@@ -5433,7 +5433,7 @@ func (s *DockerTrustSuite) TestTrustedBuild(c *check.C) {

 	name := "testtrustedbuild"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

+	trustedExecCmd(buildCmd)

 	out, _, err := runCommandWithOutput(buildCmd)

 	if err != nil {

 		c.Fatalf("Error running trusted build: %s\n%s", err, out)

@@ -5464,7 +5464,7 @@ func (s *DockerTrustSuite) TestTrustedBuildUntrustedTag(c *check.C) {

 	name := "testtrustedbuilduntrustedtag"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

+	trustedExecCmd(buildCmd)

 	out, _, err := runCommandWithOutput(buildCmd)

 	if err == nil {

 		c.Fatalf("Expected error on trusted build with untrusted tag: %s\n%s", err, out)

@@ -5527,10 +5527,7 @@ func (s *DockerTrustSuite) TestTrustedBuildTagFromReleasesRole(c *check.C) {

 	otherTag := fmt.Sprintf("%s:other", repoName)

 	dockerCmd(c, "tag", "busybox", otherTag)

-	pushCmd := exec.Command(dockerBinary, "push", otherTag)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil, check.Commentf("Trusted push failed: %s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", otherTag), trustedCmd).Assert(c, icmd.Success)

 	s.assertTargetInRoles(c, repoName, "other", "targets/releases")

 	s.assertTargetNotInRoles(c, repoName, "other", "targets")

@@ -5545,8 +5542,8 @@ func (s *DockerTrustSuite) TestTrustedBuildTagFromReleasesRole(c *check.C) {

 	name := "testtrustedbuildreleasesrole"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

-	out, _, err = runCommandWithOutput(buildCmd)

+	trustedExecCmd(buildCmd)

+	out, _, err := runCommandWithOutput(buildCmd)

 	c.Assert(err, check.IsNil, check.Commentf("Trusted build failed: %s", out))

 	c.Assert(out, checker.Contains, fmt.Sprintf("FROM %s@sha", repoName))

 }

@@ -5566,10 +5563,7 @@ func (s *DockerTrustSuite) TestTrustedBuildTagIgnoresOtherDelegationRoles(c *che

 	otherTag := fmt.Sprintf("%s:other", repoName)

 	dockerCmd(c, "tag", "busybox", otherTag)

-	pushCmd := exec.Command(dockerBinary, "push", otherTag)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil, check.Commentf("Trusted push failed: %s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", otherTag), trustedCmd).Assert(c, icmd.Success)

 	s.assertTargetInRoles(c, repoName, "other", "targets/other")

 	s.assertTargetNotInRoles(c, repoName, "other", "targets")

@@ -5584,8 +5578,8 @@ func (s *DockerTrustSuite) TestTrustedBuildTagIgnoresOtherDelegationRoles(c *che

 	name := "testtrustedbuildotherrole"

 	buildCmd := buildImageCmd(name, dockerFile, true)

-	s.trustedCmd(buildCmd)

-	out, _, err = runCommandWithOutput(buildCmd)

+	trustedExecCmd(buildCmd)

+	out, _, err := runCommandWithOutput(buildCmd)

 	c.Assert(err, check.NotNil, check.Commentf("Trusted build expected to fail: %s", out))

 }

@@ -103,7 +103,7 @@ func (s *DockerSuite) TestBuildAddChangeOwnership(c *check.C) {

 		icmd.RunCmd(icmd.Cmd{

 			Command: []string{"chown", "daemon:daemon", "foo"},

-			Dir: tmpDir,

+			Dir:     tmpDir,

 		}).Assert(c, icmd.Success)

 		if err := ioutil.WriteFile(filepath.Join(tmpDir, "Dockerfile"), []byte(dockerfile), 0644); err != nil {

@@ -5,15 +5,14 @@ import (

 	"net/http"

 	"net/http/httptest"

 	"os"

-	"os/exec"

 	"path/filepath"

 	"runtime"

 	"github.com/docker/docker/api"

