docker/cli · error

error: remote repository

Error message

error: remote repository %s out-of-date: %v

What it means

Returned by NotaryError (trust.go:238) when the notary error is signed.ErrExpired — TUF metadata (timestamps/snapshots) has expired, so the remote repository's trust data is considered out-of-date. TUF relies on time-bounded metadata to prevent freeze attacks; expired metadata must be refreshed by re-signing/re-publishing.

Solutions

1. Re-publish the repository metadata from a signer that holds the snapshot/timestamp keys (`docker trust signer add` then re-push, or notary CLI publish).
2. Ensure the Notary signer service is running and rotating timestamps automatically.
3. Check for client clock skew (`date`) and sync with NTP.
4. As a last resort rotate the expired keys and re-initialize trust for the repo.

Example fix

# before: pulling against expired timestamp metadata
DOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest

# after: refresh metadata on the signer side, then pull
notary publish example.com/app --server https://notary.example.com
DOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest

// Detect client clock skew that would falsely trip expiry
if skew := ntpSkew(); skew > 5*time.Minute {
    return fmt.Errorf("clock skew %s; sync NTP before trust operations", skew)
}

// Refresh expired metadata then retry once
if errors.Is(err, signed.ErrExpired) {
    if rerr := republishMetadata(repo); rerr == nil {
        err = trustedOp(repo)
    }
}

When it happens

Trigger: The repository's timestamp or snapshot role metadata on the Notary server has passed its expiration (e.g. timestamp keys not rotating, snapshot not re-signed). A trusted pull/push validates metadata timestamps, sees they expired, and raises ErrExpired which NotaryError maps here.

Common situations: A Notary server that stopped publishing snapshot/timestamp updates (the automated signer offline), clock skew between client and server, or a repository left un-touched longer than the role's expiry threshold.

Related errors

• warning: potential malicious behavior - trust data mismatch…
• no valid signing keys for delegation roles
• cannot push a digest reference
• no targets found, provide a specific tag in order to sign it
• could not decrypt key

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/e310642f564ded39. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:238

		if v := env[alias]; v != "" {
			return v, numAttempts > 1, nil
		}
		// For non-root roles, we can also try the "default" alias if it is specified
		if v := env["default"]; v != "" && alias != data.CanonicalRootRole.String() {
			return v, numAttempts > 1, nil
		}
		return baseRetriever(keyName, alias, createNew, numAttempts)
	}
}

// NotaryError formats an error message received from the notary service
func NotaryError(repoName string, err error) error {
	switch err.(type) {
	case *json.SyntaxError:
		logrus.Debugf("Notary syntax error: %s", err)
		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
	case signed.ErrExpired:
		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
	case trustmanager.ErrKeyNotFound:
		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
	case storage.NetworkError:
		return fmt.Errorf("error: error contacting notary server: %v", err)
	case storage.ErrMetaNotFound:
		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
	case signed.ErrNoKeys:
		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
	case signed.ErrLowVersion:
		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
	case signed.ErrRoleThreshold:
		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
	case client.ErrRepositoryNotExist:
		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)
	case signed.ErrInsufficientSignatures:
		return fmt.Errorf("error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)

View on GitHub (pinned to 4f84911bfe)