{"record":{"id":"5843c5b5e4c018e6","repo":"docker/cli","slug":"failed-to-sign-s-s-w","errorCode":null,"errorMessage":"failed to sign %s:%s: %w","messagePattern":"failed to sign (.+?):(.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust_push.go","lineNumber":144,"sourceCode":"\t\t// Initialize the notary repository with a remotely managed snapshot key\n\t\tif err := repo.Initialize([]string{rootKeyID}, data.CanonicalSnapshotRole); err != nil {\n\t\t\treturn NotaryError(repoInfo.Name.Name(), err)\n\t\t}\n\t\t_, _ = fmt.Fprintf(ioStreams.Out(), \"Finished initializing %q\\n\", repoInfo.Name.Name())\n\t\terr = repo.AddTarget(notaryTarget, data.CanonicalTargetsRole)\n\tcase nil:\n\t\t// already initialized and we have successfully downloaded the latest metadata\n\t\terr = AddToAllSignableRoles(repo, notaryTarget)\n\tdefault:\n\t\treturn NotaryError(repoInfo.Name.Name(), err)\n\t}\n\n\tif err == nil {\n\t\terr = repo.Publish()\n\t}\n\n\tif err != nil {\n\t\terr = fmt.Errorf(\"failed to sign %s:%s: %w\", repoInfo.Name.Name(), tag, err)\n\t\treturn NotaryError(repoInfo.Name.Name(), err)\n\t}\n\n\t_, _ = fmt.Fprintf(ioStreams.Out(), \"Successfully signed %s:%s\\n\", repoInfo.Name.Name(), tag)\n\treturn nil\n}\n","sourceCodeStart":126,"sourceCodeEnd":151,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust_push.go#L126-L151","documentation":"In PushTrustedReference (trust_push.go:139-146), after the target has been added and Publish() attempted, if any error remains it is wrapped as 'failed to sign <repo>:<tag>' and then passed through NotaryError for human-friendly mapping. This is the catch-all signing/publish failure for a trusted push - the underlying cause is in the wrapped error (could be ErrNoKeys, ErrInsufficientSignatures, network error during publish, etc.).","triggerScenarios":"repo.Publish() fails (network error uploading metadata to notary server); repo.AddTarget() / AddToAllSignableRoles() fails (no valid signing keys for delegation roles - 'no valid signing keys for delegation roles' from GetSignableRoles at trust.go:317); repo.Initialize() fails during first push; the underlying error is then mapped by NotaryError into one of the specific messages.","commonSituations":"First-time trusted push where repository initialization fails; CI environment without the signing key; delegation role configured but the pushing identity lacks any of the delegation keys; transient network error between client and notary server during the final Publish step; notary server out of disk or misconfigured.","solutions":["Read the wrapped (%w) underlying error first - it is mapped by NotaryError into a more specific message; address that root cause (e.g. import key if ErrNoKeys).","Ensure a valid signing key for the targets/releases role is loaded locally ('docker trust key load').","For delegation-based repos, confirm the pushing user holds one of the delegation keys whose ID is listed in the role's KeyIDs (check with 'docker trust inspect --pretty').","Retry on transient network errors; if Publish partially uploaded metadata, the next attempt may need the server-side stale changelist cleared (clearChangeList is called in lookupTrustInfo).","If initializing for the first time, confirm the root key passphrase (DOCKER_CONTENT_TRUST_ROOT_PASSPHRASE) is set."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate signing prerequisites before calling PushTrustedReference/Publish.\nfunc preflightTrustedPush(repo client.Repository) error {\n    if _, err := repo.ListTargets(); err != nil {\n        // tolerate not-initialized/not-exist (PushTrustedReference bootstraps), surface the rest\n        if _, ok := err.(client.ErrRepositoryNotExist); !ok && _, ok2 := err.(client.ErrRepoNotInitialized); !ok2 {\n            return trust.NotaryError(gun, err)\n        }\n    }\n    return ensureSigningKeyAvailable(repo, os.Getenv(\"DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE\"))\n}","typeGuard":null,"tryCatchPattern":"if err := repo.Publish(); err != nil {\n    err = fmt.Errorf(\"failed to sign %s:%s: %w\", gun, tag, err)\n    return trust.NotaryError(gun, err) // maps underlying type to a human message\n}","preventionTips":["Pre-check that a signable role/key exists via GetSignableRoles before AddTarget.","For delegation repos, confirm the pusher holds a listed delegation key ID.","Set both ROOT and REPOSITORY passphrases for first-time initialization.","Capture the wrapped underlying error to route to the right remediation (key vs network vs init)."],"tags":["docker","notary","content-trust","signing","publish","delegation-keys"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}