 	"github.com/docker/docker/dockerversion"

 	"github.com/docker/docker/integration-cli/checker"

-	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/docker/pkg/homedir"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -53,7 +52,10 @@ func (s *DockerSuite) TestConfigHTTPHeader(c *check.C) {

 	c.Assert(err, checker.IsNil)

 	result := icmd.RunCommand(dockerBinary, "-H="+server.URL[7:], "ps")

-	result.Assert(c, icmd.Success)

+	result.Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

+	})

 	c.Assert(headers["User-Agent"], checker.NotNil, check.Commentf("Missing User-Agent"))

@@ -73,9 +75,9 @@ func (s *DockerSuite) TestConfigDir(c *check.C) {

 	dockerCmd(c, "--config", cDir, "ps")

 	// Test with env var too

-	icmd.RunCmd(icm.Cmd{

+	icmd.RunCmd(icmd.Cmd{

 		Command: []string{dockerBinary, "ps"},

-		Env: appendBaseEnv(true, "DOCKER_CONFIG="+cDir),

+		Env:     appendBaseEnv(true, "DOCKER_CONFIG="+cDir),

 	}).Assert(c, icmd.Success)

 	// Start a server so we can check to see if the config file was

@@ -100,36 +102,37 @@ func (s *DockerSuite) TestConfigDir(c *check.C) {

 	env := appendBaseEnv(false)

 	icmd.RunCmd(icmd.Cmd{

-		Command: []string{dockerBinary, "--config", cDir, "-H="+server.URL[7:], "ps"},

-		Env: env,

-	}).Assert(c, icmd.Exepected{

-		Error: "exit status 1",

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     env,

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

 	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps3 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps3 - Missing header"))

 	// Reset headers and try again using env var this time

 	headers = map[string][]string{}

 	icmd.RunCmd(icmd.Cmd{

-		Command: []string{dockerBinary, "--config", cDir, "-H="+server.URL[7:], "ps"},

-		Env: append(env, "DOCKER_CONFIG="+cDir),

-	}).Assert(c, icmd.Exepected{

-		Error: "exit status 1",

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG="+cDir),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

 	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps4 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps4 - Missing header"))

 	// FIXME(vdemeester) should be a unit test

 	// Reset headers and make sure flag overrides the env var

 	headers = map[string][]string{}

 	icmd.RunCmd(icmd.Cmd{

-		Command: []string{dockerBinary, "--config", cDir, "-H="+server.URL[7:], "ps"},

-		Env: append(env, "DOCKER_CONFIG=MissingDir"),

-	}).Assert(c, icmd.Exepected{

-		Error: "exit status 1",

+		Command: []string{dockerBinary, "--config", cDir, "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG=MissingDir"),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

 	})

 	c.Assert(headers["Myheader"], checker.NotNil)

-	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps5 - Missing header,out:%v", out))

+	c.Assert(headers["Myheader"][0], checker.Equals, "MyValue", check.Commentf("ps5 - Missing header"))

 	// FIXME(vdemeester) should be a unit test

 	// Reset headers and make sure flag overrides the env var.

@@ -137,11 +140,12 @@ func (s *DockerSuite) TestConfigDir(c *check.C) {

 	// ignore - we don't want to default back to the env var.

 	headers = map[string][]string{}

 	icmd.RunCmd(icmd.Cmd{

-		Command: []string{dockerBinary, "--config", "MissingDir", "-H="+server.URL[7:], "ps"},

-		Env: append(env, "DOCKER_CONFIG="+cDir),

-	}).Assert(c, icmd.Exepected{

-		Error: "exit status 1",

+		Command: []string{dockerBinary, "--config", "MissingDir", "-H=" + server.URL[7:], "ps"},

+		Env:     append(env, "DOCKER_CONFIG="+cDir),

+	}).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Error:    "exit status 1",

 	})

-	c.Assert(headers["Myheader"], checker.IsNil, check.Commentf("ps6 - Headers shouldn't be the expected value,out:%v", out))

