{"record":{"id":"d9a35071fc5ab6c6","repo":"docker/cli","slug":"error-trust-data-missing-for-remote-repository-s","errorCode":null,"errorMessage":"error: trust data missing for remote repository %s or remote repository not found: %v","messagePattern":"error: trust data missing for remote repository (.+?) or remote repository not found: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/trust/trust.go","lineNumber":244,"sourceCode":"\t\t}\n\t\treturn baseRetriever(keyName, alias, createNew, numAttempts)\n\t}\n}\n\n// NotaryError formats an error message received from the notary service\nfunc NotaryError(repoName string, err error) error {\n\tswitch err.(type) {\n\tcase *json.SyntaxError:\n\t\tlogrus.Debugf(\"Notary syntax error: %s\", err)\n\t\treturn fmt.Errorf(\"error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address\", repoName)\n\tcase signed.ErrExpired:\n\t\treturn fmt.Errorf(\"error: remote repository %s out-of-date: %v\", repoName, err)\n\tcase trustmanager.ErrKeyNotFound:\n\t\treturn fmt.Errorf(\"error: signing keys for remote repository %s not found: %v\", repoName, err)\n\tcase storage.NetworkError:\n\t\treturn fmt.Errorf(\"error: error contacting notary server: %v\", err)\n\tcase storage.ErrMetaNotFound:\n\t\treturn fmt.Errorf(\"error: trust data missing for remote repository %s or remote repository not found: %v\", repoName, err)\n\tcase trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data mismatch for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrNoKeys:\n\t\treturn fmt.Errorf(\"error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v\", repoName, err)\n\tcase signed.ErrLowVersion:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v\", repoName, err)\n\tcase signed.ErrRoleThreshold:\n\t\treturn fmt.Errorf(\"warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v\", repoName, err)\n\tcase client.ErrRepositoryNotExist:\n\t\treturn fmt.Errorf(\"error: remote trust data does not exist for %s: %v\", repoName, err)\n\tcase signed.ErrInsufficientSignatures:\n\t\treturn fmt.Errorf(\"error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v\", repoName, err)\n\tdefault:\n\t\treturn err\n\t}\n}\n\n// AddToAllSignableRoles attempts to add the image target to all the top level","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/trust/trust.go#L226-L262","documentation":"Returned by NotaryError (trust.go:244) when the notary error is storage.ErrMetaNotFound — specific TUF metadata (e.g. targets, snapshot, or root role file) that the client expected to find is absent on the server. The message covers both 'trust data missing for this repo' and 'the remote repository does not exist yet on the trust server'.","triggerScenarios":"Trusted operation against a repository that exists in the image registry but was never initialized in Notary, or where a required role's metadata file was deleted on the server side. The client requests a role and storage returns ErrMetaNotFound.","commonSituations":"Pulling with DOCKER_CONTENT_TRUST=1 from a repo that was pushed without trust, a Notary DB that lost a role file, or a typo in the repository name that maps to a non-existent trust collection.","solutions":["Initialize and publish trust for the repo: push with DOCKER_CONTENT_TRUST=1 from an authorized signer.","Verify the exact repository name (including registry namespace) matches what was signed.","If the data was deleted server-side, re-bootstrap the trust collection with the root key.","Pull without trust (unset DOCKER_CONTENT_TRUST) if integrity is not required."],"exampleFix":"# before: trust data absent for an unsigned repo\nDOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest\n\n# after: sign+publish first, then pull\nDOCKER_CONTENT_TRUST=1 docker push example.com/app:latest\nDOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest","handlingStrategy":"validation","validationCode":"// Check trust data exists before requiring it\nresp, err := http.Head(trustServer + \"/v2/\" + repoName + \"/_trust/\")\nif err != nil || resp.StatusCode == http.StatusNotFound {\n    return fmt.Errorf(\"no trust collection for %s; initialize or pull without trust\", repoName)\n}","typeGuard":null,"tryCatchPattern":"// Fall back to untrusted pull only when policy permits\nif errors.Is(err, storage.ErrMetaNotFound) && allowUntrusted {\n    return untrustedPull(img)\n}","preventionTips":["Initialize trust (push signed) before enforcing it on pull.","Double-check the repository name/namespace.","Document which repos are trusted in your environment."],"tags":["trust","notary","metadata","configuration"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}