{"record":{"id":"c7e787ad2f8c457b","repo":"docker/cli","slug":"error-removing-signer-from-s","errorCode":null,"errorMessage":"error removing signer from: %s","messagePattern":"error removing signer from: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_remove.go","lineNumber":52,"sourceCode":"\t\t},\n\t\tDisableFlagsInUseLine: true,\n\t}\n\tflags := cmd.Flags()\n\tflags.BoolVarP(&options.forceYes, \"force\", \"f\", false, \"Do not prompt for confirmation before removing the most recent signer\")\n\treturn cmd\n}\n\nfunc removeSigner(ctx context.Context, dockerCLI command.Cli, options signerRemoveOptions) error {\n\tvar errRepos []string\n\tfor _, repo := range options.repos {\n\t\t_, _ = fmt.Fprintf(dockerCLI.Out(), \"Removing signer \\\"%s\\\" from %s...\\n\", options.signer, repo)\n\t\tif _, err := removeSingleSigner(ctx, dockerCLI, repo, options.signer, options.forceYes); err != nil {\n\t\t\t_, _ = fmt.Fprintln(dockerCLI.Err(), err.Error()+\"\\n\")\n\t\t\terrRepos = append(errRepos, repo)\n\t\t}\n\t}\n\tif len(errRepos) > 0 {\n\t\treturn fmt.Errorf(\"error removing signer from: %s\", strings.Join(errRepos, \", \"))\n\t}\n\treturn nil\n}\n\nfunc isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSignatures) (bool, error) {\n\tvar releasesRoleWithSigs client.RoleWithSignatures\n\tfor _, role := range allRoles {\n\t\tif role.Name == releasesRoleTUFName {\n\t\t\treleasesRoleWithSigs = role\n\t\t\tbreak\n\t\t}\n\t}\n\tcounter := len(releasesRoleWithSigs.Signatures)\n\tif counter == 0 {\n\t\treturn false, errors.New(\"all signed tags are currently revoked, use docker trust sign to fix\")\n\t}\n\tfor _, signature := range releasesRoleWithSigs.Signatures {\n\t\tfor _, key := range roleWithSig.KeyIDs {","sourceCodeStart":34,"sourceCodeEnd":70,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_remove.go#L34-L70","documentation":"Returned by `docker trust signer remove` (removeSigner) as an aggregate error when one or more of the listed REPOSITORY targets failed during removeSingleSigner(). Per-repo errors are printed to stderr first; %s is the comma-joined list of repositories that failed. Mirrors the aggregate pattern of signer_add.go:77.","triggerScenarios":"Running `docker trust signer remove <name> <repo1> <repo2>` where at least one repo fails — signer not present (572), delegation retrieval error (571), publish failure, last-signer confirmation declined, or auth/connectivity problems.","commonSituations":"Bulk-removing a signer across many repos where the signer doesn't exist on some, or some repos are on a registry whose notary service is unreachable.","solutions":["Read the per-repo errors printed to stderr above this summary for each repo's actual cause.","Use `docker trust inspect <repo>` to confirm the signer exists on a repo before removing.","Pass `-f`/`--force` if a repo reports the signer is the last signer for releases and you accept making the image unpullable.","Retry against only the still-failing repos once their issues are resolved."],"exampleFix":"// before\n$ docker trust signer remove alice reg1.io/app reg2.io/app\nRemoving signer \"alice\" from reg2.io/app...\nno signer alice for repository reg2.io/app\nError: error removing signer from: reg2.io/app\n\n// after — verify presence then remove only where the signer exists\n$ docker trust inspect reg2.io/app   # confirm signer list\n$ docker trust signer remove alice reg1.io/app","handlingStrategy":"try-catch","validationCode":"// Pre-check signer presence per repo before bulk remove\nfunc reposWithSigner(repos, signer string) []string {\n    var hit []string\n    for _, r := range repos {\n        out, _ := exec.Command(\"docker\", \"trust\", \"inspect\", r).CombinedOutput()\n        if strings.Contains(string(out), signer) { hit = append(hit, r) }\n    }\n    return hit\n}","typeGuard":null,"tryCatchPattern":"// Bulk remove: surface per-repo stderr, then retry only failing repos\nout, err := exec.CommandContext(ctx, \"docker\", \"trust\", \"signer\", \"remove\", name).CombinedOutput() // + repos\nif err != nil {\n    return fmt.Errorf(\"partial remove failed; per-repo details:\\n%s\", out)\n}","preventionTips":["Inspect each repo's signer list before bulk removal.","Pass --force in automation to avoid last-signer prompt blocks.","Treat 'no signer X for repo Y' (572) as non-fatal in idempotent scripts."],"tags":["docker","trust","aggregate","notary","delegation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}