build args in FROM do not work with content trust

Using the new ability to have build args work with the FROM line, discovered that this breaks builds with content trust, as something tries to parse the FROM line and fails:

whale:arg justin$ cat Dockerfile 
ARG BASE=alpine:3.6
FROM $BASE
RUN cat /etc/alpine-release
RUN uname -a

whale:arg justin$ docker build --no-cache --build-arg BASE=alpine:3.5 .
Sending build context to Docker daemon  2.048kB
Step 1/4 : ARG BASE=alpine:3.6
 ---> 
Step 2/4 : FROM $BASE
 ---> 074d602a59d7
Step 3/4 : RUN cat /etc/alpine-release
 ---> Running in cd34a02789c8
3.5.2
 ---> 919100690231
Removing intermediate container cd34a02789c8
Step 4/4 : RUN uname -a
 ---> Running in 32e20ce11a09
Linux 3009dd4da609 4.9.36-moby moby/moby#1 SMP Wed Jul 12 17:33:58 UTC 2017 x86_64 Linux
 ---> cd5da4524cea
Removing intermediate container 32e20ce11a09
Successfully built cd5da4524cea

whale:arg justin$ DOCKER_CONTENT_TRUST=1 docker build --no-cache --build-arg BASE=alpine:3.5 .
Sending build context to Docker daemon 

error during connect: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.30/build?buildargs=%7B%22BASE%22%3A%22alpine%3A3.5%22%7D&cachefrom=%5B%5D&cgroupparent=&cpuperiod=0&cpuquota=0&cpusetcpus=&cpusetmems=&cpushares=0&dockerfile=Dockerfile&labels=%7B%7D&memory=0&memswap=0&networkmode=default&nocache=1&rm=1&shmsize=0&target=&ulimits=null: invalid reference format: repository name must be lowercase

Client:
 Version:      17.06.0-ce
 API version:  1.30
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:31:53 2017
 OS/Arch:      darwin/amd64

Server:
 Version:      17.06.0-ce
 API version:  1.30 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   02c1d87
 Built:        Fri Jun 23 21:51:55 2017
 OS/Arch:      linux/amd64
 Experimental: true

Containers: 108
 Running: 0
 Paused: 0
 Stopped: 108
Images: 637
Server Version: 17.06.0-ce
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins: 
 Volume: local
 Network: bridge host ipvlan macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: cfb82a876ecc11b5ca0977d1733adbe58599088a
runc version: 2d41c047c83e09a6d61d464906feb2a2f3c52aa4
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.9.36-moby
Operating System: Alpine Linux v3.5
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 1.952GiB
Name: moby
ID: 62QR:HC6P:CL3A:X2OU:VT2R:D4OH:K7PC:W2TG:X6JP:OFZE:PJKA:F2D3
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 18
 Goroutines: 30
 System Time: 2017-07-20T07:29:32.514762657Z
 EventsListeners: 1
No Proxy: *.local, 169.254/16
Registry: https://index.docker.io/v1/
Experimental: true
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

Start by reproducing the failure with the shown Dockerfile, docker build command, and DOCKER_CONTENT_TRUST=1. Trace how the FROM instruction with a build argument is parsed during content-trust builds; done means the build completes successfully with the substituted base image while content trust remains enabled.