docker/cli · error

error removing signer from

Error message

error removing signer from: %s

What it means

Returned by `docker trust signer remove` (removeSigner) as an aggregate error when one or more of the listed REPOSITORY targets failed during removeSingleSigner(). Per-repo errors are printed to stderr first; %s is the comma-joined list of repositories that failed. Mirrors the aggregate pattern of signer_add.go:77.

Solutions

1. Read the per-repo errors printed to stderr above this summary for each repo's actual cause.
2. Use `docker trust inspect <repo>` to confirm the signer exists on a repo before removing.
3. Pass `-f`/`--force` if a repo reports the signer is the last signer for releases and you accept making the image unpullable.
4. Retry against only the still-failing repos once their issues are resolved.

Example fix

// before
$ docker trust signer remove alice reg1.io/app reg2.io/app
Removing signer "alice" from reg2.io/app...
no signer alice for repository reg2.io/app
Error: error removing signer from: reg2.io/app

// after — verify presence then remove only where the signer exists
$ docker trust inspect reg2.io/app   # confirm signer list
$ docker trust signer remove alice reg1.io/app

// Pre-check signer presence per repo before bulk remove
func reposWithSigner(repos, signer string) []string {
    var hit []string
    for _, r := range repos {
        out, _ := exec.Command("docker", "trust", "inspect", r).CombinedOutput()
        if strings.Contains(string(out), signer) { hit = append(hit, r) }
    }
    return hit
}

// Bulk remove: surface per-repo stderr, then retry only failing repos
out, err := exec.CommandContext(ctx, "docker", "trust", "signer", "remove", name).CombinedOutput() // + repos
if err != nil {
    return fmt.Errorf("partial remove failed; per-repo details:\n%s", out)
}

When it happens

Trigger: Running `docker trust signer remove <name> <repo1> <repo2>` where at least one repo fails — signer not present (572), delegation retrieval error (571), publish failure, last-signer confirmation declined, or auth/connectivity problems.

Common situations: Bulk-removing a signer across many repos where the signer doesn't exist on some, or some repos are on a registry whose notary service is unreachable.

Related errors

• failed to sign
• could not add signer to repo
• failed to add signer to
• could not add signer to repo
• error retrieving signers for

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/c7e787ad2f8c457b. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/signer_remove.go:52

		},
		DisableFlagsInUseLine: true,
	}
	flags := cmd.Flags()
	flags.BoolVarP(&options.forceYes, "force", "f", false, "Do not prompt for confirmation before removing the most recent signer")
	return cmd
}

func removeSigner(ctx context.Context, dockerCLI command.Cli, options signerRemoveOptions) error {
	var errRepos []string
	for _, repo := range options.repos {
		_, _ = fmt.Fprintf(dockerCLI.Out(), "Removing signer \"%s\" from %s...\n", options.signer, repo)
		if _, err := removeSingleSigner(ctx, dockerCLI, repo, options.signer, options.forceYes); err != nil {
			_, _ = fmt.Fprintln(dockerCLI.Err(), err.Error()+"\n")
			errRepos = append(errRepos, repo)
		}
	}
	if len(errRepos) > 0 {
		return fmt.Errorf("error removing signer from: %s", strings.Join(errRepos, ", "))
	}
	return nil
}

func isLastSignerForReleases(roleWithSig data.Role, allRoles []client.RoleWithSignatures) (bool, error) {
	var releasesRoleWithSigs client.RoleWithSignatures
	for _, role := range allRoles {
		if role.Name == releasesRoleTUFName {
			releasesRoleWithSigs = role
			break
		}
	}
	counter := len(releasesRoleWithSigs.Signatures)
	if counter == 0 {
		return false, errors.New("all signed tags are currently revoked, use docker trust sign to fix")
	}
	for _, signature := range releasesRoleWithSigs.Signatures {
		for _, key := range roleWithSig.KeyIDs {

View on GitHub (pinned to 4f84911bfe)