{"record":{"id":"1269cc48dad5fc76","repo":"docker/cli","slug":"key-name-s-must-start-with-lowercase-alphanumer","errorCode":null,"errorMessage":"key name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character","messagePattern":"key name \"(.+?)\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_generate.go","lineNumber":50,"sourceCode":"\t\tRunE: func(cmd *cobra.Command, args []string) error {\n\t\t\toptions.name = args[0]\n\t\t\treturn setupPassphraseAndGenerateKeys(dockerCLI, options)\n\t\t},\n\t\tDisableFlagsInUseLine: true,\n\t}\n\tflags := cmd.Flags()\n\tflags.StringVar(&options.directory, \"dir\", \"\", \"Directory to generate key in, defaults to current directory\")\n\treturn cmd\n}\n\n// key names can use lowercase alphanumeric + _ + - characters\nvar validKeyName = lazyregexp.New(`^[a-z0-9][a-z0-9\\_\\-]*$`).MatchString\n\n// validate that all of the key names are unique and are alphanumeric + _ + -\n// and that we do not already have public key files in the target dir on disk\nfunc validateKeyArgs(keyName string, targetDir string) error {\n\tif !validKeyName(keyName) {\n\t\treturn fmt.Errorf(\"key name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", keyName)\n\t}\n\n\tpubKeyFileName := keyName + \".pub\"\n\tif _, err := os.Stat(targetDir); err != nil {\n\t\treturn fmt.Errorf(\"public key path does not exist: \\\"%s\\\"\", targetDir)\n\t}\n\ttargetPath := filepath.Join(targetDir, pubKeyFileName)\n\tif _, err := os.Stat(targetPath); err == nil {\n\t\treturn fmt.Errorf(\"public key file already exists: \\\"%s\\\"\", targetPath)\n\t}\n\treturn nil\n}\n\nfunc setupPassphraseAndGenerateKeys(streams command.Streams, opts keyGenerateOptions) error {\n\ttargetDir := opts.directory\n\tif targetDir == \"\" {\n\t\tcwd, err := os.Getwd()\n\t\tif err != nil {","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_generate.go#L32-L68","documentation":"In validateKeyArgs (key_generate.go:48-51), the supplied key name fails the regex validKeyName (^[a-z0-9][a-z0-9_\\-]*$ defined at key_generate.go:44). Names must start with a lowercase alphanumeric character and may only contain lowercase alphanumeric, underscore, or hyphen thereafter. This validates input to 'docker trust key generate NAME'.","triggerScenarios":"Running 'docker trust key generate <NAME>' with a NAME that starts with an uppercase letter, digit-only is fine but leading special char is not, contains uppercase, spaces, dots, slashes, or other punctuation; empty name; name starting with '-' or '_'.","commonSituations":"User passes a human display name like 'ReleaseKey' or 'CI Signing' (uppercase/space); uses an email or domain like 'team@corp' (@ not allowed); copies a UUID with uppercase hex; uses a path-like name 'org/key'.","solutions":["Rename the key to match the pattern: lowercase letters/digits first, then optionally '-' or '_', e.g. 'release-key' or 'ci_signing'.","Strip disallowed characters (uppercase, spaces, dots, @) and convert to lowercase.","Ensure the name is non-empty and does not start with '-' or '_'."],"exampleFix":"# before\ndocker trust key generate ReleaseKey\n# after\ndocker trust key generate release-key","handlingStrategy":"validation","validationCode":"// Validate the key name matches the allowed pattern before invoking generate.\nvar validKeyName = regexp.MustCompile(`^[a-z0-9][a-z0-9\\_\\-]*$`).MatchString\n\nfunc validateKeyName(name string) error {\n    if !validKeyName(name) {\n        return fmt.Errorf(\"key name %q must start with lowercase alphanumeric and may contain '-' or '_'\", name)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if !validKeyName(name) {\n    return fmt.Errorf(\"key name %q must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", name)\n}","preventionTips":["Adopt a naming convention (kebab-case, lowercase) for trust key names.","Validate names in CI scripts before invoking 'docker trust key generate'.","Avoid spaces, uppercase, and punctuation in key names."],"tags":["docker","notary","content-trust","validation","key-naming","input-validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}