{"record":{"id":"724b527cbec02032","repo":"docker/cli","slug":"no-signed-tags-to-remove","errorCode":null,"errorMessage":"no signed tags to remove","messagePattern":"no signed tags to remove","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cmd/docker-trust/trust/revoke.go","lineNumber":109,"sourceCode":"}\n\nfunc revokeSingleSig(notaryRepo client.Repository, tag string) error {\n\treleasedTargetWithRole, err := notaryRepo.GetTargetByName(tag, trust.ReleasesRole, data.CanonicalTargetsRole)\n\tif err != nil {\n\t\treturn err\n\t}\n\treleasedTarget := releasedTargetWithRole.Target\n\treturn getSignableRolesForTargetAndRemove(releasedTarget, notaryRepo)\n}\n\nfunc revokeAllSigs(notaryRepo client.Repository) error {\n\treleasedTargetWithRoleList, err := notaryRepo.ListTargets(trust.ReleasesRole, data.CanonicalTargetsRole)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif len(releasedTargetWithRoleList) == 0 {\n\t\treturn errors.New(\"no signed tags to remove\")\n\t}\n\n\t// we need all the roles that signed each released target so we can remove from all roles.\n\tfor _, releasedTargetWithRole := range releasedTargetWithRoleList {\n\t\t// remove from all roles\n\t\tif err := getSignableRolesForTargetAndRemove(releasedTargetWithRole.Target, notaryRepo); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn nil\n}\n\n// get all the roles that signed the target and removes it from all roles.\nfunc getSignableRolesForTargetAndRemove(releasedTarget client.Target, notaryRepo client.Repository) error {\n\tsignableRoles, err := trust.GetSignableRoles(notaryRepo, &releasedTarget)\n\tif err != nil {\n\t\treturn err\n\t}","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/revoke.go#L91-L127","documentation":"Returned by revokeAllSigs when revoking all signatures (no tag given) but ListTargets returned an empty list for the releases and targets roles. There are no signed tags in the repository, so there is nothing to remove.","triggerScenarios":"Running 'docker trust revoke repo/image' (or with -y) against a repository that has no published signed targets — either it was never signed, or all signatures were already revoked.","commonSituations":"Revoking from a freshly-created repository that was pushed without DCT; revoking again after a previous full revoke; pointing at the wrong repository name.","solutions":["Confirm the repository was actually signed: 'docker trust inspect --pretty repo/image'.","If you need signatures, sign a tag first with 'docker trust sign repo/image:tag'.","Verify you are using the correct repository/image name and registry."],"exampleFix":"# before: docker trust revoke -y myrepo/img  # nothing signed\n# after:  docker trust sign myrepo/img:v1    # sign first, then revoke later if needed","handlingStrategy":"validation","validationCode":"// Before revoking all, check whether any signed targets exist\nfunc hasSignedTargets(repo client.Repository) (bool, error) {\n\ttargets, err := repo.ListTargets(trust.ReleasesRole, data.CanonicalTargetsRole)\n\tif err != nil { return false, err }\n\treturn len(targets) > 0, nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'docker trust inspect --pretty repo' to confirm signatures exist before revoking all.","Treat 'no signed tags to remove' as an expected empty-state, not a retryable failure.","Sign a tag first if you intend to later demonstrate revocation."],"tags":["trust","notary","revoke","empty-state"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}