{"record":{"id":"5f1d722130103110","repo":"docker/cli","slug":"public-key-file-already-exists-s","errorCode":null,"errorMessage":"public key file already exists: \"%s\"","messagePattern":"public key file already exists: \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_generate.go","lineNumber":59,"sourceCode":"}\n\n// key names can use lowercase alphanumeric + _ + - characters\nvar validKeyName = lazyregexp.New(`^[a-z0-9][a-z0-9\\_\\-]*$`).MatchString\n\n// validate that all of the key names are unique and are alphanumeric + _ + -\n// and that we do not already have public key files in the target dir on disk\nfunc validateKeyArgs(keyName string, targetDir string) error {\n\tif !validKeyName(keyName) {\n\t\treturn fmt.Errorf(\"key name \\\"%s\\\" must start with lowercase alphanumeric characters and can include \\\"-\\\" or \\\"_\\\" after the first character\", keyName)\n\t}\n\n\tpubKeyFileName := keyName + \".pub\"\n\tif _, err := os.Stat(targetDir); err != nil {\n\t\treturn fmt.Errorf(\"public key path does not exist: \\\"%s\\\"\", targetDir)\n\t}\n\ttargetPath := filepath.Join(targetDir, pubKeyFileName)\n\tif _, err := os.Stat(targetPath); err == nil {\n\t\treturn fmt.Errorf(\"public key file already exists: \\\"%s\\\"\", targetPath)\n\t}\n\treturn nil\n}\n\nfunc setupPassphraseAndGenerateKeys(streams command.Streams, opts keyGenerateOptions) error {\n\ttargetDir := opts.directory\n\tif targetDir == \"\" {\n\t\tcwd, err := os.Getwd()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\ttargetDir = cwd\n\t}\n\treturn validateAndGenerateKey(streams, opts.name, targetDir)\n}\n\nfunc validateAndGenerateKey(streams command.Streams, keyName string, workingDir string) error {\n\tfreshPassRetGetter := func() notary.PassRetriever { return trust.GetPassphraseRetriever(streams.In(), streams.Out()) }","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_generate.go#L41-L77","documentation":"In validateKeyArgs (key_generate.go:57-60), os.Stat(targetPath) succeeded (no error), meaning the public key file <keyName>.pub already exists in targetDir. The command refuses to overwrite an existing public key to avoid clobbering a previously generated keypair and breaking signers that depend on it.","triggerScenarios":"Running 'docker trust key generate <NAME>' twice with the same NAME in the same directory; a previous successful generation left <NAME>.pub on disk; a file with that exact name exists for another reason.","commonSituations":"Re-running a setup script that regenerates keys without cleanup; CI job reusing a workspace; developer forgot a key was already generated and tries again with the same name.","solutions":["Choose a different key name, e.g. 'docker trust key generate mykey-v2'.","Remove or back up the existing file if you intentionally want to regenerate: mv <name>.pub <name>.pub.bak (and the corresponding private key), then re-run.","If regenerating because the private key was lost, also remove the old private key from ~/.docker/trust/private to avoid an orphan public key."],"exampleFix":"# before\ndocker trust key generate mykey  # mykey.pub already exists\n# after (option A: new name)\ndocker trust key generate mykey-v2\n# after (option B: intentional overwrite)\nmv mykey.pub mykey.pub.bak && docker trust key generate mykey","handlingStrategy":"validation","validationCode":"// Guard against overwriting an existing public key file.\nfunc ensureNoExistingPubKey(dir, name string) error {\n    p := filepath.Join(dir, name+\".pub\")\n    if _, err := os.Stat(p); err == nil {\n        return fmt.Errorf(\"public key file already exists: %q; choose a new name or back up the file\", p)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"targetPath := filepath.Join(targetDir, keyName+\".pub\")\nif _, err := os.Stat(targetPath); err == nil {\n    return fmt.Errorf(\"public key file already exists: %q\", targetPath)\n}","preventionTips":["Use unique key names (with a version or date suffix) in automation.","Clean or back up generated .pub files in CI workspaces between runs.","Never blind-overwrite key files; losing a public key breaks existing signers."],"tags":["docker","notary","content-trust","filesystem","validation","key-management"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}