{"record":{"id":"45f4502b5815200f","repo":"docker/cli","slug":"error-no-trust-data-available-for-remote-reposito","errorCode":null,"errorMessage":"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address","messagePattern":"error: no trust data available for remote repository (.+?)\\. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":236,"sourceCode":"\n\treturn func(keyName string, alias string, createNew bool, numAttempts int) (string, bool, error) {\n\t\tif v := env[alias]; v != \"\" {\n\t\t\treturn v, numAttempts > 1, nil\n\t\t}\n\t\t// For non-root roles, we can also try the \"default\" alias if it is specified\n\t\tif v := env[\"default\"]; v != \"\" && alias != data.CanonicalRootRole.String() {\n\t\t\treturn v, numAttempts > 1, nil\n\t\t}\n\t\treturn baseRetriever(keyName, alias, createNew, numAttempts)\n\t}\n}\n\n// NotaryError formats an error message received from the notary service\nfunc NotaryError(repoName string, err error) error {\n\tswitch err.(type) {\n\tcase *json.SyntaxError:\n\t\tlogrus.Debugf(\"Notary syntax error: %s\", err)\n\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)","sourceCodeStart":218,"sourceCodeEnd":254,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L218-L254","documentation":"Returned by NotaryError (trust.go:236) when the underlying notary error is a *json.SyntaxError, meaning the trust server returned data that is not valid JSON. The message tells the user no trust data exists for the repository and suggests running a Notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address.","triggerScenarios":"Performing a trusted pull/inspect on a repository that has never been initialized for content trust, or pointing DOCKER_CONTENT_TRUST_SERVER at an endpoint that returns non-JSON (an HTML error page, an empty body, a proxy intercept). notary client's JSON decode fails with a SyntaxError which NotaryError maps to this message.","commonSituations":"First pull of an unsigned image with DOCKER_CONTENT_TRUST=1, a misconfigured trust server URL hitting a generic web server, or DNS/proxy returning an HTML 502 page instead of trust metadata.","solutions":["Confirm the image is signed; if not, either sign it or disable trust for that pull (unset DOCKER_CONTENT_TRUST).","Verify DOCKER_CONTENT_TRUST_SERVER resolves to a running Notary server returning JSON (curl the /v2/ endpoint).","Initialize trust for the repo: push with DOCKER_CONTENT_TRUST=1 after `docker trust key generate` / `docker trust signer add`.","Check for corporate proxies intercepting and rewriting the response."],"exampleFix":"# before: trust enabled against an unsigned/unreachable repo\nDOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest\n\n# after: verify the notary endpoint, or pull without trust\ncurl -s https://notary.example.com/v2/example.com/app/_trust/t targets.json | head\n# if unsigned: \nDOCKER_CONTENT_TRUST= docker pull example.com/app:latest","handlingStrategy":"fallback","validationCode":"// Probe the notary endpoint before trusting it\nresp, err := http.Get(strings.TrimRight(trustServer, \"/\") + \"/v2/\")\nif err != nil || resp.StatusCode >= 400 {\n    return fmt.Errorf(\"trust server unreachable or not returning JSON; disable trust or fix server\")\n}","typeGuard":null,"tryCatchPattern":"// If no trust data, fall back to a non-trusted pull (only if policy allows)\nif err := trustedPull(img); err != nil {\n    if strings.Contains(err.Error(), \"no trust data available\") {\n        return untrustedPull(img)\n    }\n    return err\n}","preventionTips":["Initialize/sign repos before requiring trust on pull.","Point DOCKER_CONTENT_TRUST_SERVER at a real Notary server returning JSON.","Watch for proxies returning HTML error pages."],"tags":["trust","notary","network","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}