docker/cli · error

error: trust data missing for remote repository

Error message

error: trust data missing for remote repository %s or remote repository not found: %v

What it means

Returned by NotaryError (trust.go:244) when the notary error is storage.ErrMetaNotFound — specific TUF metadata (e.g. targets, snapshot, or root role file) that the client expected to find is absent on the server. The message covers both 'trust data missing for this repo' and 'the remote repository does not exist yet on the trust server'.

Solutions

1. Initialize and publish trust for the repo: push with DOCKER_CONTENT_TRUST=1 from an authorized signer.
2. Verify the exact repository name (including registry namespace) matches what was signed.
3. If the data was deleted server-side, re-bootstrap the trust collection with the root key.
4. Pull without trust (unset DOCKER_CONTENT_TRUST) if integrity is not required.

Example fix

# before: trust data absent for an unsigned repo
DOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest

# after: sign+publish first, then pull
DOCKER_CONTENT_TRUST=1 docker push example.com/app:latest
DOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest

// Check trust data exists before requiring it
resp, err := http.Head(trustServer + "/v2/" + repoName + "/_trust/")
if err != nil || resp.StatusCode == http.StatusNotFound {
    return fmt.Errorf("no trust collection for %s; initialize or pull without trust", repoName)
}

// Fall back to untrusted pull only when policy permits
if errors.Is(err, storage.ErrMetaNotFound) && allowUntrusted {
    return untrustedPull(img)
}

When it happens

Trigger: Trusted operation against a repository that exists in the image registry but was never initialized in Notary, or where a required role's metadata file was deleted on the server side. The client requests a role and storage returns ErrMetaNotFound.

Common situations: Pulling with DOCKER_CONTENT_TRUST=1 from a repo that was pushed without trust, a Notary DB that lost a role file, or a typo in the repository name that maps to a non-existent trust collection.

Related errors

• error: no trust data available for remote repository
• plugin SchemaVersion version cannot be empty
• no valid signing keys for delegation roles
• cannot push a digest reference
• no targets found, provide a specific tag in order to sign it

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/d9a35071fc5ab6c6. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:244

		}
		return baseRetriever(keyName, alias, createNew, numAttempts)
	}
}

// NotaryError formats an error message received from the notary service
func NotaryError(repoName string, err error) error {
	switch err.(type) {
	case *json.SyntaxError:
		logrus.Debugf("Notary syntax error: %s", err)
		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
	case signed.ErrExpired:
		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
	case trustmanager.ErrKeyNotFound:
		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
	case storage.NetworkError:
		return fmt.Errorf("error: error contacting notary server: %v", err)
	case storage.ErrMetaNotFound:
		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
	case signed.ErrNoKeys:
		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
	case signed.ErrLowVersion:
		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
	case signed.ErrRoleThreshold:
		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
	case client.ErrRepositoryNotExist:
		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)
	case signed.ErrInsufficientSignatures:
		return fmt.Errorf("error: could not produce valid signature for %s.  If Yubikey was used, was touch input provided?: %v", repoName, err)
	default:
		return err
	}
}

// AddToAllSignableRoles attempts to add the image target to all the top level

View on GitHub (pinned to 4f84911bfe)