{"record":{"id":"4e19c5c924f8981b","repo":"docker/cli","slug":"error-importing-key-from-s-w","errorCode":null,"errorMessage":"error importing key from %s: %w","messagePattern":"error importing key from (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":67,"sourceCode":"\t\treturn fmt.Errorf(\"key name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", options.keyName)\n\t}\n\ttrustDir := trust.GetTrustDirectory()\n\tkeyFileStore, err := storage.NewPrivateKeyFileStorage(trustDir, notary.KeyExtension)\n\tif err != nil {\n\t\treturn err\n\t}\n\tprivKeyImporters := []trustmanager.Importer{keyFileStore}\n\n\t_, _ = fmt.Fprintf(streams.Out(), \"Loading key from \\\"%s\\\"...\\n\", keyPath)\n\n\t// Always use a fresh passphrase retriever for each import\n\tpassRet := trust.GetPassphraseRetriever(streams.In(), streams.Out())\n\tkeyBytes, err := getPrivKeyBytesFromPath(keyPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"refusing to load key from %s: %w\", keyPath, err)\n\t}\n\tif err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {\n\t\treturn fmt.Errorf(\"error importing key from %s: %w\", keyPath, err)\n\t}\n\t_, _ = fmt.Fprintln(streams.Out(), \"Successfully imported key from\", keyPath)\n\treturn nil\n}\n\nfunc getPrivKeyBytesFromPath(keyPath string) ([]byte, error) {\n\tif runtime.GOOS != \"windows\" {\n\t\tfileInfo, err := os.Stat(keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n\t\t\treturn nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n\t\t}\n\t}\n\n\tfrom, err := os.OpenFile(keyPath, os.O_RDONLY, notary.PrivExecPerms)\n\tif err != nil {","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_load.go#L49-L85","documentation":"In loadPrivKey (key_load.go:66-68), loadPrivKeyBytesToStore failed and is wrapped as 'error importing key from <path>'. loadPrivKeyBytesToStore (key_load.go:93-103) extracts private-key attributes, optionally decrypts an encrypted PEM, then calls trustmanager.ImportKeys to write the key into the trust file store. Failure here means the bytes were read fine but parsing/decryption/import into ~/.docker/trust/private failed.","triggerScenarios":"The file is not a supported private key format (but that has a dedicated message at 558, hit earlier); decryption of an encrypted key failed because the passphrase was wrong (but that has a dedicated message at 559, hit earlier); trustmanager.ImportKeys failed because the trust directory is not writable, a key with the same ID already exists, or the passphrase retriever returned an error during re-encryption on import.","commonSituations":"Trust directory ~/.docker/trust/private not writable or full; key with the same ID already imported; passphrase mismatch during import re-encryption; HOME unset; running in a restricted container/sandbox that blocks writes to the trust dir.","solutions":["Ensure HOME is set and ~/.docker/trust/private is writable with mode 0700: mkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private.","If a key with that ID is already imported, remove the conflicting file from ~/.docker/trust/private (or skip re-importing).","Provide the correct passphrase (set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE or enter it correctly when prompted) so re-encryption on import succeeds.","Free disk space and confirm the filesystem is writable.","Run with -D to capture the wrapped ImportKeys error for specifics."],"exampleFix":"# before: trust dir not writable, import fails\ndocker trust key load /tmp/priv.key\n# after\nmkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private\ndocker trust key load /tmp/priv.key","handlingStrategy":"try-catch","validationCode":"// Ensure the trust private dir is writable and free of the conflicting key id before import.\nfunc preflightImport(trustDir string) error {\n    privDir := filepath.Join(trustDir, \"private\")\n    if err := os.MkdirAll(privDir, 0o700); err != nil {\n        return fmt.Errorf(\"cannot access trust private dir %s: %w\", privDir, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := loadPrivKeyBytesToStore(keyBytes, privKeyImporters, keyPath, options.keyName, passRet); err != nil {\n    return fmt.Errorf(\"error importing key from %s: %w\", keyPath, err)\n}","preventionTips":["Ensure ~/.docker/trust/private is writable (0700) and HOME is set.","Remove conflicting key IDs before re-importing the same key.","Provide the correct passphrase for re-encryption on import.","Use -D to capture the wrapped ImportKeys error for diagnosis."],"tags":["docker","notary","content-trust","key-import","filesystem","permissions","passphrase"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}