{"record":{"id":"18f548534b760e99","repo":"docker/cli","slug":"error-remote-trust-data-does-not-exist-for-s-v","errorCode":null,"errorMessage":"error: remote trust data does not exist for %s: %v","messagePattern":"error: remote trust data does not exist for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":254,"sourceCode":"\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err\n\t}\n}\n\n// AddToAllSignableRoles attempts to add the image target to all the top level\n// delegation roles we can (based on whether we have the signing key and whether\n// the role's path allows us to).\n//\n// If there are no delegation roles, we add to the targets role.\nfunc AddToAllSignableRoles(repo client.Repository, target *client.Target) error {\n\tsignableRoles, err := GetSignableRoles(repo, target)\n\tif err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L236-L272","documentation":"Returned by NotaryError for client.ErrRepositoryNotExist (trust.go:253-254). The notary server responded that there is no trust repository (no root.json / metadata) for the given GUN at all. This differs from missing targets: the repository itself was never initialized on the server.","triggerScenarios":"Calling ListTargets/GetAllTargetMetadataByName/ListRoles/lookupTrustInfo against a GUN that has never had a trusted push (so the notary server has no metadata for it); pointing at the wrong notary server (e.g. DOCKER_CONTENT_TRUST_SERVER set to a server that does not host this repo); querying an image whose name/registry resolves to a different GUN than expected.","commonSituations":"Running 'docker trust inspect' or 'docker trust view' on an image that was pushed without DOCKER_CONTENT_TRUST; querying a private registry whose notary server is separate and not configured; typo in repository name or registry hostname producing a different GUN; image lives on Docker Hub but DOCKER_CONTENT_TRUST_SERVER points to a self-hosted notary.","solutions":["Confirm the image was pushed with content trust enabled: perform a trusted push (DOCKER_CONTENT_TRUST=1 docker push <img>:<tag>) to initialize the notary repository.","Verify DOCKER_CONTENT_TRUST_SERVER points to the notary server that actually hosts the repo (default https://notary.docker.io for Docker Hub); correct the env var or unset it.","Double-check the repository name/registry spelling so the resolved GUN matches the one initialized on the server.","Ensure registry credentials have access; some notary servers return 'not exist' rather than 'forbidden' for unauthorized GUNs - re-auth with 'docker login'."],"exampleFix":"# before: repo never initialized on notary server\ndocker trust inspect myrepo/img:tag  # -> remote trust data does not exist\n# after: initialize via trusted push\nDOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag\ndocker trust inspect myrepo/img:tag","handlingStrategy":"validation","validationCode":"// Before inspecting, check whether the notary server has a repository for the GUN.\nfunc repoInitialized(repo client.Repository, gun string) error {\n    if _, err := repo.ListTargets(); err != nil {\n        if _, ok := err.(client.ErrRepositoryNotExist); ok {\n            return fmt.Errorf(\"%s has no trust data; push with DOCKER_CONTENT_TRUST=1 first\", gun)\n        }\n        return trust.NotaryError(gun, err)\n    }\n    return nil\n}","typeGuard":"func isRepoNotExist(err error) bool {\n    if err == nil {\n        return false\n    }\n    _, ok := err.(client.ErrRepositoryNotExist)\n    return ok\n}","tryCatchPattern":"if _, err := repo.ListTargets(); err != nil {\n    if _, ok := err.(client.ErrRepositoryNotExist); ok {\n        // Not an error in all flows: report that the repo is unsigned.\n        return nil\n    }\n    return trust.NotaryError(gun, err)\n}","preventionTips":["Ensure a trusted push (DOCKER_CONTENT_TRUST=1) has initialized the repo before running inspect/view commands.","Validate the resolved GUN (registry + repo path) matches what was trust-pushed.","Confirm DOCKER_CONTENT_TRUST_SERVER targets the server hosting the repo's metadata.","In CI, separate the trust-init push from subsequent inspect steps."],"tags":["docker","notary","content-trust","repository-not-found","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}