{"record":{"id":"47336807c99e41c2","repo":"docker/cli","slug":"cannot-use-a-digest-reference-for-image-tag-473368","errorCode":null,"errorMessage":"cannot use a digest reference for IMAGE:TAG","messagePattern":"cannot use a digest reference for IMAGE:TAG","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/sign.go","lineNumber":139,"sourceCode":"\t\treturn err\n\t}\n\terr = trust.AddToAllSignableRoles(notaryRepo, &target)\n\tif err == nil {\n\t\tprettyPrintExistingSignatureInfo(out, existingSigInfo)\n\t\terr = notaryRepo.Publish()\n\t}\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to sign %s:%s: %w\", imgRefAndAuth.RepoInfo().Name.Name(), tag, err)\n\t}\n\t_, _ = fmt.Fprintf(out, \"Successfully signed %s:%s\\n\", imgRefAndAuth.RepoInfo().Name.Name(), tag)\n\treturn nil\n}\n\nfunc validateTag(imgRefAndAuth trust.ImageRefAndAuth) error {\n\ttag := imgRefAndAuth.Tag()\n\tif tag == \"\" {\n\t\tif imgRefAndAuth.Digest() != \"\" {\n\t\t\treturn errors.New(\"cannot use a digest reference for IMAGE:TAG\")\n\t\t}\n\t\treturn fmt.Errorf(\"no tag specified for %s\", imgRefAndAuth.Name())\n\t}\n\treturn nil\n}\n\nfunc checkLocalImageExistence(ctx context.Context, apiClient client.APIClient, imageName string) error {\n\t_, err := apiClient.ImageInspect(ctx, imageName)\n\treturn err\n}\n\nfunc createTarget(notaryRepo notaryclient.Repository, tag string) (notaryclient.Target, error) {\n\ttarget := &notaryclient.Target{}\n\tvar err error\n\tif tag == \"\" {\n\t\treturn *target, errors.New(\"no tag specified\")\n\t}\n\ttarget.Name = tag","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/sign.go#L121-L157","documentation":"Returned by validateTag (called from runSignImage) when the image reference has a digest but no tag. Signing requires a concrete tag to attach the trust target to; a digest-only reference is rejected at sign.go:138-139 before any Notary interaction.","triggerScenarios":"Running 'docker trust sign repo/image@sha256:...' — Tag() returns '' while Digest() is set, so validateTag returns this error.","commonSituations":"Resolving an image to a digest in a script and passing it to trust sign; copy-pasting a digest from docker inspect; pinning by digest in a signed-build pipeline.","solutions":["Sign by tag: 'docker trust sign repo/image:tag'.","Tag the digest locally first: 'docker tag repo/image@sha256:... repo/image:v1' then sign the tag.","Adjust CI to pass the tag reference, not the resolved digest, to docker trust sign."],"exampleFix":"# before: docker trust sign myrepo/img@sha256:abcd...\n# after:  docker tag myrepo/img@sha256:abcd... myrepo/img:v1 && docker trust sign myrepo/img:v1","handlingStrategy":"validation","validationCode":"// Reject digest references before signing\nfunc validateSignRef(ref trust.ImageRefAndAuth) error {\n\tif ref.Tag() == \"\" {\n\t\tif ref.Digest() != \"\" {\n\t\t\treturn errors.New(\"cannot use a digest reference for IMAGE:TAG\")\n\t\t}\n\t\treturn fmt.Errorf(\"no tag specified for %s\", ref.Name())\n\t}\n\treturn nil\n}","typeGuard":"// Ensure a tag is present for signing\nfunc isTaggedForSign(ref trust.ImageRefAndAuth) bool {\n\treturn ref.Tag() != \"\"\n}","tryCatchPattern":null,"preventionTips":["Pass a tag to docker trust sign, not a digest.","In CI, resolve and pass the tag rather than the canonical digest.","Type-check references in code to reject reference.Digested in the sign path."],"tags":["trust","notary","sign","digest","reference"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}