 	}
 }
 
@@ -903,7 +901,7 @@ var transformSize TransformerFunc = func(value any) (any, error) {
 	case string:
 		return units.RAMInBytes(value)
 	}
-	panic(errors.Errorf("invalid type for size %T", value))
+	panic(fmt.Errorf("invalid type for size %T", value))
 }
 
 var transformStringToDuration TransformerFunc = func(value any) (any, error) {
@@ -915,7 +913,7 @@ var transformStringToDuration TransformerFunc = func(value any) (any, error) {
 		}
 		return types.Duration(d), nil
 	default:
-		return value, errors.Errorf("invalid type %T for duration", value)
+		return value, fmt.Errorf("invalid type %T for duration", value)
 	}
 }
 

cli/compose/loader/merge.go

@@ -4,12 +4,12 @@
 package loader
 
 import (
+	"fmt"
 	"reflect"
 	"sort"
 
 	"dario.cat/mergo"
 	"github.com/docker/cli/cli/compose/types"
-	"github.com/pkg/errors"
 )
 
 type specials struct {
@@ -29,23 +29,23 @@ func merge(configs []*types.Config) (*types.Config, error) {
 		var err error
 		base.Services, err = mergeServices(base.Services, override.Services)
 		if err != nil {
-			return base, errors.Wrapf(err, "cannot merge services from %s", override.Filename)
+			return base, fmt.Errorf("cannot merge services from %s: %w", override.Filename, err)
 		}
 		base.Volumes, err = mergeVolumes(base.Volumes, override.Volumes)
 		if err != nil {
-			return base, errors.Wrapf(err, "cannot merge volumes from %s", override.Filename)
+			return base, fmt.Errorf("cannot merge volumes from %s: %w", override.Filename, err)
 		}
 		base.Networks, err = mergeNetworks(base.Networks, override.Networks)
 		if err != nil {
-			return base, errors.Wrapf(err, "cannot merge networks from %s", override.Filename)
+			return base, fmt.Errorf("cannot merge networks from %s: %w", override.Filename, err)
 		}
 		base.Secrets, err = mergeSecrets(base.Secrets, override.Secrets)
 		if err != nil {
-			return base, errors.Wrapf(err, "cannot merge secrets from %s", override.Filename)
+			return base, fmt.Errorf("cannot merge secrets from %s: %w", override.Filename, err)
 		}
 		base.Configs, err = mergeConfigs(base.Configs, override.Configs)
 		if err != nil {
-			return base, errors.Wrapf(err, "cannot merge configs from %s", override.Filename)
+			return base, fmt.Errorf("cannot merge configs from %s: %w", override.Filename, err)
 		}
 	}
 	return base, nil
@@ -70,7 +70,7 @@ func mergeServices(base, override []types.ServiceConfig) ([]types.ServiceConfig,
 	for name, overrideService := range overrideServices {
 		if baseService, ok := baseServices[name]; ok {
 			if err := mergo.Merge(&baseService, &overrideService, mergo.WithAppendSlice, mergo.WithOverride, mergo.WithTransformers(specials)); err != nil {
-				return base, errors.Wrapf(err, "cannot merge service %s", name)
+				return base, fmt.Errorf("cannot merge service %s: %w", name, err)
 			}
 			baseServices[name] = baseService
 			continue
@@ -88,7 +88,7 @@ func mergeServices(base, override []types.ServiceConfig) ([]types.ServiceConfig,
 func toServiceSecretConfigsMap(s any) (map[any]any, error) {
 	secrets, ok := s.([]types.ServiceSecretConfig)
 	if !ok {
-		return nil, errors.Errorf("not a serviceSecretConfig: %v", s)
+		return nil, fmt.Errorf("not a serviceSecretConfig: %v", s)
 	}
 	m := map[any]any{}
 	for _, secret := range secrets {
@@ -100,7 +100,7 @@ func toServiceSecretConfigsMap(s any) (map[any]any, error) {
 func toServiceConfigObjConfigsMap(s any) (map[any]any, error) {
 	secrets, ok := s.([]types.ServiceConfigObjConfig)
 	if !ok {
-		return nil, errors.Errorf("not a serviceSecretConfig: %v", s)
+		return nil, fmt.Errorf("not a serviceSecretConfig: %v", s)
 	}
 	m := map[any]any{}
 	for _, secret := range secrets {
@@ -112,7 +112,7 @@ func toServiceConfigObjConfigsMap(s any) (map[any]any, error) {
 func toServicePortConfigsMap(s any) (map[any]any, error) {
 	ports, ok := s.([]types.ServicePortConfig)
 	if !ok {
-		return nil, errors.Errorf("not a servicePortConfig slice: %v", s)
+		return nil, fmt.Errorf("not a servicePortConfig slice: %v", s)
 	}
 	m := map[any]any{}
 	for _, p := range ports {
@@ -124,7 +124,7 @@ func toServicePortConfigsMap(s any) (map[any]any, error) {
 func toServiceVolumeConfigsMap(s any) (map[any]any, error) {
 	volumes, ok := s.([]types.ServiceVolumeConfig)
 	if !ok {
-		return nil, errors.Errorf("not a serviceVolumeConfig slice: %v", s)
+		return nil, fmt.Errorf("not a serviceVolumeConfig slice: %v", s)
 	}
 	m := map[any]any{}
 	for _, v := range volumes {
@@ -211,7 +211,7 @@ func mergeSlice(tomap tomapFn, writeValue writeValueFromMapFn) func(dst, src ref
 func sliceToMap(tomap tomapFn, v reflect.Value) (map[any]any, error) {
 	// check if valid
 	if !v.IsValid() {
-		return nil, errors.Errorf("invalid value : %+v", v)
+		return nil, fmt.Errorf("invalid value : %+v", v)
 	}
 	return tomap(v.Interface())
 }

