{"record":{"id":"e1431f4af9193fd3","repo":"docker/cli","slug":"all-signed-tags-are-currently-revoked-use-docker","errorCode":null,"errorMessage":"all signed tags are currently revoked, use docker trust sign to fix","messagePattern":"all signed tags are currently revoked, use docker trust sign to fix","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/signer_remove.go","lineNumber":67,"sourceCode":"\t\t}\n\t}\n\tif len(errRepos) > 0 {\n\t\treturn fmt.Errorf(\"error removing signer from: %s\", strings.Join(errRepos, \", \"))\n\t}\n\treturn nil\n}\n\nfunc isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSignatures) (bool, error) {\n\tvar releasesRoleWithSigs client.RoleWithSignatures\n\tfor _, role := range allRoles {\n\t\tif role.Name == releasesRoleTUFName {\n\t\t\treleasesRoleWithSigs = role\n\t\t\tbreak\n\t\t}\n\t}\n\tcounter := len(releasesRoleWithSigs.Signatures)\n\tif counter == 0 {\n\t\treturn false, errors.New(\"all signed tags are currently revoked, use docker trust sign to fix\")\n\t}\n\tfor _, signature := range releasesRoleWithSigs.Signatures {\n\t\tfor _, key := range roleWithSig.KeyIDs {\n\t\t\tif signature.KeyID == key {\n\t\t\t\tcounter--\n\t\t\t}\n\t\t}\n\t}\n\treturn counter < releasesRoleWithSigs.Threshold, nil\n}\n\nfunc maybePromptForSignerRemoval(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, isLastSigner, forceYes bool) (bool, error) {\n\tif isLastSigner && !forceYes {\n\t\tmessage := fmt.Sprintf(\"The signer \\\"%s\\\" signed the last released version of %s. \"+\n\t\t\t\"Removing this signer will make %s unpullable. \"+\n\t\t\t\"Are you sure you want to continue?\",\n\t\t\tsignerName, repoName, repoName,\n\t\t)","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/trust/signer_remove.go#L49-L85","documentation":"Returned by isLastSignerForReleases when the targets/releases role has zero signatures (all of them were previously revoked). The function cannot determine whether removing a signer would drop below the threshold because there is no active signed release to count against, so it errors and directs the user to re-sign.","triggerScenarios":"Running 'docker trust signer remove <name> <repo>' on a repository whose releases role currently has no valid signatures — every previously signed tag was revoked.","commonSituations":"Revoking all signatures (docker trust revoke) then trying to remove a signer; a repository whose release signatures were all revoked by a previous incident; stale local metadata.","solutions":["Re-sign a tag first: 'docker trust sign repo/image:tag' to restore a valid releases signature.","Retry the signer removal after signing succeeds.","Refresh local trust metadata by pulling the latest targets before removing signers."],"exampleFix":"# before: docker trust signer remove alice myrepo  # releases empty\n# after:  docker trust sign myrepo:v1 && docker trust signer remove alice myrepo","handlingStrategy":"validation","validationCode":"// Before removing a signer, check the releases role has active signatures\nfunc releasesHasSignatures(allRoles []client.RoleWithSignatures) bool {\n\tfor _, r := range allRoles {\n\t\tif r.Name == releasesRoleTUFName && len(r.Signatures) > 0 {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sign at least one tag (docker trust sign) before removing signers from a fully-revoked repo.","Inspect the repository trust state (docker trust inspect) before signer removal.","Refresh local trust metadata to avoid stale role/signature counts."],"tags":["trust","notary","signer","releases","revoked"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}