+	c.Assert(headers["Myheader"], checker.IsNil, check.Commentf("ps6 - Headers shouldn't be the expected value"))

 }

@@ -3,18 +3,16 @@ package main

 import (

 	"encoding/json"

 	"fmt"

+	"io/ioutil"

 	"os"

 	"reflect"

 	"strings"

 	"time"

-	"os/exec"

-

-	"io/ioutil"

-

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/stringid"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/go-connections/nat"

 	"github.com/go-check/check"

 )

@@ -302,21 +300,12 @@ func (s *DockerTrustSuite) TestTrustedCreate(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-create")

 	// Try create

-	createCmd := exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 	// Try untrusted create to ensure we pushed the tag to the registry

-	createCmd = exec.Command(dockerBinary, "create", "--disable-content-trust=true", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create with --disable-content-trust:\n%s", out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", "--disable-content-trust=true", repoName), trustedCmd).Assert(c, SuccessDownloadedOnStderr)

 }

 func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

@@ -328,23 +317,17 @@ func (s *DockerTrustSuite) TestUntrustedCreate(c *check.C) {

 	dockerCmd(c, "rmi", withTagName)

 	// Try trusted create on untrusted tag

-	createCmd := exec.Command(dockerBinary, "create", withTagName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.Not(check.IsNil))

-	c.Assert(string(out), checker.Contains, fmt.Sprintf("does not have trust data for %s", repoName), check.Commentf("Missing expected output on trusted create:\n%s", out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", withTagName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      fmt.Sprintf("does not have trust data for %s", repoName),

+	})

 }

 func (s *DockerTrustSuite) TestTrustedIsolatedCreate(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-isolated-create")

 	// Try create

-	createCmd := exec.Command(dockerBinary, "--config", "/tmp/docker-isolated-create", "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err := runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", "/tmp/docker-isolated-create", "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 }

@@ -358,20 +341,19 @@ func (s *DockerTrustSuite) TestCreateWhenCertExpired(c *check.C) {

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try create

-		createCmd := exec.Command(dockerBinary, "create", repoName)

-		s.trustedCmd(createCmd)

-		out, _, err := runCommandWithOutput(createCmd)

-		c.Assert(err, check.Not(check.IsNil))

-		c.Assert(string(out), checker.Contains, "could not validate the path to a trusted root", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", out))

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{dockerBinary, "create", repoName},

+		}, trustedCmd).Assert(c, icmd.Expected{

+			ExitCode: 1,

+			Err:      "could not validate the path to a trusted root",

+		})

 	})

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try create

-		createCmd := exec.Command(dockerBinary, "create", "--disable-content-trust", repoName)

-		s.trustedCmd(createCmd)

-		out, _, err := runCommandWithOutput(createCmd)

-		c.Assert(err, check.Not(check.IsNil))

-		c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", out))

+		result := icmd.RunCmd(icmd.Command(dockerBinary, "create", "--disable-content-trust", repoName), trustedCmd)

+		c.Assert(result.Error, check.Not(check.IsNil))

+		c.Assert(string(result.Combined()), checker.Contains, "Status: Downloaded", check.Commentf("Missing expected output on trusted create in the distant future:\n%s", result.Combined()))

 	})

 }

@@ -384,20 +366,12 @@ func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	// tag the image and upload it to the private registry

 	dockerCmd(c, "tag", "busybox", repoName)

-	pushCmd := exec.Command(dockerBinary, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	dockerCmd(c, "rmi", repoName)

 	// Try create

-	createCmd := exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

@@ -411,23 +385,13 @@ func (s *DockerTrustSuite) TestTrustedCreateFromBadTrustServer(c *check.C) {

 	dockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)

 	// Push up to the new server

-	pushCmd = exec.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err = runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil)

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf("Missing expected output on trusted push:\n%s", out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	// Now, try creating with the original client from this new trust server. This should fail because the new root is invalid.

