{"record":{"id":"3a5a42718eca3272","repo":"docker/cli","slug":"error-error-contacting-notary-server-v","errorCode":null,"errorMessage":"error: error contacting notary server: %v","messagePattern":"error: error contacting notary server: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":242,"sourceCode":"\t\tif v := env[\"default\"]; v != \"\" && alias != data.CanonicalRootRole.String() {\n\t\t\treturn v, numAttempts > 1, nil\n\t\t}\n\t\treturn baseRetriever(keyName, alias, createNew, numAttempts)\n\t}\n}\n\n// NotaryError formats an error message received from the notary service\nfunc NotaryError(repoName string, err error) error {\n\tswitch err.(type) {\n\tcase *json.SyntaxError:\n\t\tlogrus.Debugf(\"Notary syntax error: %s\", err)\n\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err\n\t}\n}","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L224-L260","documentation":"Returned by NotaryError (trust.go:242) when the notary error is storage.NetworkError — the client could not reach or successfully communicate with the Notary server over the network. This is distinct from missing data: the request itself failed (DNS, connection refused, TLS, timeout, HTTP transport error).","triggerScenarios":"Any trusted operation when the network path to the Notary server (DOCKER_CONTENT_TRUST_SERVER or notary.docker.io) fails: DNS resolution error, connection refused, TLS handshake failure, or a timeout. notary's storage layer wraps the HTTP error as NetworkError and NotaryError maps it here.","commonSituations":"Offline or behind a restrictive corporate proxy/firewall blocking the Notary port, a typo'd or unreachable trust server hostname, expired/invalid TLS certs on the server, or transient outages of notary.docker.io.","solutions":["Verify connectivity: `curl -v https://<trust-server>/v2/` and check DNS/firewall/proxy.","Set HTTPS_PROXY/HTTP_PROXY if a corporate proxy is required.","Confirm DOCKER_CONTENT_TRUST_SERVER is correct and reachable; fall back to notary.docker.io by unsetting it.","Retry after confirming the server cert chain validates against the configured CA bundle."],"exampleFix":"# before: blocked by proxy, fails with NetworkError\nDOCKER_CONTENT_TRUST=1 docker push example.com/app\n\n# after: route through the corporate proxy\nexport HTTPS_PROXY=http://proxy.corp:3128\nDOCKER_CONTENT_TRUST=1 docker push example.com/app","handlingStrategy":"retry","validationCode":"// Pre-flight connectivity to the trust server\nctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)\ndefer cancel()\nif _, err := http.NewRequestWithContext(ctx, http.MethodGet, trustServer+\"/v2/\", nil); err != nil {\n    return fmt.Errorf(\"trust server URL invalid: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"// Retry transient network errors with backoff\nvar last error\nfor i := 0; i < 3; i++ {\n    last = trustedOp(repo)\n    if last == nil || !errors.As(last, &storage.NetworkError{}) { break }\n    time.Sleep(time.Duration(1<<i) * time.Second)\n}","preventionTips":["Configure HTTPS_PROXY where required.","Verify DNS/firewall allows the Notary host/port.","Use short timeouts and retries for transient failures."],"tags":["trust","notary","network","proxy"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}