{"record":{"id":"53003ea40693c1ae","repo":"docker/cli","slug":"no-signatures-or-cannot-access-s","errorCode":null,"errorMessage":"no signatures or cannot access %s","messagePattern":"no signatures or cannot access (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/common.go","lineNumber":92,"sourceCode":"\t}\n\ttag := imgRefAndAuth.Tag()\n\tnotaryRepo, err := newNotaryClient(cli, imgRefAndAuth, trust.ActionsPullOnly)\n\tif err != nil {\n\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, trust.NotaryError(imgRefAndAuth.Reference().Name(), err)\n\t}\n\n\tif err = clearChangeList(notaryRepo); err != nil {\n\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, err\n\t}\n\tdefer clearChangeList(notaryRepo)\n\n\t// Retrieve all released signatures, match them, and pretty print them\n\tallSignedTargets, err := notaryRepo.GetAllTargetMetadataByName(tag)\n\tif err != nil {\n\t\tlogrus.Debug(trust.NotaryError(remote, err))\n\t\t// print an empty table if we don't have signed targets, but have an initialized notary repo\n\t\tif _, ok := err.(client.ErrNoSuchTarget); !ok {\n\t\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf(\"no signatures or cannot access %s\", remote)\n\t\t}\n\t}\n\tsignatureRows := matchReleasedSignatures(allSignedTargets)\n\n\t// get the administrative roles\n\tadminRolesWithSigs, err := notaryRepo.ListRoles()\n\tif err != nil {\n\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf(\"no signers for %s\", remote)\n\t}\n\n\t// get delegation roles with the canonical key IDs\n\tdelegationRoles, err := notaryRepo.GetDelegationRoles()\n\tif err != nil {\n\t\tlogrus.Debugf(\"no delegation roles found, or error fetching them for %s: %v\", remote, err)\n\t}\n\n\treturn signatureRows, adminRolesWithSigs, delegationRoles, nil\n}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/common.go#L74-L110","documentation":"In lookupTrustInfo (common.go:87-94), notaryRepo.GetAllTargetMetadataByName(tag) returned an error that is NOT client.ErrNoSuchTarget. The code logs NotaryError(remote, err) at debug level, then returns a generic 'no signatures or cannot access <remote>'. This is a fallback for any non-'no such target' failure when fetching signed target metadata - typically auth or transport failures.","triggerScenarios":"Calling 'docker trust inspect'/'docker trust view' when GetAllTargetMetadataByName fails due to a network/transport error to the notary server, an authentication failure (no/invalid registry credentials), a TLS error, or a server-side metadata corruption that is not the specific ErrNoSuchTarget type.","commonSituations":"Running trust inspect without 'docker login' first so token auth fails; DOCKER_CONTENT_TRUST_SERVER unreachable or misconfigured; corporate firewall blocks notary.docker.io; notary server returns malformed metadata (json.SyntaxError mapped by NotaryError to 'no trust data available'); expired registry token.","solutions":["Authenticate first: docker login <registry> (or docker login for Docker Hub) so the notary client can obtain a token.","Confirm network connectivity to the notary server: curl -v <server>/v2/ and check DNS/firewall/proxy.","Verify DOCKER_CONTENT_TRUST_SERVER is correct (or unset to use the default notary.docker.io).","Run with debug logging (DOCKER_DEBUG=1 or -D) to surface the underlying NotaryError that was logged at debug level.","If the repo genuinely has no signatures yet, push with DOCKER_CONTENT_TRUST=1 first to initialize it."],"exampleFix":"# before: not logged in, inspect fails\ndocker trust inspect myrepo/img:tag  # -> no signatures or cannot access\n# after: login then inspect\ndocker login\ndocker trust inspect myrepo/img:tag","handlingStrategy":"validation","validationCode":"// Ensure auth and connectivity before lookupTrustInfo's GetAllTargetMetadataByName call.\nfunc preflightLookup(repo client.Repository, remote string) error {\n    if _, err := repo.GetAllTargetMetadataByName(\"\"); err != nil {\n        if _, ok := err.(client.ErrNoSuchTarget); ok {\n            return nil // repo exists but has no targets - acceptable\n        }\n        return fmt.Errorf(\"no signatures or cannot access %s: %w\", remote, err)\n    }\n    return nil\n}","typeGuard":"func isErrNoSuchTarget(err error) bool {\n    if err == nil {\n        return false\n    }\n    _, ok := err.(client.ErrNoSuchTarget)\n    return ok\n}","tryCatchPattern":"allSigned, err := notaryRepo.GetAllTargetMetadataByName(tag)\nif err != nil {\n    logrus.Debug(trust.NotaryError(remote, err))\n    if _, ok := err.(client.ErrNoSuchTarget); !ok {\n        return nil, nil, nil, fmt.Errorf(\"no signatures or cannot access %s\", remote)\n    }\n}","preventionTips":["Always 'docker login' before running 'docker trust inspect'.","Use -D / debug logging to surface the underlying NotaryError that is otherwise swallowed.","Validate DOCKER_CONTENT_TRUST_SERVER and network path to the notary endpoint.","Distinguish 'repo has no signatures' (ErrNoSuchTarget) from 'cannot access' to give users better guidance."],"tags":["docker","notary","content-trust","authentication","network","inspection"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}