-	createCmd = exec.Command(dockerBinary, "create", repoName)

-	s.trustedCmd(createCmd)

-	out, _, err = runCommandWithOutput(createCmd)

-	if err == nil {

-		c.Fatalf("Continuing with cached data even though it's an invalid root rotation: %s\n%s", err, out)

-	}

-	if !strings.Contains(out, "could not rotate trust to a new trusted root") {

-		c.Fatalf("Missing expected output on trusted create:\n%s", out)

-	}

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "create", repoName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "could not rotate trust to a new trusted root",

+	})

 }

 func (s *DockerSuite) TestCreateStopSignal(c *check.C) {

@@ -4,14 +4,13 @@ package main

 import (

 	"os"

-	"os/exec"

 	"path/filepath"

 	"strings"

 	"syscall"

-	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/mount"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -153,7 +152,7 @@ func (s *DockerDaemonSuite) TestDaemonShutdownWithPlugins(c *check.C) {

 	icmd.RunCommand("pgrep", "-f", pluginProcessName).Assert(c, icmd.Expected{

 		ExitCode: 1,

-		Error: "exit status 1",

+		Error:    "exit status 1",

 	})

 	s.d.Start(c, "--live-restore")

@@ -1945,7 +1945,7 @@ func (s *DockerDaemonSuite) TestDaemonRestartWithKilledRunningContainer(t *check

 	}

 	// kill the container

-	icmd.RunCommand(ctrBinary, "--address", "unix:///var/run/docker/libcontainerd/docker-containerd.sock", "containers", "kill", cid).Assert(c, icmd.Success)

+	icmd.RunCommand(ctrBinary, "--address", "unix:///var/run/docker/libcontainerd/docker-containerd.sock", "containers", "kill", cid).Assert(t, icmd.Success)

 	// Give time to containerd to process the command if we don't

 	// the exit event might be received after we do the inspect

@@ -19,8 +19,8 @@ func (s *DockerSuite) TestExportContainerAndImportImage(c *check.C) {

 	out, _ := dockerCmd(c, "export", containerID)

 	result := icmd.RunCmd(icmd.Cmd{

-		Command: dockerBinary, "import", "-", "repo/testexp:v1",

-		Stdin: strings.NewReader(out),

+		Command: []string{dockerBinary, "import", "-", "repo/testexp:v1"},

+		Stdin:   strings.NewReader(out),

 	})

 	result.Assert(c, icmd.Success)

@@ -41,8 +41,8 @@ func (s *DockerSuite) TestExportContainerWithOutputAndImportImage(c *check.C) {

 	resultCat.Assert(c, icmd.Success)

 	result := icmd.RunCmd(icmd.Cmd{

-		Command: dockerBinary, "import", "-", "repo/testexp:v1",

-		Stdin: strings.NewReader(resultCat.Combined()),

+		Command: []string{dockerBinary, "import", "-", "repo/testexp:v1"},

+		Stdin:   strings.NewReader(resultCat.Combined()),

 	})

 	result.Assert(c, icmd.Success)

@@ -2,7 +2,6 @@ package main

 import (

 	"fmt"

-	"os/exec"

 	"runtime"

 	"strings"

 	"unicode"

@@ -54,8 +53,8 @@ func (s *DockerSuite) TestHelpTextVerify(c *check.C) {

 		// Check main help text to make sure its not over 80 chars

 		result := icmd.RunCmd(icmd.Cmd{

-			Command: []stirng{dockerBinary, "help"},

-			Env: newEnvs,

+			Command: []string{dockerBinary, "help"},

+			Env:     newEnvs,

 		})

 		result.Assert(c, icmd.Success)

 		lines := strings.Split(result.Combined(), "\n")

@@ -8,10 +8,10 @@ import (

 	"strings"

 	"time"

-	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/jsonlog"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -190,10 +190,10 @@ func (s *DockerSuite) TestLogsSince(c *check.C) {

 	// Test with default value specified and parameter omitted

 	expected := []string{"log1", "log2", "log3"}

 	for _, cmd := range [][]string{

-		[]string{dockerBinary, "logs", "-t", name},

-		[]string{dockerBinary, "logs", "-t", "--since=0", name},

+		{"logs", "-t", name},

+		{"logs", "-t", "--since=0", name},

 	} {

-		result := icmd.RunCommand(cmd...)

