docker/cli · error

all signed tags are currently revoked, use docker trust sign

Error message

all signed tags are currently revoked, use docker trust sign to fix

What it means

Error "all signed tags are currently revoked, use docker trust sign to fix" thrown in docker/cli.

Source

Thrown at cmd/docker-trust/trust/signer_remove.go:67

		}
	}
	if len(errRepos) > 0 {
		return fmt.Errorf("error removing signer from: %s", strings.Join(errRepos, ", "))
	}
	return nil
}

func isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSignatures) (bool, error) {
	var releasesRoleWithSigs client.RoleWithSignatures
	for _, role := range allRoles {
		if role.Name == releasesRoleTUFName {
			releasesRoleWithSigs = role
			break
		}
	}
	counter := len(releasesRoleWithSigs.Signatures)
	if counter == 0 {
		return false, errors.New("all signed tags are currently revoked, use docker trust sign to fix")
	}
	for _, signature := range releasesRoleWithSigs.Signatures {
		for _, key := range roleWithSig.KeyIDs {
			if signature.KeyID == key {
				counter--
			}
		}
	}
	return counter < releasesRoleWithSigs.Threshold, nil
}

func maybePromptForSignerRemoval(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, isLastSigner, forceYes bool) (bool, error) {
	if isLastSigner && !forceYes {
		message := fmt.Sprintf("The signer \"%s\" signed the last released version of %s. "+
			"Removing this signer will make %s unpullable. "+
			"Are you sure you want to continue?",
			signerName, repoName, repoName,
		)

View on GitHub (pinned to e9452d6e78)

When it happens

Trigger: Thrown at cmd/docker-trust/trust/signer_remove.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/e1431f4af9193fd3.json. Report an issue: GitHub.