docker/cli · error

error: remote trust data does not exist for

Error message

error: remote trust data does not exist for %s: %v

What it means

Returned by NotaryError for client.ErrRepositoryNotExist (trust.go:253-254). The notary server responded that there is no trust repository (no root.json / metadata) for the given GUN at all. This differs from missing targets: the repository itself was never initialized on the server.

Solutions

  1. Confirm the image was pushed with content trust enabled: perform a trusted push (DOCKER_CONTENT_TRUST=1 docker push <img>:<tag>) to initialize the notary repository.
  2. Verify DOCKER_CONTENT_TRUST_SERVER points to the notary server that actually hosts the repo (default https://notary.docker.io for Docker Hub); correct the env var or unset it.
  3. Double-check the repository name/registry spelling so the resolved GUN matches the one initialized on the server.
  4. Ensure registry credentials have access; some notary servers return 'not exist' rather than 'forbidden' for unauthorized GUNs - re-auth with 'docker login'.

Example fix

# before: repo never initialized on notary server
docker trust inspect myrepo/img:tag  # -> remote trust data does not exist
# after: initialize via trusted push
DOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag
docker trust inspect myrepo/img:tag
Defensive patterns

Strategy: validation

Validate before calling

// Before inspecting, check whether the notary server has a repository for the GUN.
func repoInitialized(repo client.Repository, gun string) error {
    if _, err := repo.ListTargets(); err != nil {
        if _, ok := err.(client.ErrRepositoryNotExist); ok {
            return fmt.Errorf("%s has no trust data; push with DOCKER_CONTENT_TRUST=1 first", gun)
        }
        return trust.NotaryError(gun, err)
    }
    return nil
}

Type guard

func isRepoNotExist(err error) bool {
    if err == nil {
        return false
    }
    _, ok := err.(client.ErrRepositoryNotExist)
    return ok
}

Try / catch

if _, err := repo.ListTargets(); err != nil {
    if _, ok := err.(client.ErrRepositoryNotExist); ok {
        // Not an error in all flows: report that the repo is unsigned.
        return nil
    }
    return trust.NotaryError(gun, err)
}

Prevention

When it happens

Trigger: Calling ListTargets/GetAllTargetMetadataByName/ListRoles/lookupTrustInfo against a GUN that has never had a trusted push (so the notary server has no metadata for it); pointing at the wrong notary server (e.g. DOCKER_CONTENT_TRUST_SERVER set to a server that does not host this repo); querying an image whose name/registry resolves to a different GUN than expected.

Common situations: Running 'docker trust inspect' or 'docker trust view' on an image that was pushed without DOCKER_CONTENT_TRUST; querying a private registry whose notary server is separate and not configured; typo in repository name or registry hostname producing a different GUN; image lives on Docker Hub but DOCKER_CONTENT_TRUST_SERVER points to a self-hosted notary.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/18f548534b760e99. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:254

		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
	case signed.ErrExpired:
		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
	case trustmanager.ErrKeyNotFound:
		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
	case storage.NetworkError:
		return fmt.Errorf("error: error contacting notary server: %v", err)
	case storage.ErrMetaNotFound:
		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
	case signed.ErrNoKeys:
		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
	case signed.ErrLowVersion:
		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
	case signed.ErrRoleThreshold:
		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
	case client.ErrRepositoryNotExist:
		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)
	case signed.ErrInsufficientSignatures:
		return fmt.Errorf("error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)
	default:
		return err
	}
}

// AddToAllSignableRoles attempts to add the image target to all the top level
// delegation roles we can (based on whether we have the signing key and whether
// the role's path allows us to).
//
// If there are no delegation roles, we add to the targets role.
func AddToAllSignableRoles(repo client.Repository, target *client.Target) error {
	signableRoles, err := GetSignableRoles(repo, target)
	if err != nil {
		return err
	}

View on GitHub (pinned to 4f84911bfe)