+		result := icmd.RunCommand(dockerBinary, cmd...)

 		result.Assert(c, icmd.Success)

 		for _, v := range expected {

 			c.Assert(result.Combined(), checker.Contains, v)

@@ -2,15 +2,14 @@ package main

 import (

 	"fmt"

-	"os/exec"

-

-	"github.com/docker/docker/integration-cli/checker"

-	"github.com/go-check/check"

-

 	"io/ioutil"

 	"os"

 	"path/filepath"

 	"strings"

+

+	"github.com/docker/docker/integration-cli/checker"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

+	"github.com/go-check/check"

 )

 var (

@@ -305,15 +304,11 @@ func (s *DockerTrustSuite) TestPluginTrustedInstall(c *check.C) {

 	trustedName := s.setupTrustedplugin(c, pNameWithTag, "trusted-plugin-install")

-	installCmd := exec.Command(dockerBinary, "plugin", "install", "--grant-all-permissions", trustedName)

-	s.trustedCmd(installCmd)

-	out, _, err := runCommandWithOutput(installCmd)

+	icmd.RunCmd(icmd.Command(dockerBinary, "plugin", "install", "--grant-all-permissions", trustedName), trustedCmd).Assert(c, icmd.Expected{

+		Out: trustedName,

+	})

-	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

-	c.Assert(err, checker.IsNil)

-	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

-

-	out, _, err = dockerCmdWithError("plugin", "ls")

+	out, _, err := dockerCmdWithError("plugin", "ls")

 	c.Assert(err, checker.IsNil)

 	c.Assert(out, checker.Contains, "true")

@@ -330,11 +325,7 @@ func (s *DockerTrustSuite) TestPluginTrustedInstall(c *check.C) {

 	c.Assert(strings.TrimSpace(out), checker.Contains, trustedName)

 	// Try untrusted pull to ensure we pushed the tag to the registry

-	installCmd = exec.Command(dockerBinary, "plugin", "install", "--disable-content-trust=true", "--grant-all-permissions", trustedName)

-	s.trustedCmd(installCmd)

-	out, _, err = runCommandWithOutput(installCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "plugin", "install", "--disable-content-trust=true", "--grant-all-permissions", trustedName), trustedCmd).Assert(c, SuccessDownloaded)

 	out, _, err = dockerCmdWithError("plugin", "ls")

 	c.Assert(err, checker.IsNil)

@@ -352,12 +343,10 @@ func (s *DockerTrustSuite) TestPluginUntrustedInstall(c *check.C) {

 	dockerCmd(c, "plugin", "rm", "-f", pluginName)

 	// Try trusted install on untrusted plugin

-	installCmd := exec.Command(dockerBinary, "plugin", "install", "--grant-all-permissions", pluginName)

-	s.trustedCmd(installCmd)

-	out, _, err := runCommandWithOutput(installCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Error: remote trust data does not exist", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "plugin", "install", "--grant-all-permissions", pluginName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Error: remote trust data does not exist",

+	})

 }

 func (s *DockerSuite) TestPluginIDPrefix(c *check.C) {

@@ -2,20 +2,19 @@ package main

 import (

 	"net"

-	"os/exec"

 	"strings"

-	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/docker/integration-cli/checker"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

 func (s *DockerSuite) TestCLIProxyDisableProxyUnixSock(c *check.C) {

 	testRequires(c, DaemonIsLinux, SameHostDaemon)

-	icmd.RunCmd(icm.Cmd{

+	icmd.RunCmd(icmd.Cmd{

 		Command: []string{dockerBinary, "info"},

-		Env: appendBaseEnv(false, "HTTP_PROXY=http://127.0.0.1:9999"),

+		Env:     appendBaseEnv(false, "HTTP_PROXY=http://127.0.0.1:9999"),

 	}).Assert(c, icmd.Success)

