{"record":{"id":"32a8a71c064085d2","repo":"docker/cli","slug":"no-targets-found-provide-a-specific-tag-in-order","errorCode":null,"errorMessage":"no targets found, provide a specific tag in order to sign it","messagePattern":"no targets found, provide a specific tag in order to sign it","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust_push.go","lineNumber":97,"sourceCode":"\t\t// We want trust signatures to always take an explicit tag,\n\t\t// otherwise it will act as an untrusted push.\n\t\tif err := jsonstream.Display(ctx, in, ioStreams.Out()); err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_, _ = fmt.Fprintln(ioStreams.Err(), \"No tag specified, skipping trust metadata push\")\n\t\treturn nil\n\t}\n\n\tif err := jsonstream.Display(ctx, in, ioStreams.Out(), jsonstream.WithAuxCallback(handleTarget)); err != nil {\n\t\treturn err\n\t}\n\n\tif cnt > 1 {\n\t\treturn errors.New(\"internal error: only one call to handleTarget expected\")\n\t}\n\n\tif notaryTarget == nil {\n\t\treturn errors.New(\"no targets found, provide a specific tag in order to sign it\")\n\t}\n\n\t_, _ = fmt.Fprintln(ioStreams.Out(), \"Signing and pushing trust metadata\")\n\n\trepo, err := GetNotaryRepository(ioStreams.In(), ioStreams.Out(), userAgent, repoInfo, &authConfig, \"push\", \"pull\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"error establishing connection to trust repository: %w\", err)\n\t}\n\n\t// get the latest repository metadata so we can figure out which roles to sign\n\t_, err = repo.ListTargets()\n\n\tswitch err.(type) {\n\tcase client.ErrRepoNotInitialized, client.ErrRepositoryNotExist:\n\t\tkeys := repo.GetCryptoService().ListKeys(data.CanonicalRootRole)\n\t\tvar rootKeyID string\n\t\t// always select the first root key\n\t\tif len(keys) > 0 {","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust_push.go#L79-L115","documentation":"Returned by PushTrustedReference when the push stream produced no valid signable target: the handleTarget callback either was never invoked with a usable PushResult or set notaryTarget to nil because the manifest digest could not be hex-decoded. Without a target (name+hash+size) there is nothing to register in the trust metadata.","triggerScenarios":"A trusted push whose aux JSON message had an unparseable or empty digest, or cnt==0 because the registry returned no push-result aux payload for the tag; essentially the push succeeded at the registry level but the trust layer could not extract a target to sign.","commonSituations":"Pushing with an explicit tag but the registry/manifest format did not emit the expected aux field; partial/older registry that omits PushResult digest; a manifest digest algorithm the client cannot hex-decode.","solutions":["Retry the push — transient registry aux-omission can resolve on a clean push.","Ensure you are pushing a concrete tag (not a digest or bare name) against a registry that returns push aux metadata.","Verify the image manifest is valid and the digest is a standard sha256; rebuild the image if the manifest is corrupt."],"exampleFix":"# before: docker push myrepo:latest  # no usable target extracted\n# after:  docker build -t myrepo:latest . && docker push myrepo:latest   # retry with a fresh manifest","handlingStrategy":"try-catch","validationCode":"// Ensure an explicit tag is used so the push aux callback can extract a target\nfunc ensureTagForTrust(ref reference.Named) (string, error) {\n\tif t, ok := ref.(reference.Tagged); ok { return t.Tag(), nil }\n\treturn \"\", errors.New(\"provide a specific tag in order to sign it\")\n}","typeGuard":null,"tryCatchPattern":"// Retry once on 'no targets found' since it can be a transient aux omission\nerr = trust.PushTrustedReference(...)\nif err != nil && strings.Contains(err.Error(), \"no targets found\") {\n    // rebuild/re-push by tag and retry\n    err = trust.PushTrustedReference(...)\n}","preventionTips":["Push a concrete tag (not a digest or bare name) so the registry returns push aux metadata.","Verify the manifest is valid (docker image inspect) before trusted push.","Retry once on transient target-extraction failures before treating as a hard error."],"tags":["trust","notary","push","manifest","signing"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}