{"record":{"id":"5a7e55397988a137","repo":"docker/cli","slug":"path-to-a-public-key-must-be-provided-using-the","errorCode":null,"errorMessage":"path to a public key must be provided using the `--key` flag","messagePattern":"path to a public key must be provided using the `--key` flag","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_add.go","lineNumber":60,"sourceCode":"\tflags := cmd.Flags()\n\toptions.keys = opts.NewListOpts(nil)\n\tflags.Var(&options.keys, \"key\", \"Path to the signer's public key file\")\n\treturn cmd\n}\n\nvar validSignerName = lazyregexp.New(`^[a-z0-9][a-z0-9\\_\\-]*$`).MatchString\n\nfunc addSigner(ctx context.Context, dockerCLI command.Cli, options signerAddOptions) error {\n\tsignerName := options.signer\n\tif !validSignerName(signerName) {\n\t\treturn fmt.Errorf(\"signer name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", signerName)\n\t}\n\tif signerName == \"releases\" {\n\t\treturn errors.New(\"releases is a reserved keyword, use a different signer name\")\n\t}\n\n\tif options.keys.Len() == 0 {\n\t\treturn errors.New(\"path to a public key must be provided using the `--key` flag\")\n\t}\n\tsignerPubKeys, err := ingestPublicKeys(options.keys.GetSlice())\n\tif err != nil {\n\t\treturn err\n\t}\n\tvar errRepos []string\n\tfor _, repoName := range options.repos {\n\t\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Adding signer \\\"%s\\\" to %s...\\n\", signerName, repoName)\n\t\tif err := addSignerToRepo(ctx, dockerCLI, signerName, repoName, signerPubKeys); err != nil {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Err(), err.Error()+\"\\n\")\n\t\t\terrRepos = append(errRepos, repoName)\n\t\t} else {\n\t\t\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Successfully added signer: %s to %s\\n\\n\", signerName, repoName)\n\t\t}\n\t}\n\tif len(errRepos) > 0 {\n\t\treturn fmt.Errorf(\"failed to add signer to: %s\", strings.Join(errRepos, \", \"))\n\t}","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_add.go#L42-L78","documentation":"Returned by addSigner when options.keys is empty — the user invoked 'docker trust signer add' without any --key flag. Adding a signer requires at least one public key to attach to the delegation role, so a missing key is rejected before contacting the Notary server.","triggerScenarios":"Running 'docker trust signer add alice myrepo' with no '--key <pubkeyfile>' arguments; the flag count check at signer_add.go:59 fails.","commonSituations":"Forgetting the --key flag; passing the key as a positional arg instead of via --key; assuming a default key is used.","solutions":["Provide at least one --key flag pointing to the signer's public key PEM file.","Generate the public key with 'docker trust key generate' (or notary key generate) if you do not have one yet.","Double-check flag spelling: it is --key (not --keys or --pubkey)."],"exampleFix":"# before: docker trust signer add alice myrepo\n# after:  docker trust signer add alice --key alice.pub myrepo","handlingStrategy":"validation","validationCode":"// Ensure at least one --key is provided before adding a signer\nfunc validateSignerKeys(keys []string) error {\n\tif len(keys) == 0 {\n\t\treturn errors.New(\"path to a public key must be provided using the --key flag\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass --key <pubkey.pem> when adding a signer.","Generate a key pair first if none exists (docker trust key generate).","Validate flag presence in scripts and surface a helpful message."],"tags":["trust","notary","signer","keys","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}