 }

@@ -42,11 +41,11 @@ func (s *DockerDaemonSuite) TestCLIProxyProxyTCPSock(c *check.C) {

 	icmd.RunCmd(icmd.Cmd{

 		Command: []string{dockerBinary, "info"},

-		Env: []string{"DOCKER_HOST=tcp://" + ip + ":2375", "HTTP_PROXY=127.0.0.1:9999"},

-	}).Assert(c, icmd.Expected{Error:"exit status 1", ExitCode: 1})

+		Env:     []string{"DOCKER_HOST=tcp://" + ip + ":2375", "HTTP_PROXY=127.0.0.1:9999"},

+	}).Assert(c, icmd.Expected{Error: "exit status 1", ExitCode: 1})

 	// Test with no_proxy

-	icmd.RunCommand(icmd.Cmd{

+	icmd.RunCmd(icmd.Cmd{

 		Command: []string{dockerBinary, "info"},

-		Env: []string{"DOCKER_HOST=tcp://" + ip + ":2375", "HTTP_PROXY=127.0.0.1:9999", "NO_PROXY="+ip},

+		Env:     []string{"DOCKER_HOST=tcp://" + ip + ":2375", "HTTP_PROXY=127.0.0.1:9999", "NO_PROXY=" + ip},

 	}).Assert(c, icmd.Success)

 }

@@ -5,18 +5,17 @@ import (

 	"fmt"

 	"io/ioutil"

 	"os"

-	"os/exec"

 	"path/filepath"

 	"runtime"

 	"strings"

 	"github.com/docker/distribution"

 	"github.com/docker/distribution/digest"

-	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/docker/distribution/manifest"

 	"github.com/docker/distribution/manifest/manifestlist"

 	"github.com/docker/distribution/manifest/schema2"

 	"github.com/docker/docker/integration-cli/checker"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -3,12 +3,11 @@ package main

 import (

 	"fmt"

 	"io/ioutil"

-	"os/exec"

-	"strings"

 	"time"

 	"github.com/docker/docker/integration-cli/checker"

 	"github.com/docker/docker/pkg/testutil"

+	icmd "github.com/docker/docker/pkg/testutil/cmd"

 	"github.com/go-check/check"

 )

@@ -16,33 +15,18 @@ func (s *DockerTrustSuite) TestTrustedPull(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-pull")

 	// Try pull

-	pullCmd := exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err := runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 	// Try untrusted pull to ensure we pushed the tag to the registry

-	pullCmd = exec.Command(dockerBinary, "pull", "--disable-content-trust=true", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", "--disable-content-trust=true", repoName), trustedCmd).Assert(c, SuccessDownloaded)

 }

 func (s *DockerTrustSuite) TestTrustedIsolatedPull(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-isolated-pull")

 	// Try pull (run from isolated directory without trust information)

-	pullCmd := exec.Command(dockerBinary, "--config", "/tmp/docker-isolated", "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err := runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(string(out)))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", "/tmp/docker-isolated", "pull", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 }

@@ -55,12 +39,10 @@ func (s *DockerTrustSuite) TestUntrustedPull(c *check.C) {

 	dockerCmd(c, "rmi", repoName)

 	// Try trusted pull on untrusted tag

-	pullCmd := exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err := runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Error: remote trust data does not exist", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "Error: remote trust data does not exist",

+	})

 }

 func (s *DockerTrustSuite) TestPullWhenCertExpired(c *check.C) {

@@ -72,22 +54,19 @@ func (s *DockerTrustSuite) TestPullWhenCertExpired(c *check.C) {

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try pull

-		pullCmd := exec.Command(dockerBinary, "pull", repoName)

-		s.trustedCmd(pullCmd)

-		out, _, err := runCommandWithOutput(pullCmd)

-

-		c.Assert(err, check.NotNil, check.Commentf(out))

-		c.Assert(string(out), checker.Contains, "could not validate the path to a trusted root", check.Commentf(out))

