{"record":{"id":"9e238ce417234574","repo":"docker/cli","slug":"error-retrieving-signers-for-s-w","errorCode":null,"errorMessage":"error retrieving signers for %s: %w","messagePattern":"error retrieving signers for (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_remove.go","lineNumber":109,"sourceCode":"// removeSingleSigner attempts to remove a single signer and returns whether signer removal happened.\n// The signer not being removed doesn't necessarily raise an error e.g. user choosing \"No\" when prompted for confirmation.\nfunc removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, forceYes bool) (bool, error) {\n\timgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, authResolver(dockerCLI), repoName)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tsignerDelegation := data.RoleName(\"targets/\" + signerName)\n\tif signerDelegation == releasesRoleTUFName {\n\t\treturn false, errors.New(\"releases is a reserved keyword and cannot be removed\")\n\t}\n\tnotaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull)\n\tif err != nil {\n\t\treturn false, trust.NotaryError(imgRefAndAuth.Reference().Name(), err)\n\t}\n\tdelegationRoles, err := notaryRepo.GetDelegationRoles()\n\tif err != nil {\n\t\treturn false, fmt.Errorf(\"error retrieving signers for %s: %w\", repoName, err)\n\t}\n\tvar role data.Role\n\tfor _, delRole := range delegationRoles {\n\t\tif delRole.Name == signerDelegation {\n\t\t\trole = delRole\n\t\t\tbreak\n\t\t}\n\t}\n\tif role.Name == \"\" {\n\t\treturn false, fmt.Errorf(\"no signer %s for repository %s\", signerName, repoName)\n\t}\n\tallRoles, err := notaryRepo.ListRoles()\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tisLastSigner, err := isLastSignerForReleases(role, allRoles)\n\tif err != nil {","sourceCodeStart":91,"sourceCodeEnd":127,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_remove.go#L91-L127","documentation":"Returned by removeSingleSigner() in `docker trust signer remove` when notaryRepo.GetDelegationRoles() fails to fetch the list of delegation (signer) roles for the repository. %s is the repository name, %w is the notary client error. This is a network/metadata-retrieval failure, not a 'not found' condition.","triggerScenarios":"Calling `docker trust signer remove <name> <repo>` when the notary server is unreachable, returns an error, the trust repo doesn't exist, or the client lacks pull/push auth for the repo's trust data.","commonSituations":"Registry without content trust enabled; notary endpoint behind a flaky proxy; credentials expired; DNS resolution failure for the notary host.","solutions":["Check connectivity to the registry's notary service and that content trust is supported.","Re-authenticate with `docker login <registry>`.","Inspect the wrapped %w to distinguish ErrRepositoryNotExist/ErrRepoNotInitialized from transport errors.","Retry once transient network issues clear."],"exampleFix":"// before\n$ docker trust signer remove alice reg.io/app\nError: error retrieving signers for reg.io/app: ...\n\n// after — re-auth and confirm notary reachability\n$ docker login reg.io\n$ docker trust inspect reg.io/app   # confirms delegation retrieval works\n$ docker trust signer remove alice reg.io/app","handlingStrategy":"retry","validationCode":"// Confirm notary reachability before signer remove\nfunc notaryReachable(repo string) error {\n    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)\n    defer cancel()\n    out, err := exec.CommandContext(ctx, \"docker\", \"trust\", \"inspect\", repo).CombinedOutput()\n    if err != nil { return fmt.Errorf(\"notary unreachable for %s: %s\", repo, out) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Retry delegation retrieval on transient errors with backoff\nvar last error\nfor i := 0; i < 3; i++ {\n    out, err := exec.CommandContext(ctx, \"docker\", \"trust\", \"signer\", \"remove\", name, repo).CombinedOutput()\n    if err == nil || !strings.Contains(string(out), \"error retrieving signers\") { return err }\n    last = err; time.Sleep(time.Duration(i*i) * time.Second)\n}\nreturn last","preventionTips":["Ensure content trust is enabled on the registry before signer management.","Keep push/pull auth current with `docker login`.","Distinguish transient network errors from ErrRepositoryNotExist in the wrapped %w."],"tags":["docker","trust","notary","network","delegation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}