{"record":{"id":"6af5d4dc572dfc5d","repo":"docker/cli","slug":"error-signing-keys-for-remote-repository-s-not-f","errorCode":null,"errorMessage":"error: signing keys for remote repository %s not found: %v","messagePattern":"error: signing keys for remote repository (.+?) not found: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":240,"sourceCode":"\t\t}\n\t\t// For non-root roles, we can also try the \"default\" alias if it is specified\n\t\tif v := env[\"default\"]; v != \"\" && alias != data.CanonicalRootRole.String() {\n\t\t\treturn v, numAttempts > 1, nil\n\t\t}\n\t\treturn baseRetriever(keyName, alias, createNew, numAttempts)\n\t}\n}\n\n// NotaryError formats an error message received from the notary service\nfunc NotaryError(repoName string, err error) error {\n\tswitch err.(type) {\n\tcase *json.SyntaxError:\n\t\tlogrus.Debugf(\"Notary syntax error: %s\", err)\n\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L222-L258","documentation":"Returned by NotaryError (trust.go:240) when the notary error is trustmanager.ErrKeyNotFound — the local or YubiKey keystore does not contain the signing key required to sign the target role for the repository. Without the key the client cannot produce a valid signature, so signing/push aborts.","triggerScenarios":"Performing a trusted push/sign (`docker push` with DOCKER_CONTENT_TRUST=1, or `docker trust sign`) when the private key for the targets/releases role is absent from ~/.docker/trust/private (or the attached hardware token). trustmanager lookups raise ErrKeyNotFound.","commonSituations":"New machine without the signing key, key stored on a YubiKey that is unplugged, key imported with the wrong passphrase (so it decrypts to nothing), or a repo whose targets key was rotated by another signer.","solutions":["Import the targets/releases signing key: `docker trust key load key.pem --name <signer>`.","If using a YubiKey, plug it in and ensure notary sees it.","Add yourself as a delegation signer again (`docker trust signer add`) and re-push.","Rotate the targets key with the root key holder and re-initialize if the key is truly lost."],"exampleFix":"# before: signing without the key present\ndocker trust sign example.com/app:latest\n\n# after: load the key first, then sign\ndocker trust key load ./targets.key --name alice\ndocker trust sign example.com/app:latest","handlingStrategy":"try-catch","validationCode":"// Confirm the signing key is present before pushing\nfound := false\nfor _, k := range repo.GetCryptoService().ListAllKeys() {\n    if strings.Contains(k, targetsRole) { found = true; break }\n}\nif !found { return errors.New(\"signing key not loaded; run docker trust key load\") }","typeGuard":null,"tryCatchPattern":"// On missing key, prompt load then retry the sign\nif errors.Is(err, trustmanager.ErrKeyNotFound) {\n    if lerr := loadKey(\"./targets.key\"); lerr == nil {\n        err = repo.AddTarget(target, roles...)\n    }\n}","preventionTips":["Load the targets/releases key with `docker trust key load` before signing.","Plug in YubiKeys before trusted pushes.","Track key passphrase via DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE."],"tags":["trust","notary","keys","signing"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}