cli/compose/schema/schema.go

@@ -11,7 +11,6 @@ import (
 	"time"
 
 	"github.com/docker/go-connections/nat"
-	"github.com/pkg/errors"
 	"github.com/xeipuuv/gojsonschema"
 )
 
@@ -80,7 +79,7 @@ func Validate(config map[string]any, version string) error {
 	version = normalizeVersion(version)
 	schemaData, err := schemas.ReadFile("data/config_schema_v" + version + ".json")
 	if err != nil {
-		return errors.Errorf("unsupported Compose file version: %s", version)
+		return fmt.Errorf("unsupported Compose file version: %s", version)
 	}
 
 	schemaLoader := gojsonschema.NewStringLoader(string(schemaData))

cli/config/config.go

@@ -13,7 +13,6 @@ import (
 	"github.com/docker/cli/cli/config/configfile"
 	"github.com/docker/cli/cli/config/credentials"
 	"github.com/docker/cli/cli/config/types"
-	"github.com/pkg/errors"
 )
 
 const (
@@ -101,7 +100,7 @@ func SetDir(dir string) {
 func Path(p ...string) (string, error) {
 	path := filepath.Join(append([]string{Dir()}, p...)...)
 	if !strings.HasPrefix(path, Dir()+string(filepath.Separator)) {
-		return "", errors.Errorf("path %q is outside of root config directory %q", path, Dir())
+		return "", fmt.Errorf("path %q is outside of root config directory %q", path, Dir())
 	}
 	return path, nil
 }
@@ -143,12 +142,12 @@ func load(configDir string) (*configfile.ConfigFile, error) {
 			return configFile, nil
 		}
 		// Any other error happening when failing to read the file must be returned.
-		return configFile, errors.Wrap(err, "loading config file")
+		return configFile, fmt.Errorf("loading config file: %w", err)
 	}
-	defer file.Close()
+	defer func() { _ = file.Close() }()
 	err = configFile.LoadFromReader(file)
 	if err != nil {
-		err = errors.Wrapf(err, "parsing config file (%s)", filename)
+		err = fmt.Errorf("parsing config file (%s): %w", filename, err)
 	}
 	return configFile, err
 }

cli/config/configfile/file.go

@@ -3,6 +3,7 @@ package configfile
 import (
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -12,7 +13,6 @@ import (
 	"github.com/docker/cli/cli/config/credentials"
 	"github.com/docker/cli/cli/config/memorystore"
 	"github.com/docker/cli/cli/config/types"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -167,7 +167,7 @@ func (configFile *ConfigFile) SaveToWriter(writer io.Writer) error {
 // Save encodes and writes out all the authorization information
 func (configFile *ConfigFile) Save() (retErr error) {
 	if configFile.Filename == "" {
-		return errors.Errorf("Can't save config with empty filename")
+		return errors.New("can't save config with empty filename")
 	}
 
 	dir := filepath.Dir(configFile.Filename)
@@ -194,7 +194,7 @@ func (configFile *ConfigFile) Save() (retErr error) {
 	}
 
 	if err := temp.Close(); err != nil {
-		return errors.Wrap(err, "error closing temp file")
+		return fmt.Errorf("error closing temp file: %w", err)
 	}
 
