{"record":{"id":"324edbaf64502e04","repo":"docker/cli","slug":"no-tag-specified","errorCode":null,"errorMessage":"no tag specified","messagePattern":"no tag specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/sign.go","lineNumber":155,"sourceCode":"\tif tag == \"\" {\n\t\tif imgRefAndAuth.Digest() != \"\" {\n\t\t\treturn errors.New(\"cannot use a digest reference for IMAGE:TAG\")\n\t\t}\n\t\treturn fmt.Errorf(\"no tag specified for %s\", imgRefAndAuth.Name())\n\t}\n\treturn nil\n}\n\nfunc checkLocalImageExistence(ctx context.Context, apiClient client.APIClient, imageName string) error {\n\t_, err := apiClient.ImageInspect(ctx, imageName)\n\treturn err\n}\n\nfunc createTarget(notaryRepo notaryclient.Repository, tag string) (notaryclient.Target, error) {\n\ttarget := &notaryclient.Target{}\n\tvar err error\n\tif tag == \"\" {\n\t\treturn *target, errors.New(\"no tag specified\")\n\t}\n\ttarget.Name = tag\n\ttarget.Hashes, target.Length, err = getSignedManifestHashAndSize(notaryRepo, tag)\n\treturn *target, err\n}\n\nfunc getSignedManifestHashAndSize(notaryRepo notaryclient.Repository, tag string) (data.Hashes, int64, error) {\n\ttargets, err := notaryRepo.GetAllTargetMetadataByName(tag)\n\tif err != nil {\n\t\treturn nil, 0, err\n\t}\n\treturn getReleasedTargetHashAndSize(targets, tag)\n}\n\nfunc getReleasedTargetHashAndSize(targets []notaryclient.TargetSignedStruct, tag string) (data.Hashes, int64, error) {\n\tfor _, tgt := range targets {\n\t\tif isReleasedTarget(tgt.Role.Name) {\n\t\t\treturn tgt.Target.Hashes, tgt.Target.Length, nil","sourceCodeStart":137,"sourceCodeEnd":173,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/sign.go#L137-L173","documentation":"Returned by createTarget when tag is empty — a defensive guard asserting that a target name is required to look up the signed manifest hash and size. In practice validateTag usually catches the missing tag first; this error surfaces when createTarget is reached with an empty tag (e.g. via a code path that bypasses validateTag).","triggerScenarios":"Calling createTarget(notaryRepo, '') directly, or runSignImage reaching createTarget with an empty tag due to a reference that is neither tagged nor digested.","commonSituations":"Signing a bare repository name with no tag or digest: 'docker trust sign repo/image'; a reference parsing edge case that yields no tag.","solutions":["Provide an explicit tag: 'docker trust sign repo/image:tag'.","If scripting, assert the reference contains a tag before invoking docker trust sign.","Check that the image name string is not truncated or missing the ':tag' suffix."],"exampleFix":"# before: docker trust sign myrepo/img      # no tag\n# after:  docker trust sign myrepo/img:v1","handlingStrategy":"validation","validationCode":"// Assert a non-empty tag before creating a target\nfunc ensureTag(tag string) error {\n\tif tag == \"\" { return errors.New(\"no tag specified\") }\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always include an explicit tag when invoking docker trust sign.","Validate that the image string contains ':tag' before the sign call.","Guard createTarget callers with an empty-tag check to fail early."],"tags":["trust","notary","sign","tag","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}