Rotate secrets by mixing id and name result in target conflict

Mixing the secret id and name on service update command result in conflict. Using the old and new name for rotation worked as expected.

Command

docker service update nginx --secret-rm iz4fjkq1z6ka7zvrx48ifaetm --secret-add source=1578412904_ssl.example.com.key,target=/etc/ssl/ssl_example_com.key,mode=0400,uid=101,gid=101

Result:

Error response from daemon: rpc error: code = InvalidArgument desc = secret references '1578411222_ssl.example.com' and '1578412904_ssl.example.com' have a conflicting target: '/etc/ssl/ssl_example_com.key'

Info

Client:
Debug Mode: false

Server:
Containers: 18
Running: 5
Paused: 0
Stopped: 13
Images: 8
Server Version: 19.03.5
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: active
NodeID: wmxqdykl9u4ys9sxmsvp77srl
Is Manager: true
ClusterID: plm2ks55zk5atjrmx6v3p8spl
Managers: 2
Nodes: 2
Default Address Pool: 10.0.0.0/8
SubnetSize: 24
Data Path Port: 4789
Orchestration:
Task History Retention Limit: 5
Raft:
Snapshot Interval: 10000
Number of Old Snapshots to Retain: 0
Heartbeat Tick: 1
Election Tick: 10
Dispatcher:
Heartbeat Period: 5 seconds
CA Configuration:
Expiry Duration: 3 months
Force Rotate: 0
Autolock Managers: false
Root Rotation In Progress: false
Node Address: xxx.xxx.xxx.xxx
Manager Addresses:
xxx.xxx.xxx.xxx:2377
xxx.xxx.xxx.xxx:2377
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: b34a5c8af56e510852c35414db4c1f4fa6172339
runc version: 3e425f80a8c931f88e6d94a8c831b9d5aa481657
init version: fec3683
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.15.0-72-generic
Operating System: Ubuntu 18.04.3 LTS
OSType: linux
Architecture: x86_64
CPUs: 32
Total Memory: 125.8GiB
Name: docker1
ID: N2CL:JQZ6:3FKB:WFWX:WGNJ:GMBZ:FSCC:BQQA:ZJMW:5FQH:NC7R:ZZSP
Docker Root Dir: /var/lib/docker
Debug Mode: false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support
WARNING: Running Swarm in a two-manager configuration. This configuration provides
no fault tolerance, and poses a high risk to lose control over the cluster.
Refer to https://docs.docker.com/engine/swarm/admin_guide/ to configure the
Swarm for fault-tolerance.

Start at the Docker CLI service update command and reproduce the reported rotation using --secret-rm with --secret-add, mixing the secret ID and new name. Trace how secret references and target conflicts are validated; done means the mixed ID/name rotation succeeds without reporting a conflict for the shared target.