 	// Handle situation where the configfile is a symlink, and allow for dangling symlinks
@@ -278,11 +278,11 @@ func decodeAuth(authStr string) (string, string, error) {
 		return "", "", err
 	}
 	if n > decLen {
-		return "", "", errors.Errorf("Something went wrong decoding auth config")
+		return "", "", errors.New("something went wrong decoding auth config")
 	}
 	userName, password, ok := strings.Cut(string(decoded), ":")
 	if !ok || userName == "" {
-		return "", "", errors.Errorf("Invalid auth configuration file")
+		return "", "", errors.New("invalid auth configuration file")
 	}
 	return userName, strings.Trim(password, "\x00"), nil
 }

cli/context/docker/load.go

@@ -4,6 +4,8 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
+	"errors"
+	"fmt"
 	"net"
 	"net/http"
 	"strings"
@@ -14,7 +16,6 @@ import (
 	"github.com/docker/cli/cli/context/store"
 	"github.com/docker/go-connections/tlsconfig"
 	"github.com/moby/moby/client"
-	"github.com/pkg/errors"
 )
 
 // EndpointMeta is a typed wrapper around a context-store generic endpoint describing
@@ -68,7 +69,7 @@ func (ep *Endpoint) tlsConfig() (*tls.Config, error) {
 
 		x509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes)
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to retrieve context tls info")
+			return nil, fmt.Errorf("failed to retrieve context tls info: %w", err)
 		}
 		tlsOpts = append(tlsOpts, func(cfg *tls.Config) {
 			cfg.Certificates = []tls.Certificate{x509cert}
@@ -160,7 +161,7 @@ func EndpointFromContext(metadata store.Metadata) (EndpointMeta, error) {
 	}
 	typed, ok := ep.(EndpointMeta)
 	if !ok {
-		return EndpointMeta{}, errors.Errorf("endpoint %q is not of type EndpointMeta", DockerEndpoint)
+		return EndpointMeta{}, fmt.Errorf("endpoint %q is not of type EndpointMeta", DockerEndpoint)
 	}
 	return typed, nil
 }

cli/context/tlsdata.go

@@ -1,10 +1,10 @@
 package context
 
 import (
+	"fmt"
 	"os"
 
 	"github.com/docker/cli/cli/context/store"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -45,14 +45,14 @@ func (data *TLSData) ToStoreTLSData() *store.EndpointTLSData {
 func LoadTLSData(s store.Reader, contextName, endpointName string) (*TLSData, error) {
 	tlsFiles, err := s.ListTLSFiles(contextName)
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to retrieve TLS files for context %q", contextName)
+		return nil, fmt.Errorf("failed to retrieve TLS files for context %q: %w", contextName, err)
 	}
 	if epTLSFiles, ok := tlsFiles[endpointName]; ok {
 		var tlsData TLSData
 		for _, f := range epTLSFiles {
 			data, err := s.GetTLSData(contextName, endpointName, f)
 			if err != nil {
-				return nil, errors.Wrapf(err, "failed to retrieve TLS data (%s) for context %q", f, contextName)
+				return nil, fmt.Errorf("failed to retrieve TLS data (%s) for context %q: %w", f, contextName, err)
 			}
 			switch f {
 			case caKey:

cli/manifest/store/store.go

@@ -2,6 +2,7 @@ package store
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -11,7 +12,6 @@ import (
 	"github.com/docker/distribution/manifest/manifestlist"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 )
 
 // Store manages local storage of image distribution manifests
@@ -72,7 +72,7 @@ func (*fsStore) getFromFilename(ref reference.Reference, filename string) (types
 			return types.ImageManifest{}, err
 		}
 		if dgst := digest.FromBytes(raw); dgst != manifestInfo.Digest {
-			return types.ImageManifest{}, errors.Errorf("invalid manifest file %v: image manifest digest mismatch (%v != %v)", filename, manifestInfo.Digest, dgst)
+			return types.ImageManifest{}, fmt.Errorf("invalid manifest file %v: image manifest digest mismatch (%v != %v)", filename, manifestInfo.Digest, dgst)
 		}
 		manifestInfo.ImageManifest.Descriptor = ocispec.Descriptor{
 			Digest:    manifestInfo.Digest,

cli/manifest/types/types.go

@@ -2,6 +2,7 @@ package types
 
 import (
 	"encoding/json"
+	"fmt"
 
