{"record":{"id":"c96a2321968545e6","repo":"docker/cli","slug":"no-valid-signing-keys-for-delegation-roles","errorCode":null,"errorMessage":"no valid signing keys for delegation roles","messagePattern":"no valid signing keys for delegation roles","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":317,"sourceCode":"\t// and attempt to sign in to all those roles.\n\tfor _, delegationRole := range allDelegationRoles {\n\t\t// We do not support signing any delegation role that isn't a direct child of the targets role.\n\t\t// Also don't bother checking the keys if we can't add the target\n\t\t// to this role due to path restrictions\n\t\tif path.Dir(delegationRole.Name.String()) != data.CanonicalTargetsRole.String() || !delegationRole.CheckPaths(target.Name) {\n\t\t\tcontinue\n\t\t}\n\n\t\tfor _, canonicalKeyID := range delegationRole.KeyIDs {\n\t\t\tif _, ok := allCanonicalKeyIDs[canonicalKeyID]; ok {\n\t\t\t\tsignableRoles = append(signableRoles, delegationRole.Name)\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(signableRoles) == 0 {\n\t\treturn signableRoles, errors.New(\"no valid signing keys for delegation roles\")\n\t}\n\n\treturn signableRoles, nil\n}\n\n// ImageRefAndAuth contains all reference information and the auth config for an image request\ntype ImageRefAndAuth struct {\n\toriginal   string\n\tauthConfig *registrytypes.AuthConfig\n\treference  reference.Named\n\trepoInfo   *RepositoryInfo\n\ttag        string\n\tdigest     digest.Digest\n}\n\n// RepositoryInfo describes a repository\ntype RepositoryInfo struct {\n\tName reference.Named","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L299-L335","documentation":"Returned by GetSignableRoles when delegation roles exist for a repository but the local trust keystore holds none of the keys referenced by those delegations. Signing a target requires a key matching at least one delegation role's KeyIDs; with zero matches, there is nothing to sign with.","triggerScenarios":"Calling trust sign or AddToAllSignableRoles on a repository that has delegation roles (e.g. targets/releases or targets/<signer>) configured on the Notary server, but the local machine never imported the corresponding delegation private keys.","commonSituations":"A teammate set up delegations on the server but you did not load the signer key (docker trust key load); the key was on a YubiKey that is now disconnected; rotating keys without distributing the new private key to all signers.","solutions":["Load the correct delegation private key with 'docker trust key load <keyfile> --name <signer>'.","Reconnect the hardware token (e.g. YubiKey) that holds the signing key.","If the key is lost, have a repo admin re-add your public key to the delegation role and load the matching private key."],"exampleFix":"# before: docker trust sign myrepo:v1  # no local delegation key\n# after:  docker trust key load signer.priv --name alice && docker trust sign myrepo:v1","handlingStrategy":"try-catch","validationCode":"// Before signing, verify a local delegation key exists for at least one role\nfunc hasSigningKey(repo client.Repository) bool {\n\tkeys := repo.GetCryptoService().ListAllKeys()\n\treturn len(keys) > 0\n}","typeGuard":null,"tryCatchPattern":"// Wrap AddToAllSignableRoles and surface a clear message\nfunc signOrGuide(repo client.Repository, t *client.Target) error {\n\terr := trust.AddToAllSignableRoles(repo, t)\n\tif err != nil {\n\t\tif strings.Contains(err.Error(), \"no valid signing keys\") {\n\t\t\treturn fmt.Errorf(\"load a delegation key first: %w\", err)\n\t\t}\n\t\treturn err\n\t}\n\treturn repo.Publish()\n}","preventionTips":["Run 'docker trust key load' to install the signer's private key before signing.","Keep hardware tokens (YubiKey) connected during signing operations.","Distribute updated delegation private keys to all signers after key rotations."],"tags":["trust","notary","signing","delegation","keys"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}