code: func rewriteDockerfileFromForContentTrust(ctx context.Context, dockerfile io.Reader, translator translatorFunc) (newDockerfile []byte, resolvedTags []*resolvedTag, err error) {
  	scanner := bufio.NewScanner(dockerfile)
  	buf := bytes.NewBuffer(nil)
  
  	// Scan the lines of the Dockerfile, looking for a "FROM" line.
  	for scanner.Scan() {
  		line := scanner.Text()
  
  		matches := dockerfileFromLinePattern.FindStringSubmatch(line)
  		if matches != nil && matches[1] != api.NoBaseImageSpecifier {
  			// Replace the line with a resolved "FROM repo@digest"
  			var ref reference.Named
  			ref, err = reference.ParseNormalizedNamed(matches[1])
  			if err != nil {
  				return nil, nil, err
  			}
  			ref = reference.TagNameOnly(ref)
  			if ref, ok := ref.(reference.NamedTagged); ok {
  				trustedRef, err := translator(ctx, ref)
  				if err != nil {
  					return nil, nil, err
  				}
  
  				line = dockerfileFromLinePattern.ReplaceAllLiteralString(line, fmt.Sprintf("FROM %s", reference.FamiliarString(trustedRef)))
  				resolvedTags = append(resolvedTags, &resolvedTag{
  					digestRef: trustedRef,
  					tagRef:    ref,
  				})
  			}
  		}
  
  		_, err := fmt.Fprintln(buf, line)
  		if err != nil {
  			return nil, nil, err
  		}
  	}
  
  	return buf.Bytes(), resolvedTags, scanner.Err()
  }
docs: // rewriteDockerfileFromForContentTrust rewrites the given Dockerfile by resolving images in
  // "FROM <image>" instructions to a digest reference. `translator` is a
  // function that takes a repository name and tag reference and returns a
  // trusted digest reference.
  // This should be called *only* when content trust is enabled