docker/cli · error

all signed tags are currently revoked, use docker trust…

Error message

all signed tags are currently revoked, use docker trust sign to fix

What it means

Returned by isLastSignerForReleases when the targets/releases role has zero signatures (all of them were previously revoked). The function cannot determine whether removing a signer would drop below the threshold because there is no active signed release to count against, so it errors and directs the user to re-sign.

Solutions

1. Re-sign a tag first: 'docker trust sign repo/image:tag' to restore a valid releases signature.
2. Retry the signer removal after signing succeeds.
3. Refresh local trust metadata by pulling the latest targets before removing signers.

Example fix

# before: docker trust signer remove alice myrepo  # releases empty
# after:  docker trust sign myrepo:v1 && docker trust signer remove alice myrepo

// Before removing a signer, check the releases role has active signatures
func releasesHasSignatures(allRoles []client.RoleWithSignatures) bool {
	for _, r := range allRoles {
		if r.Name == releasesRoleTUFName && len(r.Signatures) > 0 {
			return true
		}
	}
	return false
}

When it happens

Trigger: Running 'docker trust signer remove <name> <repo>' on a repository whose releases role currently has no valid signatures — every previously signed tag was revoked.

Common situations: Revoking all signatures (docker trust revoke) then trying to remove a signer; a repository whose release signatures were all revoked by a previous incident; stale local metadata.

Related errors

• releases is a reserved keyword and cannot be removed
• releases is a reserved keyword, use a different signer name
• path to a public key must be provided using the `--key` flag
• no valid signing keys for delegation roles
• cannot push a digest reference

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/e1431f4af9193fd3. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/signer_remove.go:67

		}
	}
	if len(errRepos) > 0 {
		return fmt.Errorf("error removing signer from: %s", strings.Join(errRepos, ", "))
	}
	return nil
}

func isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSignatures) (bool, error) {
	var releasesRoleWithSigs client.RoleWithSignatures
	for _, role := range allRoles {
		if role.Name == releasesRoleTUFName {
			releasesRoleWithSigs = role
			break
		}
	}
	counter := len(releasesRoleWithSigs.Signatures)
	if counter == 0 {
		return false, errors.New("all signed tags are currently revoked, use docker trust sign to fix")
	}
	for _, signature := range releasesRoleWithSigs.Signatures {
		for _, key := range roleWithSig.KeyIDs {
			if signature.KeyID == key {
				counter--
			}
		}
	}
	return counter < releasesRoleWithSigs.Threshold, nil
}

func maybePromptForSignerRemoval(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, isLastSigner, forceYes bool) (bool, error) {
	if isLastSigner && !forceYes {
		message := fmt.Sprintf("The signer \"%s\" signed the last released version of %s. "+
			"Removing this signer will make %s unpullable. "+
			"Are you sure you want to continue?",
			signerName, repoName, repoName,
		)

View on GitHub (pinned to 4f84911bfe)