code: func replaceDockerfileForContentTrust(ctx context.Context, inputTarStream io.ReadCloser, dockerfileName string, translator translatorFunc, resolvedTags *[]*resolvedTag) io.ReadCloser {
  	pipeReader, pipeWriter := io.Pipe()
  	go func() {
  		tarReader := tar.NewReader(inputTarStream)
  		tarWriter := tar.NewWriter(pipeWriter)
  
  		defer inputTarStream.Close()
  
  		for {
  			hdr, err := tarReader.Next()
  			if err == io.EOF {
  				// Signals end of archive.
  				tarWriter.Close()
  				pipeWriter.Close()
  				return
  			}
  			if err != nil {
  				pipeWriter.CloseWithError(err)
  				return
  			}
  
  			content := io.Reader(tarReader)
  			if hdr.Name == dockerfileName {
  				// This entry is the Dockerfile. Since the tar archive was
  				// generated from a directory on the local filesystem, the
  				// Dockerfile will only appear once in the archive.
  				var newDockerfile []byte
  				newDockerfile, *resolvedTags, err = rewriteDockerfileFromForContentTrust(ctx, content, translator)
  				if err != nil {
  					pipeWriter.CloseWithError(err)
  					return
  				}
  				hdr.Size = int64(len(newDockerfile))
  				content = bytes.NewBuffer(newDockerfile)
  			}
  
  			if err := tarWriter.WriteHeader(hdr); err != nil {
  				pipeWriter.CloseWithError(err)
  				return
  			}
  
  			if _, err := io.Copy(tarWriter, content); err != nil {
  				pipeWriter.CloseWithError(err)
  				return
  			}
  		}
  	}()
  
  	return pipeReader
  }
docs: // replaceDockerfileForContentTrust wraps the given input tar archive stream and
  // uses the translator to replace the Dockerfile which uses a trusted reference.
  // Returns a new tar archive stream with the replaced Dockerfile.