{"record":{"id":"abf9953f7902b37f","repo":"docker/cli","slug":"failed-to-generate-key-for-s-w","errorCode":null,"errorMessage":"failed to generate key for %s: %w","messagePattern":"failed to generate key for (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_generate.go","lineNumber":91,"sourceCode":"\treturn validateAndGenerateKey(streams, opts.name, targetDir)\n}\n\nfunc validateAndGenerateKey(streams command.Streams, keyName string, workingDir string) error {\n\tfreshPassRetGetter := func() notary.PassRetriever { return trust.GetPassphraseRetriever(streams.In(), streams.Out()) }\n\tif err := validateKeyArgs(keyName, workingDir); err != nil {\n\t\treturn err\n\t}\n\t_, _ = fmt.Fprintf(streams.Out(), \"Generating key for %s...\\n\", keyName)\n\t// Automatically load the private key to local storage for use\n\tprivKeyFileStore, err := trustmanager.NewKeyFileStore(trust.GetTrustDirectory(), freshPassRetGetter())\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tpubPEM, err := generateKeyAndOutputPubPEM(keyName, privKeyFileStore)\n\tif err != nil {\n\t\t_, _ = fmt.Fprint(streams.Out(), err)\n\t\treturn fmt.Errorf(\"failed to generate key for %s: %w\", keyName, err)\n\t}\n\n\t// Output the public key to a file in the CWD or specified dir\n\twrittenPubFile, err := writePubKeyPEMToDir(pubPEM, keyName, workingDir)\n\tif err != nil {\n\t\treturn err\n\t}\n\t_, _ = fmt.Fprintln(streams.Out(), \"Successfully generated and loaded private key. Corresponding public key available:\", writtenPubFile)\n\n\treturn nil\n}\n\nfunc generateKeyAndOutputPubPEM(keyName string, privKeyStore trustmanager.KeyStore) (pem.Block, error) {\n\tprivKey, err := tufutils.GenerateKey(data.ECDSAKey)\n\tif err != nil {\n\t\treturn pem.Block{}, err\n\t}\n","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/key_generate.go#L73-L109","documentation":"In validateAndGenerateKey (key_generate.go:88-92), generateKeyAndOutputPubPEM returned an error and it is wrapped as 'failed to generate key for <name>'. generateKeyAndOutputPubPEM (key_generate.go:104-122) calls tufutils.GenerateKey(data.ECDSAKey) to create an ECDSA private key, then privKeyStore.AddKey(...) to persist it encrypted in the trust key file store - failure in either step yields this error.","triggerScenarios":"tufutils.GenerateKey fails due to an entropy/crypto subsystem error (rare); trustmanager.NewKeyFileStore could not create the trust directory; privKeyStore.AddKey fails because the passphrase retriever returned an error (passphrase mismatch on confirm), the trust dir is read-only, disk full, or a key with that ID already exists in the store.","commonSituations":"Passphrase confirmation mismatch when prompted interactively (the prompt asks twice); ~/.docker/trust/private not writable (permissions, read-only mount); disk full; entropy depleted in a constrained container; existing key collision in the private store; HOME env var unset so config.Dir() resolves oddly.","solutions":["Ensure HOME is set and ~/.docker/trust/private is writable: mkdir -p ~/.docker/trust/private && chmod 700 ~/.docker/trust/private.","When prompted, enter the same passphrase twice (or pre-set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE to skip the interactive confirm).","Free disk space and check the filesystem is not read-only.","If a key with the same role/ID already exists in the private store, remove the stale entry or pick a distinct key name.","Run with debug (-D) to see the wrapped underlying error from AddKey/GenerateKey."],"exampleFix":"# before: interactive passphrase mismatch -> AddKey fails\ndocker trust key generate mykey\n# after: pre-set passphrase to avoid mismatch\nexport DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE='correct horse battery staple'\ndocker trust key generate mykey","handlingStrategy":"try-catch","validationCode":"// Pre-check trust dir writability and passphrase availability before generation.\nfunc preflightKeyGen(trustDir string) error {\n    if err := os.MkdirAll(filepath.Join(trustDir, \"private\"), 0o700); err != nil {\n        return fmt.Errorf(\"trust private dir not writable: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"pubPEM, err := generateKeyAndOutputPubPEM(keyName, privKeyFileStore)\nif err != nil {\n    return fmt.Errorf(\"failed to generate key for %s: %w\", keyName, err)\n}","preventionTips":["Pre-set DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE to avoid interactive confirmation mismatch.","Ensure ~/.docker/trust/private exists with mode 0700 and is writable.","Free disk space and confirm HOME is set in CI.","Run with -D to inspect the wrapped AddKey/GenerateKey error."],"tags":["docker","notary","content-trust","key-generation","passphrase","filesystem","permissions"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}