 	"github.com/distribution/reference"
 	"github.com/docker/distribution"
@@ -10,7 +11,6 @@ import (
 	"github.com/docker/distribution/manifest/schema2"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 )
 
 // ImageManifest contains info to output for a manifest object.
@@ -82,7 +82,7 @@ func (i ImageManifest) Payload() (string, []byte, error) {
 	case i.OCIManifest != nil:
 		return i.OCIManifest.Payload()
 	default:
-		return "", nil, errors.Errorf("%s has no payload", i.Ref)
+		return "", nil, fmt.Errorf("%s has no payload", i.Ref)
 	}
 }
 
@@ -141,7 +141,7 @@ type SerializableNamed struct {
 func (s *SerializableNamed) UnmarshalJSON(b []byte) error {
 	var raw string
 	if err := json.Unmarshal(b, &raw); err != nil {
-		return errors.Wrapf(err, "invalid named reference bytes: %s", b)
+		return fmt.Errorf("invalid named reference bytes: %s: %w", b, err)
 	}
 	var err error
 	s.Named, err = reference.ParseNamed(raw)

cli/registry/client/client.go

@@ -12,7 +12,6 @@ import (
 	distributionclient "github.com/docker/distribution/registry/client"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/opencontainers/go-digest"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -83,9 +82,9 @@ func (c *client) MountBlob(ctx context.Context, sourceRef reference.Canonical, t
 		return nil
 	case nil:
 	default:
-		return errors.Wrapf(err, "failed to mount blob %s to %s", sourceRef, targetRef)
+		return fmt.Errorf("failed to mount blob %s to %s: %w", sourceRef, targetRef, err)
 	}
-	lu.Cancel(ctx)
+	_ = lu.Cancel(ctx)
 	logrus.Debugf("mount of blob %s created", sourceRef)
 	return ErrBlobCreated{From: sourceRef, Target: targetRef}
 }
@@ -115,7 +114,7 @@ func (c *client) PutManifest(ctx context.Context, ref reference.Named, manifest
 
 	dgst, err := manifestService.Put(ctx, manifest, opts...)
 	if err != nil {
-		return dgst, errors.Wrapf(err, "failed to put manifest %s", ref)
+		return dgst, fmt.Errorf("failed to put manifest %s: %w", ref, err)
 	}
 	return dgst, nil
 }
@@ -123,7 +122,7 @@ func (c *client) PutManifest(ctx context.Context, ref reference.Named, manifest
 func (c *client) getRepositoryForReference(ctx context.Context, ref reference.Named, repoEndpoint repositoryEndpoint) (distribution.Repository, error) {
 	repoName, err := reference.WithName(repoEndpoint.Name())
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to parse repo name from %s", ref)
+		return nil, fmt.Errorf("failed to parse repo name from %s: %w", ref, err)
 	}
 	httpTransport, err := c.getHTTPTransportForRepoEndpoint(ctx, repoEndpoint)
 	if err != nil {
@@ -154,7 +153,7 @@ func (c *client) getHTTPTransportForRepoEndpoint(ctx context.Context, repoEndpoi
 		repoEndpoint.actions,
 	)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to configure transport")
+		return nil, fmt.Errorf("failed to configure transport: %w", err)
 	}
 	return httpTransport, nil
 }
@@ -193,5 +192,5 @@ func getManifestOptionsFromReference(ref reference.Named) (digest.Digest, []dist
 	if digested, isDigested := ref.(reference.Canonical); isDigested {
 		return digested.Digest(), []distribution.ManifestServiceOption{}, nil
 	}
-	return "", nil, errors.Errorf("%s no tag or digest", ref)
+	return "", nil, fmt.Errorf("%s no tag or digest", ref)
 }

cli/registry/client/endpoint.go

@@ -2,6 +2,7 @@ package client
 
 import (
 	"context"
+	"fmt"
 	"net"
 	"net/http"
 	"net/url"
@@ -12,7 +13,6 @@ import (
 	"github.com/docker/distribution/registry/client/auth"
 	"github.com/docker/distribution/registry/client/transport"
 	registrytypes "github.com/moby/moby/api/types/registry"
-	"github.com/pkg/errors"
 )
 