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{dockerBinary, "pull", repoName},

+		}, trustedCmd).Assert(c, icmd.Expected{

+			ExitCode: 1,

+			Err:      "could not validate the path to a trusted root",

+		})

 	})

 	testutil.RunAtDifferentDate(elevenYearsFromNow, func() {

 		// Try pull

-		pullCmd := exec.Command(dockerBinary, "pull", "--disable-content-trust", repoName)

-		s.trustedCmd(pullCmd)

-		out, _, err := runCommandWithOutput(pullCmd)

-

-		c.Assert(err, check.IsNil, check.Commentf(out))

-		c.Assert(string(out), checker.Contains, "Status: Downloaded", check.Commentf(out))

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{dockerBinary, "pull", "--disable-content-trust", repoName},

+		}, trustedCmd).Assert(c, SuccessDownloaded)

 	})

 }

@@ -101,21 +80,11 @@ func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {

 	// tag the image and upload it to the private registry

 	dockerCmd(c, "tag", "busybox", repoName)

-	pushCmd := exec.Command(dockerBinary, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	dockerCmd(c, "rmi", repoName)

 	// Try pull

-	pullCmd := exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 	// Kill the notary server, start a new "evil" one.

@@ -129,23 +98,13 @@ func (s *DockerTrustSuite) TestTrustedPullFromBadTrustServer(c *check.C) {

 	dockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)

 	// Push up to the new server

-	pushCmd = exec.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err = runCommandWithOutput(pushCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	// Now, try pulling with the original client from this new trust server. This should fail because the new root is invalid.

-	pullCmd = exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-	if err == nil {

-		c.Fatalf("Continuing with cached data even though it's an invalid root rotation: %s\n%s", err, out)

-	}

-	if !strings.Contains(out, "could not rotate trust to a new trusted root") {

-		c.Fatalf("Missing expected output on trusted pull:\n%s", out)

-	}

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "could not rotate trust to a new trusted root",

+	})

 }

 func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {

@@ -155,13 +114,7 @@ func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {

 	dockerCmd(c, "tag", "busybox", repoName)

 	// Push with default passphrases

-	pushCmd := exec.Command(dockerBinary, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Signing and pushing trust metadata", check.Commentf(out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

 	dockerCmd(c, "rmi", repoName)

 	// Snapshots last for three years. This should be expired

@@ -169,41 +122,28 @@ func (s *DockerTrustSuite) TestTrustedPullWithExpiredSnapshot(c *check.C) {

 	testutil.RunAtDifferentDate(fourYearsLater, func() {

 		// Try pull

-		pullCmd := exec.Command(dockerBinary, "pull", repoName)

-		s.trustedCmd(pullCmd)

-		out, _, err = runCommandWithOutput(pullCmd)

-

-		c.Assert(err, check.NotNil, check.Commentf("Missing expected error running trusted pull with expired snapshots"))

-		c.Assert(string(out), checker.Contains, "repository out-of-date", check.Commentf(out))

+		icmd.RunCmd(icmd.Cmd{

+			Command: []string{dockerBinary, "pull", repoName},

+		}, trustedCmd).Assert(c, icmd.Expected{

+			ExitCode: 1,

+			Err:      "repository out-of-date",

+		})

 	})

 }

 func (s *DockerTrustSuite) TestTrustedOfflinePull(c *check.C) {

 	repoName := s.setupTrustedImage(c, "trusted-offline-pull")

-	pullCmd := exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmdWithServer(pullCmd, "https://invalidnotaryserver")

-	out, _, err := runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.NotNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "error contacting notary server", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmdWithServer("https://invalidnotaryserver")).Assert(c, icmd.Expected{

+		ExitCode: 1,

+		Err:      "error contacting notary server",

+	})

 	// Do valid trusted pull to warm cache

-	pullCmd = exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))

-

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd).Assert(c, SuccessTagging)

 	dockerCmd(c, "rmi", repoName)

