code: func TrustedReference(ctx context.Context, cli command.Cli, ref reference.NamedTagged, rs registry.Service) (reference.Canonical, error) {
  	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, rs, AuthResolver(cli), ref.String())
  	if err != nil {
  		return nil, err
  	}
  
  	notaryRepo, err := cli.NotaryClient(imgRefAndAuth, []string{"pull"})
  	if err != nil {
  		return nil, errors.Wrap(err, "error establishing connection to trust repository")
  	}
  
  	t, err := notaryRepo.GetTargetByName(ref.Tag(), trust.ReleasesRole, data.CanonicalTargetsRole)
  	if err != nil {
  		return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), err)
  	}
  	// Only list tags in the top level targets role or the releases delegation role - ignore
  	// all other delegation roles
  	if t.Role != trust.ReleasesRole && t.Role != data.CanonicalTargetsRole {
  		return nil, trust.NotaryError(imgRefAndAuth.RepoInfo().Name.Name(), client.ErrNoSuchTarget(ref.Tag()))
  	}
  	r, err := convertTarget(t.Target)
  	if err != nil {
  		return nil, err
  
  	}
  	return reference.WithDigest(reference.TrimNamed(ref), r.digest)
  }
docs: // TrustedReference returns the canonical trusted reference for an image reference