{"record":{"id":"9d629c642ed53d49","repo":"docker/cli","slug":"warning-potential-malicious-behavior-trust-data-9d629c","errorCode":null,"errorMessage":"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v","messagePattern":"warning: potential malicious behavior - trust data has insufficient signatures for remote repository (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":252,"sourceCode":"\tcase *json.SyntaxError:\n\t\tlogrus.Debugf(\"Notary syntax error: %s\", err)\n\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err\n\t}\n}\n\n// AddToAllSignableRoles attempts to add the image target to all the top level\n// delegation roles we can (based on whether we have the signing key and whether\n// the role's path allows us to).\n//\n// If there are no delegation roles, we add to the targets role.\nfunc AddToAllSignableRoles(repo client.Repository, target *client.Target) error {\n\tsignableRoles, err := GetSignableRoles(repo, target)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L234-L270","documentation":"Returned by NotaryError for signed.ErrRoleThreshold (trust.go:251-252). TUF roles declare a threshold of signatures required to consider metadata valid; the downloaded role metadata did not meet its threshold count of valid signatures. Because insufficient signatures can indicate a compromised or tampered role, the client reports it as 'potential malicious behavior'.","triggerScenarios":"Listing/pulling/verifying a repository whose targets/releases/delegation role requires N signatures but the served metadata only carries fewer valid ones - e.g. a delegation role had 2 keys with threshold 2 but one key was removed or one signature is invalid. Also triggered when a signer's key was rotated but the old signatures were not re-signed, dropping below threshold.","commonSituations":"Repository admin removed a signer key without lowering the role threshold, so remaining signatures are below the required count; a delegation role threshold was raised but not enough signers published; a compromised notary server stripped a signature; key rotation left metadata signed only by the new key while threshold still expects the old one.","solutions":["Have the repository admin add the missing signature(s): each configured signer for the role must publish (AddTarget/Publish) so the role again carries threshold-valid signatures.","If a signer key was legitimately removed, lower the role threshold to match the remaining keys via 'docker trust signer remove' followed by a publish, or add a replacement signer key.","Confirm no unauthorized party modified the role metadata by reviewing the notary server's published targets.json and the list of valid signing key IDs.","Re-pull after the admin re-publishes; if the warning persists, verify the local trust pinning config (trust-pinning.json) has not pinned an outdated root."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the served role metadata meets its declared signature threshold before consuming.\nfunc verifyRoleThreshold(repo client.Repository, roleName data.RoleName) error {\n    roles, err := repo.ListRoles()\n    if err != nil {\n        return err\n    }\n    for _, r := range roles {\n        if r.Name == roleName && len(r.Signatures) < r.Threshold {\n            return fmt.Errorf(\"role %s below threshold (%d/%d)\", roleName, len(r.Signatures), r.Threshold)\n        }\n    }\n    return nil\n}","typeGuard":"func isErrRoleThreshold(err error) bool {\n    if err == nil {\n        return false\n    }\n    return errors.Is(err, signed.ErrRoleThreshold)\n}","tryCatchPattern":"if err := repo.Publish(); err != nil {\n    if errors.Is(err, signed.ErrRoleThreshold) {\n        return fmt.Errorf(\"insufficient signatures on published metadata: %w; have all required signers publish\", err)\n    }\n    return trust.NotaryError(gun, err)\n}","preventionTips":["When removing a signer, simultaneously lower the role threshold or add a replacement before publishing.","Document each delegation role's key set and threshold so signers know who must publish.","Audit notary role metadata periodically to confirm signature counts meet thresholds.","Coordinate key rotations so metadata is re-signed by all required keys in the same publish cycle."],"tags":["docker","notary","content-trust","tuf","threshold","signatures","security"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}