 	// Try pull again with invalid notary server, should use cache

-	pullCmd = exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmdWithServer(pullCmd, "https://invalidnotaryserver")

-	out, _, err = runCommandWithOutput(pullCmd)

-

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(string(out), checker.Contains, "Tagging", check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmdWithServer("https://invalidnotaryserver")).Assert(c, SuccessTagging)

 }

 func (s *DockerTrustSuite) TestTrustedPullDelete(c *check.C) {

@@ -214,29 +154,16 @@ func (s *DockerTrustSuite) TestTrustedPullDelete(c *check.C) {

                     CMD echo trustedpulldelete

                 `, true)

-	pushCmd := exec.Command(dockerBinary, "push", repoName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	if err != nil {

-		c.Fatalf("Error running trusted push: %s\n%s", err, out)

-	}

-	if !strings.Contains(string(out), "Signing and pushing trust metadata") {

-		c.Fatalf("Missing expected output on trusted push:\n%s", out)

-	}

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", repoName), trustedCmd).Assert(c, SuccessSigningAndPushing)

-	if out, status := dockerCmd(c, "rmi", repoName); status != 0 {

-		c.Fatalf("Error removing image %q\n%s", repoName, out)

-	}

+	dockerCmd(c, "rmi", repoName)

 	// Try pull

-	pullCmd := exec.Command(dockerBinary, "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

+	result := icmd.RunCmd(icmd.Command(dockerBinary, "pull", repoName), trustedCmd)

+	result.Assert(c, icmd.Success)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-

-	matches := digestRegex.FindStringSubmatch(out)

-	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", out))

+	matches := digestRegex.FindStringSubmatch(result.Combined())

+	c.Assert(matches, checker.HasLen, 2, check.Commentf("unable to parse digest from pull output: %s", result.Combined()))

 	pullDigest := matches[1]

 	imageID := inspectField(c, repoName, "Id")

@@ -263,18 +190,13 @@ func (s *DockerTrustSuite) TestTrustedPullReadsFromReleasesRole(c *check.C) {

 	// Push with targets first, initializing the repo

 	dockerCmd(c, "tag", "busybox", targetName)

-	pushCmd := exec.Command(dockerBinary, "push", targetName)

-	s.trustedCmd(pushCmd)

-	out, _, err := runCommandWithOutput(pushCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "push", targetName), trustedCmd).Assert(c, icmd.Success)

 	s.assertTargetInRoles(c, repoName, "latest", "targets")

 	// Try pull, check we retrieve from targets role

-	pullCmd := exec.Command(dockerBinary, "-D", "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(out, checker.Contains, "retrieving target for targets role")

+	icmd.RunCmd(icmd.Command(dockerBinary, "-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

+		Err: "retrieving target for targets role",

+	})

 	// Now we'll create the releases role, and try pushing and pulling

 	s.notaryCreateDelegation(c, repoName, "targets/releases", s.not.keys[0].Public)

@@ -283,31 +205,23 @@ func (s *DockerTrustSuite) TestTrustedPullReadsFromReleasesRole(c *check.C) {

 	// try a pull, check that we can still pull because we can still read the

 	// old tag in the targets role

-	pullCmd = exec.Command(dockerBinary, "-D", "pull", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

-	c.Assert(out, checker.Contains, "retrieving target for targets role")

+	icmd.RunCmd(icmd.Command(dockerBinary, "-D", "pull", repoName), trustedCmd).Assert(c, icmd.Expected{

+		Err: "retrieving target for targets role",

+	})

 	// try a pull -a, check that it succeeds because we can still pull from the

 	// targets role

-	pullCmd = exec.Command(dockerBinary, "-D", "pull", "-a", repoName)

-	s.trustedCmd(pullCmd)

-	out, _, err = runCommandWithOutput(pullCmd)

-	c.Assert(err, check.IsNil, check.Commentf(out))

+	icmd.RunCmd(icmd.Command(dockerBinary, "-D", "pull", "-a", repoName), trustedCmd).Assert(c, icmd.Success)