{"id":"ec25eef693280181","repo":"docker/cli","slug":"provided-file-s-is-not-a-supported-private-key","errorCode":null,"errorMessage":"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add","messagePattern":"provided file (.+?) is not a supported private key - to add a signer's public key use docker trust signer add","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/trust/key_load.go","lineNumber":96,"sourceCode":"\t\t}\n\t\tif fileInfo.Mode()&nonOwnerReadWriteMask != 0 {\n\t\t\treturn nil, fmt.Errorf(\"private key file %s must not be readable or writable by others\", keyPath)\n\t\t}\n\t}\n\n\tfrom, err := os.OpenFile(keyPath, os.O_RDONLY, notary.PrivExecPerms)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdefer from.Close()\n\n\treturn io.ReadAll(from)\n}\n\nfunc loadPrivKeyBytesToStore(privKeyBytes []byte, privKeyImporters []trustmanager.Importer, keyPath, keyName string, passRet notary.PassRetriever) error {\n\tvar err error\n\tif _, _, err = tufutils.ExtractPrivateKeyAttributes(privKeyBytes); err != nil {\n\t\treturn fmt.Errorf(\"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add\", keyPath)\n\t}\n\tif privKeyBytes, err = decodePrivKeyIfNecessary(privKeyBytes, passRet); err != nil {\n\t\treturn fmt.Errorf(\"cannot load key from provided file %s: %w\", keyPath, err)\n\t}\n\t// Make a reader, rewind the file pointer\n\treturn trustmanager.ImportKeys(bytes.NewReader(privKeyBytes), privKeyImporters, keyName, \"\", passRet)\n}\n\nfunc decodePrivKeyIfNecessary(privPemBytes []byte, passRet notary.PassRetriever) ([]byte, error) {\n\tpemBlock, _ := pem.Decode(privPemBytes)\n\t_, containsDEKInfo := pemBlock.Headers[\"DEK-Info\"]\n\tif containsDEKInfo || pemBlock.Type == \"ENCRYPTED PRIVATE KEY\" {\n\t\t// if we do not have enough information to properly import, try to decrypt the key\n\t\tif _, ok := pemBlock.Headers[\"path\"]; !ok {\n\t\t\tprivKey, _, err := trustmanager.GetPasswdDecryptBytes(passRet, privPemBytes, \"\", \"encrypted\")\n\t\t\tif err != nil {\n\t\t\t\treturn []byte{}, errors.New(\"could not decrypt key\")\n\t\t\t}","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/docker/cli/blob/e9452d6e785f6e365712b9d71bd7517591773c86/cmd/docker-trust/trust/key_load.go#L78-L114","documentation":"Error \"provided file %s is not a supported private key - to add a signer's public key use docker trust signer add\" thrown in docker/cli.","triggerScenarios":"Thrown at cmd/docker-trust/trust/key_load.go:96 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"e9452d6e785f6e365712b9d71bd7517591773c86","analyzedAt":"2026-08-01T07:09:22.474Z","schemaVersion":2}