docker/cli · error

error: signing keys for remote repository

Error message

error: signing keys for remote repository %s not found: %v

What it means

Returned by NotaryError (trust.go:240) when the notary error is trustmanager.ErrKeyNotFound — the local or YubiKey keystore does not contain the signing key required to sign the target role for the repository. Without the key the client cannot produce a valid signature, so signing/push aborts.

Solutions

1. Import the targets/releases signing key: `docker trust key load key.pem --name <signer>`.
2. If using a YubiKey, plug it in and ensure notary sees it.
3. Add yourself as a delegation signer again (`docker trust signer add`) and re-push.
4. Rotate the targets key with the root key holder and re-initialize if the key is truly lost.

Example fix

# before: signing without the key present
docker trust sign example.com/app:latest

# after: load the key first, then sign
docker trust key load ./targets.key --name alice
docker trust sign example.com/app:latest

// Confirm the signing key is present before pushing
found := false
for _, k := range repo.GetCryptoService().ListAllKeys() {
    if strings.Contains(k, targetsRole) { found = true; break }
}
if !found { return errors.New("signing key not loaded; run docker trust key load") }

// On missing key, prompt load then retry the sign
if errors.Is(err, trustmanager.ErrKeyNotFound) {
    if lerr := loadKey("./targets.key"); lerr == nil {
        err = repo.AddTarget(target, roles...)
    }
}

When it happens

Trigger: Performing a trusted push/sign (`docker push` with DOCKER_CONTENT_TRUST=1, or `docker trust sign`) when the private key for the targets/releases role is absent from ~/.docker/trust/private (or the attached hardware token). trustmanager lookups raise ErrKeyNotFound.

Common situations: New machine without the signing key, key stored on a YubiKey that is unplugged, key imported with the wrong passphrase (so it decrypts to nothing), or a repo whose targets key was rotated by another signer.

Related errors

• no valid signing keys for delegation roles
• no targets found, provide a specific tag in order to sign it
• could not decrypt key
• path to a public key must be provided using the `--key` flag
• could not remove signature for

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/6af5d4dc572dfc5d. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:240

		}
		// For non-root roles, we can also try the "default" alias if it is specified
		if v := env["default"]; v != "" && alias != data.CanonicalRootRole.String() {
			return v, numAttempts > 1, nil
		}
		return baseRetriever(keyName, alias, createNew, numAttempts)
	}
}

// NotaryError formats an error message received from the notary service
func NotaryError(repoName string, err error) error {
	switch err.(type) {
	case *json.SyntaxError:
		logrus.Debugf("Notary syntax error: %s", err)
		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
	case signed.ErrExpired:
		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
	case trustmanager.ErrKeyNotFound:
		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
	case storage.NetworkError:
		return fmt.Errorf("error: error contacting notary server: %v", err)
	case storage.ErrMetaNotFound:
		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
	case signed.ErrNoKeys:
		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
	case signed.ErrLowVersion:
		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
	case signed.ErrRoleThreshold:
		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
	case client.ErrRepositoryNotExist:
		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)
	case signed.ErrInsufficientSignatures:
		return fmt.Errorf("error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)
	default:
		return err

View on GitHub (pinned to 4f84911bfe)