 type repositoryEndpoint struct {
@@ -89,7 +89,7 @@ func getHTTPTransport(authConfig registrytypes.AuthConfig, endpoint registry.API
 	authTransport := transport.NewTransport(base, modifiers...)
 	challengeManager, err := registry.PingV2Registry(endpoint.URL, authTransport)
 	if err != nil {
-		return nil, errors.Wrap(err, "error pinging v2 registry")
+		return nil, fmt.Errorf("error pinging v2 registry: %w", err)
 	}
 	if authConfig.RegistryToken != "" {
 		passThruTokenHandler := &existingTokenHandler{token: authConfig.RegistryToken}

cli/registry/client/fetcher.go

@@ -3,6 +3,8 @@ package client
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 
 	"github.com/distribution/reference"
 	"github.com/docker/cli/cli/manifest/types"
@@ -16,7 +18,6 @@ import (
 	distclient "github.com/docker/distribution/registry/client"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -35,9 +36,9 @@ func fetchManifest(ctx context.Context, repo distribution.Repository, ref refere
 	case *ocischema.DeserializedManifest:
 		return pullManifestOCISchema(ctx, ref, repo, *v)
 	case *manifestlist.DeserializedManifestList:
-		return types.ImageManifest{}, errors.Errorf("%s is a manifest list", ref)
+		return types.ImageManifest{}, fmt.Errorf("%s is a manifest list", ref)
 	}
-	return types.ImageManifest{}, errors.Errorf("%s is not a manifest", ref)
+	return types.ImageManifest{}, fmt.Errorf("%s is not a manifest", ref)
 }
 
 func fetchList(ctx context.Context, repo distribution.Repository, ref reference.Named) ([]types.ImageManifest, error) {
@@ -50,7 +51,7 @@ func fetchList(ctx context.Context, repo distribution.Repository, ref reference.
 	case *manifestlist.DeserializedManifestList:
 		return pullManifestList(ctx, ref, repo, *v)
 	default:
-		return nil, errors.Errorf("unsupported manifest format: %v", v)
+		return nil, fmt.Errorf("unsupported manifest format: %v", v)
 	}
 }
 
@@ -62,7 +63,7 @@ func getManifest(ctx context.Context, repo distribution.Repository, ref referenc
 
 	dgst, opts, err := getManifestOptionsFromReference(ref)
 	if err != nil {
-		return nil, errors.Errorf("image manifest for %q does not exist", ref)
+		return nil, fmt.Errorf("image manifest for %q does not exist", ref)
 	}
 	return manSvc.Get(ctx, dgst, opts...)
 }
@@ -123,7 +124,7 @@ func pullManifestSchemaV2ImageConfig(ctx context.Context, dgst digest.Digest, re
 		return nil, err
 	}
 	if !verifier.Verified() {
-		return nil, errors.Errorf("image config verification failed for digest %s", dgst)
+		return nil, fmt.Errorf("image config verification failed for digest %s", dgst)
 	}
 	return configJSON, nil
 }
@@ -143,7 +144,7 @@ func validateManifestDigest(ref reference.Named, mfst distribution.Manifest) (oc
 
 	// If pull by digest, then verify the manifest digest.
 	if digested, isDigested := ref.(reference.Canonical); isDigested && digested.Digest() != desc.Digest {
-		return ocispec.Descriptor{}, errors.Errorf("manifest verification failed for digest %s", digested.Digest())
+		return ocispec.Descriptor{}, fmt.Errorf("manifest verification failed for digest %s", digested.Digest())
 	}
 
 	return desc, nil
@@ -179,7 +180,7 @@ func pullManifestList(ctx context.Context, ref reference.Named, repo distributio
 		case *ocischema.DeserializedManifest:
 			imageManifest, err = pullManifestOCISchema(ctx, manifestRef, repo, *v)
 		default:
-			err = errors.Errorf("unsupported manifest type: %T", manifest)
+			err = fmt.Errorf("unsupported manifest type: %T", manifest)
 		}
 		if err != nil {
 			return nil, err

cli/required.go

@@ -1,7 +1,8 @@
 package cli
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
+
 	"github.com/spf13/cobra"
 )
 
@@ -12,7 +13,7 @@ func NoArgs(cmd *cobra.Command, args []string) error {
 	}
 
 	if cmd.HasSubCommands() {
-		return errors.Errorf(
+		return fmt.Errorf(
 			"%[1]s: unknown command: %[2]s %[3]s\n\nUsage:  %[4]s\n\nRun '%[2]s --help' for more information",
 			binName(cmd),
 			cmd.CommandPath(),
@@ -21,7 +22,7 @@ func NoArgs(cmd *cobra.Command, args []string) error {
 		)
 	}
 
