swarm/init: Fix --external-ca ignoring cacert option

[vvoland]

• related to: integration-cli: Update default CLI version to v18.06.3-ce moby/moby#49677 (comment)

- What I did
31d6292 mistakenly changed the ToSpec function to set all certs passed via external-ca to empty strings.

- How I did it

- How to verify it

• TestSwarmUpdate on in moby integration-cli
• TestSwarmInitWithExternalCA

Before:

$ go test -run TestSwarmInitWithExternalCA
--- FAIL: TestSwarmInitWithExternalCA (0.00s)
    init_test.go:143: assertion failed: 
        --- req.Spec.CAConfig.ExternalCAs[0].CACert
        +++ cert
        @@ -1 +1,13 @@
        -
        +
        +-----BEGIN CERTIFICATE-----
        +MIIBuDCCAV4CCQDOqUYOWdqMdjAKBggqhkjOPQQDAzBjMQswCQYDVQQGEwJVUzEL
        +MAkGA1UECAwCQ0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkRv
        +Y2tlcjEPMA0GA1UECwwGRG9ja2VyMQ0wCwYDVQQDDARUZXN0MCAXDTE4MDcwMjIx
        +MjkxOFoYDzMwMTcxMTAyMjEyOTE4WjBjMQswCQYDVQQGEwJVUzELMAkGA1UECAwC
        +Q0ExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDzANBgNVBAoMBkRvY2tlcjEPMA0G
        +A1UECwwGRG9ja2VyMQ0wCwYDVQQDDARUZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0D
        +AQcDQgAEgvvZl5Vqpr1e+g5IhoU6TZHgRau+BZETVFTmqyWYajA/mooRQ1MZTozu
        +s9ZZZA8tzUhIqS36gsFuyIZ4YiAlyjAKBggqhkjOPQQDAwNIADBFAiBQ7pCPQrj8
        +8zaItMf0pk8j1NU5XrFqFEZICzvjzUJQBAIhAKq2gFwoTn8KH+cAAXZpAGJPmOsT
        +zsBT8gBAOHhNA6/2
        +-----END CERTIFICATE-----
        
FAIL
exit status 1
FAIL	github.com/docker/cli/cli/command/swarm	0.381s

After

$ go test -run TestSwarmInitWithExternalCA 
PASS
ok  	github.com/docker/cli/cli/command/swarm	1.009

- Human readable description for the release notes

- Fix `docker swarm init` ignoring `cacert` option of `--external-ca` .

- A picture of a cute animal (not mandatory but encouraged)

[vvoland]

Am I wrong here, or has this been broken for 7 years and nobody noticed? 🤣

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 59.11%. Comparing base (6714b50) to head (6c2d023).
Report is 13 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5995      +/-   ##
==========================================
- Coverage   59.12%   59.11%   -0.02%     
==========================================
  Files         355      355              
  Lines       29740    29753      +13     
==========================================
+ Hits        17583    17587       +4     
- Misses      11182    11188       +6     
- Partials      975      978       +3     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[thaJeztah]

Am I wrong here, or has this been broken for 7 years and nobody noticed? 🤣

Oh, someone noticed,

• [WIP] Fix swarm init and swarm update test moby/moby#37442
• [WIP] [18.06] Fix CLI external-ca tests in swarm suite docker-archive/engine#23

(and there's a couple of, now archived, internal issues tracking it); ISTR there was a security-related issue attached at some point, and there was some discussion whether the feature had to be restored or removed, and that's where things got stuck.

[vvoland]

Actually this isn't the same issue - the PRs you mention deal with the first cert being empty instead of defaulting to the "Trusted CA Root".

This PR is about the second cert which the CLI doesn't even pass to the swarm.

[vvoland]

I'll leave it up to the Mirantis folks to decide what to do with this one.

cc @dperny @corhere

[Copilot]

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.