{"record":{"id":"707efe8039c64e3f","repo":"docker/cli","slug":"could-not-parse-public-key-from-file-s-w","errorCode":null,"errorMessage":"could not parse public key from file: %s: %w","messagePattern":"could not parse public key from file: (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_add.go","lineNumber":134,"sourceCode":"\tpubKeys := []data.PublicKey{}\n\tfor _, pubKeyPath := range pubKeyPaths {\n\t\t// Read public key bytes from PEM file, limit to 1 KiB\n\t\tpubKeyFile, err := os.OpenFile(pubKeyPath, os.O_RDONLY, 0o666)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read public key from file: %w\", err)\n\t\t}\n\t\tdefer pubKeyFile.Close()\n\t\t// limit to\n\t\tl := io.LimitReader(pubKeyFile, 1<<20)\n\t\tpubKeyBytes, err := io.ReadAll(l)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to read public key from file: %w\", err)\n\t\t}\n\n\t\t// Parse PEM bytes into type PublicKey\n\t\tpubKey, err := tufutils.ParsePEMPublicKey(pubKeyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"could not parse public key from file: %s: %w\", pubKeyPath, err)\n\t\t}\n\t\tpubKeys = append(pubKeys, pubKey)\n\t}\n\treturn pubKeys, nil\n}\n","sourceCodeStart":116,"sourceCodeEnd":140,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_add.go#L116-L140","documentation":"Returned by ingestPublicKeys() in `docker trust signer add` when the file was opened and read successfully but tufutils.ParsePEMPublicKey() cannot parse the bytes as a valid PEM-encoded public key. %s is the offending file path, %w is the parse error. This means the file is reachable and readable but is not a valid notary public key.","triggerScenarios":"Passing `--key <file>` whose contents are not a PEM public key — e.g. a private key file, a PEM with an unsupported algorithm, a corrupted/truncated PEM, a non-PEM format (OpenSSH, JWK, DER), or a text file.","commonSituations":"Accidentally passing the private key (which is PEM but not a *public* key parseable here) instead of the public key; exporting the key in the wrong format; copy-paste truncating the PEM armor; key generated with an unsupported curve.","solutions":["Export the public key in the correct PEM format expected by notary (use `docker trust key generate` to produce a compatible pair).","Confirm you are passing the .pub file, not the private key.","Validate the PEM structure manually (BEGIN/END PUBLIC KEY blocks, base64 intact).","Regenerate the key pair with `docker trust key generate <name>` if the existing one is corrupt or wrong-format."],"exampleFix":"// before\n$ docker trust signer add alice reg.io/app --key alice-private.pem\nError: could not parse public key from file: alice-private.pem: ...\n\n// after — generate a proper pair and pass the public key\n$ docker trust key generate alice   # produces alice-*.pub and a private key\n$ docker trust signer add alice reg.io/app --key alice-<id>.pub","handlingStrategy":"validation","validationCode":"// Validate the PEM is a parseable public key before invoking signer add\nimport \"encoding/pem\"\n\nfunc validatePEMPublicKey(path string) error {\n    b, err := os.ReadFile(path)\n    if err != nil { return err }\n    block, _ := pem.Decode(b)\n    if block == nil { return errors.New(\"not a PEM file\") }\n    if !strings.Contains(block.Type, \"PUBLIC KEY\") {\n        return fmt.Errorf(\"PEM type %s is not a public key\", block.Type)\n    }\n    return nil\n}","typeGuard":"func isPEMPublicKey(b []byte) bool {\n    block, _ := pem.Decode(b)\n    if block == nil { return false }\n    return strings.Contains(block.Type, \"PUBLIC KEY\")\n}","tryCatchPattern":null,"preventionTips":["Generate keys with `docker trust key generate` to guarantee a compatible format.","Pass the .pub file, never the private key.","Lint PEM blocks in CI before the signer-add step."],"tags":["docker","trust","key-management","pem","parsing"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}