docker/cli · error

error retrieving signers for

Error message

error retrieving signers for %s: %w

What it means

Returned by removeSingleSigner() in `docker trust signer remove` when notaryRepo.GetDelegationRoles() fails to fetch the list of delegation (signer) roles for the repository. %s is the repository name, %w is the notary client error. This is a network/metadata-retrieval failure, not a 'not found' condition.

Solutions

1. Check connectivity to the registry's notary service and that content trust is supported.
2. Re-authenticate with `docker login <registry>`.
3. Inspect the wrapped %w to distinguish ErrRepositoryNotExist/ErrRepoNotInitialized from transport errors.
4. Retry once transient network issues clear.

Example fix

// before
$ docker trust signer remove alice reg.io/app
Error: error retrieving signers for reg.io/app: ...

// after — re-auth and confirm notary reachability
$ docker login reg.io
$ docker trust inspect reg.io/app   # confirms delegation retrieval works
$ docker trust signer remove alice reg.io/app

// Confirm notary reachability before signer remove
func notaryReachable(repo string) error {
    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
    defer cancel()
    out, err := exec.CommandContext(ctx, "docker", "trust", "inspect", repo).CombinedOutput()
    if err != nil { return fmt.Errorf("notary unreachable for %s: %s", repo, out) }
    return nil
}

// Retry delegation retrieval on transient errors with backoff
var last error
for i := 0; i < 3; i++ {
    out, err := exec.CommandContext(ctx, "docker", "trust", "signer", "remove", name, repo).CombinedOutput()
    if err == nil || !strings.Contains(string(out), "error retrieving signers") { return err }
    last = err; time.Sleep(time.Duration(i*i) * time.Second)
}
return last

When it happens

Trigger: Calling `docker trust signer remove <name> <repo>` when the notary server is unreachable, returns an error, the trust repo doesn't exist, or the client lacks pull/push auth for the repo's trust data.

Common situations: Registry without content trust enabled; notary endpoint behind a flaky proxy; credentials expired; DNS resolution failure for the notary host.

Related errors

• failed to sign
• could not add signer to repo
• could not add signer to repo
• error removing signer from
• no valid signing keys for delegation roles

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/9e238ce417234574. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/signer_remove.go:109

// removeSingleSigner attempts to remove a single signer and returns whether signer removal happened.
// The signer not being removed doesn't necessarily raise an error e.g. user choosing "No" when prompted for confirmation.
func removeSingleSigner(ctx context.Context, dockerCLI command.Cli, repoName, signerName string, forceYes bool) (bool, error) {
	imgRefAndAuth, err := trust.GetImageReferencesAndAuth(ctx, authResolver(dockerCLI), repoName)
	if err != nil {
		return false, err
	}

	signerDelegation := data.RoleName("targets/" + signerName)
	if signerDelegation == releasesRoleTUFName {
		return false, errors.New("releases is a reserved keyword and cannot be removed")
	}
	notaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull)
	if err != nil {
		return false, trust.NotaryError(imgRefAndAuth.Reference().Name(), err)
	}
	delegationRoles, err := notaryRepo.GetDelegationRoles()
	if err != nil {
		return false, fmt.Errorf("error retrieving signers for %s: %w", repoName, err)
	}
	var role data.Role
	for _, delRole := range delegationRoles {
		if delRole.Name == signerDelegation {
			role = delRole
			break
		}
	}
	if role.Name == "" {
		return false, fmt.Errorf("no signer %s for repository %s", signerName, repoName)
	}
	allRoles, err := notaryRepo.ListRoles()
	if err != nil {
		return false, err
	}

	isLastSigner, err := isLastSignerForReleases(role, allRoles)
	if err != nil {

View on GitHub (pinned to 4f84911bfe)