-	return errors.Errorf(
+	return fmt.Errorf(
 		"%[1]s: '%[2]s' accepts no arguments\n\nUsage:  %[3]s\n\nRun '%[2]s --help' for more information",
 		binName(cmd),
 		cmd.CommandPath(),
@@ -35,7 +36,7 @@ func RequiresMinArgs(minArgs int) cobra.PositionalArgs {
 		if len(args) >= minArgs {
 			return nil
 		}
-		return errors.Errorf(
+		return fmt.Errorf(
 			"%[1]s: '%[2]s' requires at least %[3]d %[4]s\n\nUsage:  %[5]s\n\nSee '%[2]s --help' for more information",
 			binName(cmd),
 			cmd.CommandPath(),
@@ -52,8 +53,8 @@ func RequiresMaxArgs(maxArgs int) cobra.PositionalArgs {
 		if len(args) <= maxArgs {
 			return nil
 		}
-		return errors.Errorf(
-			"%[1]s: '%[2]s' requires at most %[3]d %[4]s\n\nUsage:  %[5]s\n\nSRun '%[2]s --help' for more information",
+		return fmt.Errorf(
+			"%[1]s: '%[2]s' requires at most %[3]d %[4]s\n\nUsage:  %[5]s\n\nRun '%[2]s --help' for more information",
 			binName(cmd),
 			cmd.CommandPath(),
 			maxArgs,
@@ -69,7 +70,7 @@ func RequiresRangeArgs(minArgs int, maxArgs int) cobra.PositionalArgs {
 		if len(args) >= minArgs && len(args) <= maxArgs {
 			return nil
 		}
-		return errors.Errorf(
+		return fmt.Errorf(
 			"%[1]s: '%[2]s' requires at least %[3]d and at most %[4]d %[5]s\n\nUsage:  %[6]s\n\nRun '%[2]s --help' for more information",
 			binName(cmd),
 			cmd.CommandPath(),
@@ -87,7 +88,7 @@ func ExactArgs(number int) cobra.PositionalArgs {
 		if len(args) == number {
 			return nil
 		}
-		return errors.Errorf(
+		return fmt.Errorf(
 			"%[1]s: '%[2]s' requires %[3]d %[4]s\n\nUsage:  %[5]s\n\nRun '%[2]s --help' for more information",
 			binName(cmd),
 			cmd.CommandPath(),

cli/trust/trust.go

@@ -3,6 +3,8 @@ package trust
 import (
 	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -21,7 +23,6 @@ import (
 	"github.com/docker/go-connections/tlsconfig"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/opencontainers/go-digest"
-	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/theupdateframework/notary"
 	"github.com/theupdateframework/notary/client"
@@ -67,7 +68,7 @@ func Server(index *registrytypes.IndexInfo) (string, error) {
 	if s := os.Getenv("DOCKER_CONTENT_TRUST_SERVER"); s != "" {
 		urlObj, err := url.Parse(s)
 		if err != nil || urlObj.Scheme != "https" {
-			return "", errors.Errorf("valid https URL required for trust server, got %s", s)
+			return "", fmt.Errorf("valid https URL required for trust server, got %s", s)
 		}
 
 		return s, nil
@@ -212,27 +213,27 @@ func NotaryError(repoName string, err error) error {
 	switch err.(type) {
 	case *json.SyntaxError:
 		logrus.Debugf("Notary syntax error: %s", err)
-		return errors.Errorf("Error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address?", repoName)
+		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
 	case signed.ErrExpired:
-		return errors.Errorf("Error: remote repository %s out-of-date: %v", repoName, err)
+		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
 	case trustmanager.ErrKeyNotFound:
-		return errors.Errorf("Error: signing keys for remote repository %s not found: %v", repoName, err)
+		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
 	case storage.NetworkError:
-		return errors.Errorf("Error: error contacting notary server: %v", err)
+		return fmt.Errorf("error: error contacting notary server: %v", err)
 	case storage.ErrMetaNotFound:
-		return errors.Errorf("Error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
+		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
 	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
-		return errors.Errorf("Warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
+		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
 	case signed.ErrNoKeys:
-		return errors.Errorf("Error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
+		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
 	case signed.ErrLowVersion:
-		return errors.Errorf("Warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
+		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
 	case signed.ErrRoleThreshold:
-		return errors.Errorf("Warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
+		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
 	case client.ErrRepositoryNotExist:
-		return errors.Errorf("Error: remote trust data does not exist for %s: %v", repoName, err)
+		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)
 	case signed.ErrInsufficientSignatures:
-		return errors.Errorf("Error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)
+		return fmt.Errorf("error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)
 	}
 
