{"record":{"id":"a4a4f77a27b0f3b0","repo":"docker/cli","slug":"valid-https-url-required-for-trust-server-got-s","errorCode":null,"errorMessage":"valid https URL required for trust server, got %s","messagePattern":"valid https URL required for trust server, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":86,"sourceCode":"\n// certificateDirectory returns the directory containing\n// TLS certificates for the given server. An error is\n// returned if there was an error parsing the server string.\nfunc certificateDirectory(server string) (string, error) {\n\tu, err := url.Parse(server)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\treturn filepath.Join(config.Dir(), \"tls\", u.Host), nil\n}\n\n// Server returns the base URL for the trust server.\nfunc Server(indexName string) (string, error) {\n\tif s := os.Getenv(\"DOCKER_CONTENT_TRUST_SERVER\"); s != \"\" {\n\t\turlObj, err := url.Parse(s)\n\t\tif err != nil || urlObj.Scheme != \"https\" {\n\t\t\treturn \"\", fmt.Errorf(\"valid https URL required for trust server, got %s\", s)\n\t\t}\n\n\t\treturn s, nil\n\t}\n\tif indexName == \"docker.io\" || indexName == \"index.docker.io\" {\n\t\treturn NotaryServer, nil\n\t}\n\treturn \"https://\" + indexName, nil\n}\n\ntype simpleCredentialStore struct {\n\tauth registrytypes.AuthConfig\n}\n\nfunc (scs simpleCredentialStore) Basic(*url.URL) (string, string) {\n\treturn scs.auth.Username, scs.auth.Password\n}\n","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L68-L104","documentation":"Returned by trust.Server (trust.go:86) when DOCKER_CONTENT_TRUST_SERVER is set to a value that either fails to parse as a URL or whose scheme is not 'https'. Content trust (Notary) mandates TLS for the trust server to prevent tampering with trust metadata. The offending URL is echoed back.","triggerScenarios":"Setting DOCKER_CONTENT_TRUST_SERVER to an http:// URL (e.g. http://notary.local), a bare hostname, or a malformed string, then performing a trusted operation (push/pull with DOCKER_CONTENT_TRUST=1). trust.Server parses it with url.Parse and rejects non-https schemes.","commonSituations":"Pointing at a self-hosted Notary over plain HTTP during development, a typo in the env var, a reverse proxy terminating TLS that the client still sees as http, or copy-pasting a URL without the scheme.","solutions":["Set DOCKER_CONTENT_TRUST_SERVER to a full https:// URL, e.g. `https://notary.example.com`.","Put TLS (with a valid cert or a custom CA in the cert dir) in front of your Notary server.","Double-check for typos, trailing slashes, or missing scheme.","Unset the variable to fall back to the default https://notary.docker.io."],"exampleFix":"# before\nexport DOCKER_CONTENT_TRUST_SERVER=http://notary.local:4443\n\n# after\nexport DOCKER_CONTENT_TRUST_SERVER=https://notary.local","handlingStrategy":"validation","validationCode":"// Validate the trust server URL scheme before any trusted operation\nsrv := os.Getenv(\"DOCKER_CONTENT_TRUST_SERVER\")\nif srv != \"\" {\n    u, err := url.Parse(srv)\n    if err != nil || u.Scheme != \"https\" {\n        return fmt.Errorf(\"DOCKER_CONTENT_TRUST_SERVER must be https, got %q\", srv)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use https:// for DOCKER_CONTENT_TRUST_SERVER.","Terminate TLS at/behind the Notary server.","Unset the var to use the default notary.docker.io."],"tags":["trust","tls","configuration","security"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}