{"record":{"id":"1dbd2af4bfbe7935","repo":"docker/cli","slug":"failed-to-sign-s-s-w-1dbd2a","errorCode":null,"errorMessage":"failed to sign %s:%s: %w","messagePattern":"failed to sign (.+?):(.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/sign.go","lineNumber":129,"sourceCode":"\t\t}\n\t}\n\treturn signAndPublishToTarget(dockerCLI.Out(), imgRefAndAuth, notaryRepo, target)\n}\n\nfunc signAndPublishToTarget(out io.Writer, imgRefAndAuth trust.ImageRefAndAuth, notaryRepo notaryclient.Repository, target notaryclient.Target) error {\n\ttag := imgRefAndAuth.Tag()\n\t_, _ = fmt.Fprintln(out, \"Signing and pushing trust metadata for\", imgRefAndAuth.Name())\n\texistingSigInfo, err := getExistingSignatureInfoForReleasedTag(notaryRepo, tag)\n\tif err != nil {\n\t\treturn err\n\t}\n\terr = trust.AddToAllSignableRoles(notaryRepo, &target)\n\tif err == nil {\n\t\tprettyPrintExistingSignatureInfo(out, existingSigInfo)\n\t\terr = notaryRepo.Publish()\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to sign %s:%s: %w\", imgRefAndAuth.RepoInfo().Name.Name(), tag, err)\n\t}\n\t_, _ = fmt.Fprintf(out, \"Successfully signed %s:%s\\n\", imgRefAndAuth.RepoInfo().Name.Name(), tag)\n\treturn nil\n}\n\nfunc validateTag(imgRefAndAuth trust.ImageRefAndAuth) error {\n\ttag := imgRefAndAuth.Tag()\n\tif tag == \"\" {\n\t\tif imgRefAndAuth.Digest() != \"\" {\n\t\t\treturn errors.New(\"cannot use a digest reference for IMAGE:TAG\")\n\t\t}\n\t\treturn fmt.Errorf(\"no tag specified for %s\", imgRefAndAuth.Name())\n\t}\n\treturn nil\n}\n\nfunc checkLocalImageExistence(ctx context.Context, apiClient client.APIClient, imageName string) error {\n\t_, err := apiClient.ImageInspect(ctx, imageName)","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/sign.go#L111-L147","documentation":"Returned by `docker trust sign IMAGE:TAG` from signAndPublishToTarget() when either AddToAllSignableRoles() (adding the target to all signable delegation roles) or the subsequent notaryRepo.Publish() fails. The first %s is the repository name (imgRefAndAuth.RepoInfo().Name.Name()), the second %s is the tag, and %w is the underlying notary error.","triggerScenarios":"Running `docker trust sign <repo>:<tag>` where the local trust metadata is stale or conflicts with remote, the signer's delegation key is missing, the threshold for a delegation role cannot be met, or Publish() cannot push (network, auth, or metadata validation failure).","commonSituations":"Signing after pulling an image whose trust data was updated by another signer (metadata conflict); using a different machine than where the delegation keys live; registry notary service down or returning 4xx; clock skew between client and notary server breaking metadata expiry checks.","solutions":["Pull the latest trust metadata before signing: re-run `docker trust sign` after `docker pull <image>` to refresh local state.","Ensure the required delegation private key is present in ~/.docker/trust/private; import it if signing from a new host.","Confirm push auth with `docker login <registry>`.","Read the wrapped %w for the specific notary error (ErrInvalidRole, threshold-not-met, etc.) and address it (e.g. re-add the signer key).","If the trust repo is corrupted, rotate by re-initializing with the correct root key."],"exampleFix":"// before\n$ docker trust sign registry.example.com/app:v1\nError: failed to sign registry.example.com/app:v1: ...\n\n// after — load the delegation key on this host then re-sign\n$ docker trust key load --key alice.key\n$ docker trust sign registry.example.com/app:v1","handlingStrategy":"retry","validationCode":"// Pre-flight: ensure the local image exists and trust keys are present\n//   docker image inspect <image>            # local image exists\n//   ls ~/.docker/trust/private/*.key        # delegation key present\n//   docker trust inspect <image>:<tag>      # trust repo reachable","typeGuard":null,"tryCatchPattern":"// Signing can fail on stale metadata; pull then retry once\nfor attempt := 0; attempt < 2; attempt++ {\n    out, err := exec.CommandContext(ctx, \"docker\", \"trust\", \"sign\", ref).CombinedOutput()\n    if err == nil { break }\n    if attempt == 0 && strings.Contains(string(out), \"metadata\") {\n        _ = exec.CommandContext(ctx, \"docker\", \"pull\", ref).Run() // refresh\n        continue\n    }\n    return fmt.Errorf(\"sign failed: %s: %w\", out, err)\n}","preventionTips":["Pull the image immediately before signing to refresh local trust metadata.","Keep delegation private keys on the signing host under ~/.docker/trust/private.","Use the same host/key for repeated signs to avoid delegation conflicts."],"tags":["docker","trust","notary","signing","delegation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}