{"record":{"id":"9976609aac8ad942","repo":"docker/cli","slug":"error-could-not-produce-valid-signature-for-s","errorCode":null,"errorMessage":"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v","messagePattern":"error: could not produce valid signature for (.+?)\\.  If Yubikey was used, was touch input provided\\?: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":256,"sourceCode":"\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err\n\t}\n}\n\n// AddToAllSignableRoles attempts to add the image target to all the top level\n// delegation roles we can (based on whether we have the signing key and whether\n// the role's path allows us to).\n//\n// If there are no delegation roles, we add to the targets role.\nfunc AddToAllSignableRoles(repo client.Repository, target *client.Target) error {\n\tsignableRoles, err := GetSignableRoles(repo, target)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn repo.AddTarget(target, signableRoles...)\n}","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L238-L274","documentation":"Returned by NotaryError for signed.ErrInsufficientSignatures (trust.go:255-256). The client attempted to produce a signature but could not create a valid one - either no eligible signing key is available in the local store/crypto service, or a hardware-backed key (Yubikey) did not yield a signature because the required user-presence/touch input was not provided. The message explicitly prompts about Yubikey touch because that is the most common hardware cause.","triggerScenarios":"During repo.Publish() or repo.AddTarget() when the signing operation needs a key that is either absent from the local key store or stored on a Yubikey that timed out waiting for touch. Also when the available signatures do not satisfy the role's signing requirements so the final signature set is insufficient to publish.","commonSituations":"User enabled DCT, the signing key is on a Yubikey, and during push the Yubikey LED blinked requesting touch but the user did not tap it within the timeout; Yubikey not plugged in or pcscd daemon not running; correct signing key never imported locally so no key can sign; role requires a delegation key that was removed.","solutions":["If using a Yubikey, tap it when it flashes during the push operation and ensure pcscd (or the platform smart-card service) is running; retry the push.","Confirm the required signing key is available: run 'docker trust key list' / 'notary key list' and verify a key for the targets/releases role exists.","Import the correct private key with 'docker trust key load <key.file>' if it is missing from the local store.","Set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE correctly so an encrypted software key can be decrypted for signing.","If the role needs a delegation key, add it via 'docker trust signer add' and ensure the signer publishes with that key."],"exampleFix":"# before: Yubikey touch missed, push fails\nDOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag\n# after: tap Yubikey when it flashes, ensure daemon running\nsudo systemctl start pcscd\nDOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag  # tap Yubikey on prompt","handlingStrategy":"validation","validationCode":"// Before publishing, confirm a usable signing key exists (incl. hardware-backed).\nfunc ensureCanSign(repo client.Repository) error {\n    if err := ensureSigningKeyAvailable(repo, os.Getenv(\"DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE\")); err != nil {\n        return err\n    }\n    // If a Yubikey is the backing store, verify pcscd/smart-card is reachable.\n    if os.Getenv(\"DOCKER_TRUST_YUBIKEY\") != \"\" {\n        if err := checkYubikeyAvailable(); err != nil {\n            return fmt.Errorf(\"Yubikey not ready for touch signing: %w\", err)\n        }\n    }\n    return nil\n}","typeGuard":"func isErrInsufficientSignatures(err error) bool {\n    if err == nil {\n        return false\n    }\n    return errors.Is(err, signed.ErrInsufficientSignatures)\n}","tryCatchPattern":"if err := repo.Publish(); err != nil {\n    if errors.Is(err, signed.ErrInsufficientSignatures) {\n        return fmt.Errorf(\"could not produce a valid signature: %w; if using a Yubikey, tap it when it flashes\", err)\n    }\n    return trust.NotaryError(gun, err)\n}","preventionTips":["For Yubikey-backed keys, start pcscd and confirm the device is visible before the push window.","Increase the Yubikey touch timeout or document the tap requirement for operators.","Keep a software fallback key for CI where a hardware token is impractical.","Pre-load the targets/releases delegation key so the signer has something to sign with."],"tags":["docker","notary","content-trust","signing","yubikey","hardware-token","passphrase"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}