[errors] de-specialize Transient in favor of Tags.

tokenserver/appengine/impl/machinetoken/rpc_inspect_machine_token.go

 // Copyright 2016 The LUCI Authors. All rights reserved.
 // Use of this source code is governed under the Apache License, Version 2.0
 // that can be found in the LICENSE file.
 
 package machinetoken
 
 import (
         "fmt"
         "math/big"
 
         "golang.org/x/net/context"
         "google.golang.org/grpc"
         "google.golang.org/grpc/codes"
 
-        "github.com/luci/luci-go/common/errors"
+        "github.com/luci/luci-go/common/retry"
         "github.com/luci/luci-go/server/auth/signing"
 
         tokenserver "github.com/luci/luci-go/tokenserver/api"
         admin "github.com/luci/luci-go/tokenserver/api/admin/v1"
 
         "github.com/luci/luci-go/tokenserver/appengine/impl/certchecker"
         "github.com/luci/luci-go/tokenserver/appengine/impl/certconfig"
 )
 
 // InspectMachineTokenRPC implements Admin.InspectMachineToken API method.
@@ skipping 62 matching lines @@
                 return nil, grpc.Errorf(codes.Internal, "can't resolve ca_id to CA name - %s", err)
         case caName == "":
                 addReason("no CA with given ID")
                 return resp, nil
         }
         resp.CertCaName = caName
 
         // Grab CertChecker for this CA. It has CRL cached.
         certChecker, err := certchecker.GetCertChecker(c, caName)
         switch {
-        case errors.IsTransient(err):
+        case retry.Tag.In(err):
                 return nil, grpc.Errorf(codes.Internal, "can't fetch CRL - %s", err)
         case err != nil:
                 addReason(fmt.Sprintf("can't fetch CRL - %s", err))
                 return resp, nil
         }
 
         // Check that certificate SN is not in the revocation list.
         sn := big.NewInt(0).SetUint64(body.CertSn)
         revoked, err := certChecker.CRL.IsRevokedSN(c, sn)
         if err != nil {
                 return nil, grpc.Errorf(codes.Internal, "can't check CRL - %s", err)
         }
         resp.NonRevoked = !revoked
 
         // Note: if Signed or NonExpired is false, InvalidityReason is already set.
         if resp.Signed && resp.NonExpired {
                 if resp.NonRevoked {
                         resp.Valid = true
                 } else {
                         addReason("corresponding cert was revoked")
                 }
         }
 
         return resp, nil
 }