{"record":{"id":"2bd31ff6e6bac172","repo":"docker/cli","slug":"releases-is-a-reserved-keyword-use-a-different-si","errorCode":null,"errorMessage":"releases is a reserved keyword, use a different signer name","messagePattern":"releases is a reserved keyword, use a different signer name","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_add.go","lineNumber":56,"sourceCode":"\t\t\treturn addSigner(cmd.Context(), dockerCLI, options)\n\t\t},\n\t\tDisableFlagsInUseLine: true,\n\t}\n\tflags := cmd.Flags()\n\toptions.keys = opts.NewListOpts(nil)\n\tflags.Var(&options.keys, \"key\", \"Path to the signer's public key file\")\n\treturn cmd\n}\n\nvar validSignerName = lazyregexp.New(`^[a-z0-9][a-z0-9\\_\\-]*$`).MatchString\n\nfunc addSigner(ctx context.Context, dockerCLI command.Cli, options signerAddOptions) error {\n\tsignerName := options.signer\n\tif !validSignerName(signerName) {\n\t\treturn fmt.Errorf(\"signer name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", signerName)\n\t}\n\tif signerName == \"releases\" {\n\t\treturn errors.New(\"releases is a reserved keyword, use a different signer name\")\n\t}\n\n\tif options.keys.Len() == 0 {\n\t\treturn errors.New(\"path to a public key must be provided using the `--key` flag\")\n\t}\n\tsignerPubKeys, err := ingestPublicKeys(options.keys.GetSlice())\n\tif err != nil {\n\t\treturn err\n\t}\n\tvar errRepos []string\n\tfor _, repoName := range options.repos {\n\t\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Adding signer \\\"%s\\\" to %s...\\n\", signerName, repoName)\n\t\tif err := addSignerToRepo(ctx, dockerCLI, signerName, repoName, signerPubKeys); err != nil {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Err(), err.Error()+\"\\n\")\n\t\t\terrRepos = append(errRepos, repoName)\n\t\t} else {\n\t\t\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Successfully added signer: %s to %s\\n\\n\", signerName, repoName)\n\t\t}","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_add.go#L38-L74","documentation":"Returned by addSigner when the requested signer name is 'releases'. The name 'releases' maps to the reserved targets/releases role in Notary, which Docker manages internally; creating a user signer with that name would collide with the reserved delegation role.","triggerScenarios":"Running 'docker trust signer add releases ...' — the name check at signer_add.go:55 rejects it after the general name-format regex passes.","commonSituations":"Choosing 'releases' as a team/role name; migrating from a naming scheme that used 'releases'; misunderstanding that 'releases' is special in DCT.","solutions":["Pick a different signer name such as 'release-team', 'deploy', or a username.","Check reserved keywords (currently 'releases') before choosing a signer name.","If you already published data under targets/releases, it is system-managed — use a distinct delegation name for human signers."],"exampleFix":"# before: docker trust signer add releases alice.pub myrepo\n# after:  docker trust signer add release-team alice.pub myrepo","handlingStrategy":"validation","validationCode":"// Reject reserved signer names up front\nfunc validateSignerName(name string) error {\n\tif name == \"releases\" {\n\t\treturn errors.New(\"releases is a reserved keyword, use a different signer name\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid 'releases' as a signer name; it is reserved for targets/releases.","Validate signer names against the reserved-keyword list before invoking add.","Adopt a naming convention (team/user names) that never collides with TUF reserved roles."],"tags":["trust","notary","signer","reserved-keyword","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}