 	return err
@@ -293,7 +294,7 @@ func GetSignableRoles(repo client.Repository, target *client.Target) ([]data.Rol
 	}
 
 	if len(signableRoles) == 0 {
-		return signableRoles, errors.Errorf("no valid signing keys for delegation roles")
+		return signableRoles, errors.New("no valid signing keys for delegation roles")
 	}
 
 	return signableRoles, nil

cli/trust/trust_push.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"sort"
@@ -14,7 +15,6 @@ import (
 	"github.com/moby/moby/api/types"
 	registrytypes "github.com/moby/moby/api/types/registry"
 	"github.com/opencontainers/go-digest"
-	"github.com/pkg/errors"
 	"github.com/theupdateframework/notary/client"
 	"github.com/theupdateframework/notary/tuf/data"
 )
@@ -82,18 +82,18 @@ func PushTrustedReference(ctx context.Context, ioStreams Streams, repoInfo *Repo
 	}
 
 	if cnt > 1 {
-		return errors.Errorf("internal error: only one call to handleTarget expected")
+		return errors.New("internal error: only one call to handleTarget expected")
 	}
 
 	if notaryTarget == nil {
-		return errors.Errorf("no targets found, provide a specific tag in order to sign it")
+		return errors.New("no targets found, provide a specific tag in order to sign it")
 	}
 
 	_, _ = fmt.Fprintln(ioStreams.Out(), "Signing and pushing trust metadata")
 
 	repo, err := GetNotaryRepository(ioStreams.In(), ioStreams.Out(), userAgent, repoInfo, &authConfig, "push", "pull")
 	if err != nil {
-		return errors.Wrap(err, "error establishing connection to trust repository")
+		return fmt.Errorf("error establishing connection to trust repository: %w", err)
 	}
 
 	// get the latest repository metadata so we can figure out which roles to sign
@@ -133,7 +133,7 @@ func PushTrustedReference(ctx context.Context, ioStreams Streams, repoInfo *Repo
 	}
 
 	if err != nil {
-		err = errors.Wrapf(err, "failed to sign %s:%s", repoInfo.Name.Name(), tag)
+		err = fmt.Errorf("failed to sign %s:%s: %w", repoInfo.Name.Name(), tag, err)
 		return NotaryError(repoInfo.Name.Name(), err)
 	}
 

e2e/cli-plugins/flags_test.go

@@ -93,7 +93,7 @@ func TestGlobalArgsOnlyParsedOnce(t *testing.T) {
 			args:             []string{"-H", dh, "-H", dh, "version", "-f", "{{.Client.Version}}"},
 			expectedExitCode: 1,
 			expectedOut:      icmd.None,
-			expectedErr:      "Specify only one -H",
+			expectedErr:      "specify only one -H",
 		},
 		{
 			name:             "builtin",

internal/volumespec/volumespec.go

@@ -1,12 +1,13 @@
 package volumespec
 
 import (
+	"errors"
+	"fmt"
 	"strings"
 	"unicode"
 	"unicode/utf8"
 
 	"github.com/moby/moby/api/types/mount"
-	"github.com/pkg/errors"
 )
 
 const endOfSpec = rune(0)
@@ -24,7 +25,7 @@ func Parse(spec string) (VolumeConfig, error) {
 		return volume, nil
 	}
 
-	buffer := []rune{}
+	var buffer []rune
 	for _, char := range spec + string(endOfSpec) {
 		switch {
 		case isWindowsDrive(buffer, char):
@@ -32,7 +33,7 @@ func Parse(spec string) (VolumeConfig, error) {
 		case char == ':' || char == endOfSpec:
 			if err := populateFieldFromBuffer(char, buffer, &volume); err != nil {
 				populateType(&volume)
-				return volume, errors.Wrapf(err, "invalid spec: %s", spec)
+				return volume, fmt.Errorf("invalid spec: %s: %w", spec, err)
 			}
 			buffer = []rune{}
 		default: