Flaky TestInstallWithContentTrust

Description

Getting a lot of failures of TestInstallWithContentTrust

=== FAIL: e2e/plugin TestInstallWithContentTrust (1.48s)
    trust_test.go:40: assertion failed: 
        Command:  docker plugin push registry:5000/plugin-content-trust
        ExitCode: 1
        Error:    exit status 1
        Stdout:   The push refers to repository [registry:5000/plugin-content-trust]
        6207f4171ee2: Preparing
        cbd48e118951: Preparing
        0b0e9ab4c1ec: Preparing
        6207f4171ee2: Preparing
        cbd48e118951: Preparing
        0b0e9ab4c1ec: Preparing
        
        Stderr:   error pushing plugin: failed to do request: Head "https://registry:5000/v2/plugin-content-trust/blobs/sha256:cbd48e1189511f7f177dc51c4a9418629b7b843809edb9d3803c60e44b7771fe": http: server gave HTTP response to HTTPS client
        
        
        Failures:
        ExitCode was 1 expected 0
        Expected stdout to contain "Signing and pushing trust metadata"
        Expected no error

DONE 130 tests, 1 skipped, 1 failure in 53.983s

Reproduce

CI fails

• https://github.com/docker/cli/actions/runs/13813775567/job/38641597677?pr=5927

Expected behavior

No response

docker version

Client:
 Version:           28.0.0-dev
 API version:       1.45 (downgraded from 1.48)
 Go version:        go1.23.7
 Git commit:        584d8df
 Built:             Wed Mar 12 14:25:57 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          26.1.4
  API version:      1.45 (minimum version 1.24)
  Go version:       go1.21.11
  Git commit:       de5c9cf
  Built:            Wed Jun  5 11:29:25 2024
  OS/Arch:          linux/amd64
  Experimental:     true
 containerd:
  Version:          v1.7.18
  GitCommit:        ae71819c4f5e67bb4d5ae76a6b735f29cc25774e
 runc:
  Version:          1.1.12
  GitCommit:        v1.1.12-0-g51d5e94
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

docker info

Client: Docker Engine - Community
   Version:    26.1.3
   Context:    default
   Debug Mode: false
   Plugins:
    buildx: Docker Buildx (Docker Inc.)
      Version:  v0.21.2
      Path:     /usr/libexec/docker/cli-plugins/docker-buildx
    compose: Docker Compose (Docker Inc.)
      Version:  v2.27.1
      Path:     /usr/libexec/docker/cli-plugins/docker-compose
  
  Server:
   Containers: 0
    Running: 0
    Paused: 0
    Stopped: 0
   Images: 0
   Server Version: 26.1.3
   Storage Driver: overlay2
    Backing Filesystem: extfs
    Supports d_type: true
    Using metacopy: false
    Native Overlay Diff: false
    userxattr: false
   Logging Driver: json-file
   Cgroup Driver: systemd
   Cgroup Version: 2
   Plugins:
    Volume: local
    Network: bridge host ipvlan macvlan null overlay
    Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
   Swarm: inactive
   Runtimes: io.containerd.runc.v2 runc
   Default Runtime: runc
   Init Binary: docker-init
   containerd version: bcc810d6b9066471b0b6fa75f557a15a1cbf31bb
   runc version: v1.2.4-0-g6c52b3f
   init version: de40ad0
   Security Options:
    apparmor
    seccomp
     Profile: builtin
    cgroupns
   Kernel Version: 6.8.0-1021-azure
   Operating System: Ubuntu 24.04.2 LTS
   OSType: linux
   Architecture: x86_64
   CPUs: 4
   Total Memory: 15.62GiB
   Name: fv-az1680-809
   ID: 037eeb9a-fa35-4bec-af2b-1b30adfbcf1e
   Docker Root Dir: /var/lib/docker
   Debug Mode: false
   Username: githubactions
   Experimental: true
   Insecure Registries:
    127.0.0.0/8
   Live Restore Enabled: false

Additional Info

No response

Start with e2e/plugin/trust_test.go, especially TestInstallWithContentTrust near the reported line, and inspect the CI run showing the registry request failure. Reproduce the test in CI or the local end-to-end environment and trace the registry protocol setup; done means the test passes reliably and no longer receives an HTTP response from an HTTPS client.