{"record":{"id":"c144dd414558076a","repo":"docker/cli","slug":"no-signers-for-s","errorCode":null,"errorMessage":"no signers for %s","messagePattern":"no signers for (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/common.go","lineNumber":100,"sourceCode":"\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, err\n\t}\n\tdefer clearChangeList(notaryRepo)\n\n\t// Retrieve all released signatures, match them, and pretty print them\n\tallSignedTargets, err := notaryRepo.GetAllTargetMetadataByName(tag)\n\tif err != nil {\n\t\tlogrus.Debug(trust.NotaryError(remote, err))\n\t\t// print an empty table if we don't have signed targets, but have an initialized notary repo\n\t\tif _, ok := err.(client.ErrNoSuchTarget); !ok {\n\t\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf(\"no signatures or cannot access %s\", remote)\n\t\t}\n\t}\n\tsignatureRows := matchReleasedSignatures(allSignedTargets)\n\n\t// get the administrative roles\n\tadminRolesWithSigs, err := notaryRepo.ListRoles()\n\tif err != nil {\n\t\treturn []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf(\"no signers for %s\", remote)\n\t}\n\n\t// get delegation roles with the canonical key IDs\n\tdelegationRoles, err := notaryRepo.GetDelegationRoles()\n\tif err != nil {\n\t\tlogrus.Debugf(\"no delegation roles found, or error fetching them for %s: %v\", remote, err)\n\t}\n\n\treturn signatureRows, adminRolesWithSigs, delegationRoles, nil\n}\n\nfunc formatAdminRole(roleWithSigs client.RoleWithSignatures) string {\n\tadminKeyList := roleWithSigs.KeyIDs\n\tsort.Strings(adminKeyList)\n\n\tvar role string\n\tswitch roleWithSigs.Name {\n\tcase data.CanonicalTargetsRole:","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/common.go#L82-L118","documentation":"In lookupTrustInfo (common.go:98-101), notaryRepo.ListRoles() failed, so the function returns 'no signers for <remote>'. ListRoles fetches the administrative roles (root, targets, snapshot, timestamp) and any delegation roles from the notary server. A failure here usually means the repository metadata could not be read - the repository may not be initialized, the server is unreachable, or auth failed.","triggerScenarios":"Calling 'docker trust inspect'/'docker trust view' on a repository where ListRoles returns an error: repo not initialized on the notary server (no root.json), auth failure reading the roles metadata, network/TLS error reaching the notary server, or the notary server returned an error status.","commonSituations":"Inspecting an image that was never trust-pushed; 'docker login' not done or credentials expired; DOCKER_CONTENT_TRUST_SERVER points to wrong server; network blocking notary endpoint; the notary repository exists but roles metadata is corrupt/missing after a botched rotation.","solutions":["Confirm the repository is initialized on the notary server by doing a trusted push first (DOCKER_CONTENT_TRUST=1 docker push <img>:<tag>).","Re-authenticate: docker login <registry> so the notary client can read role metadata.","Verify DOCKER_CONTENT_TRUST_SERVER and network reachability of the notary endpoint.","Enable debug logging (-D) to capture the underlying ListRoles error for a more specific cause.","If the repository is on Docker Hub, remember DCT for Official Images is being retired - confirm the GUN is still supported."],"exampleFix":"# before: repo not initialized\ndocker trust inspect myrepo/img:tag  # -> no signers\n# after: initialize then inspect\nDOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag\ndocker trust inspect myrepo/img:tag","handlingStrategy":"validation","validationCode":"// Confirm the repo is initialized and reachable before calling ListRoles.\nfunc preflightRoles(repo client.Repository, remote string) error {\n    if _, err := repo.ListRoles(); err != nil {\n        if _, ok := err.(client.ErrRepositoryNotExist); ok {\n            return fmt.Errorf(\"%s not initialized; trusted-push first\", remote)\n        }\n        return fmt.Errorf(\"no signers for %s: %w\", remote, err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"adminRoles, err := notaryRepo.ListRoles()\nif err != nil {\n    return nil, nil, nil, fmt.Errorf(\"no signers for %s\", remote)\n}","preventionTips":["Initialize the repo with a trusted push before invoking inspect/view.","Authenticate (docker login) so ListRoles can read role metadata.","Surface the underlying ListRoles error in debug logs rather than only the generic message.","Verify DOCKER_CONTENT_TRUST_SERVER points to the server holding this repo's metadata."],"tags":["docker","notary","content-trust","roles","authentication","network","inspection"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}