key name " " must start with lowercase alphanumeric…

Error message

key name "%s" must start with lowercase alphanumeric characters and can include "-" or "_" after the first character

What it means

In validateKeyArgs (key_generate.go:48-51), the supplied key name fails the regex validKeyName (^[a-z0-9][a-z0-9_\-]*$ defined at key_generate.go:44). Names must start with a lowercase alphanumeric character and may only contain lowercase alphanumeric, underscore, or hyphen thereafter. This validates input to 'docker trust key generate NAME'.

Solutions

Rename the key to match the pattern: lowercase letters/digits first, then optionally '-' or '_', e.g. 'release-key' or 'ci_signing'.
Strip disallowed characters (uppercase, spaces, dots, @) and convert to lowercase.
Ensure the name is non-empty and does not start with '-' or '_'.

Example fix

# before
docker trust key generate ReleaseKey
# after
docker trust key generate release-key

Defensive patterns

Strategy: validation

Validate before calling

// Validate the key name matches the allowed pattern before invoking generate.
var validKeyName = regexp.MustCompile(`^[a-z0-9][a-z0-9\_\-]*$`).MatchString

func validateKeyName(name string) error {
    if !validKeyName(name) {
        return fmt.Errorf("key name %q must start with lowercase alphanumeric and may contain '-' or '_'", name)
    }
    return nil
}

Try / catch

if !validKeyName(name) {
    return fmt.Errorf("key name %q must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", name)
}

Prevention

Adopt a naming convention (kebab-case, lowercase) for trust key names.
Validate names in CI scripts before invoking 'docker trust key generate'.
Avoid spaces, uppercase, and punctuation in key names.

When it happens

Trigger: Running 'docker trust key generate <NAME>' with a NAME that starts with an uppercase letter, digit-only is fine but leading special char is not, contains uppercase, spaces, dots, slashes, or other punctuation; empty name; name starting with '-' or '_'.

Common situations: User passes a human display name like 'ReleaseKey' or 'CI Signing' (uppercase/space); uses an email or domain like 'team@corp' (@ not allowed); copies a UUID with uppercase hex; uses a path-like name 'org/key'.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/1269cc48dad5fc76. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/key_generate.go:50

		RunE: func(cmd *cobra.Command, args []string) error {
			options.name = args[0]
			return setupPassphraseAndGenerateKeys(dockerCLI, options)
		},
		DisableFlagsInUseLine: true,
	}
	flags := cmd.Flags()
	flags.StringVar(&options.directory, "dir", "", "Directory to generate key in, defaults to current directory")
	return cmd
}

// key names can use lowercase alphanumeric + _ + - characters
var validKeyName = lazyregexp.New(`^[a-z0-9][a-z0-9\_\-]*$`).MatchString

// validate that all of the key names are unique and are alphanumeric + _ + -
// and that we do not already have public key files in the target dir on disk
func validateKeyArgs(keyName string, targetDir string) error {
	if !validKeyName(keyName) {
		return fmt.Errorf("key name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", keyName)
	}

	pubKeyFileName := keyName + ".pub"
	if _, err := os.Stat(targetDir); err != nil {
		return fmt.Errorf("public key path does not exist: \"%s\"", targetDir)
	}
	targetPath := filepath.Join(targetDir, pubKeyFileName)
	if _, err := os.Stat(targetPath); err == nil {
		return fmt.Errorf("public key file already exists: \"%s\"", targetPath)
	}
	return nil
}

func setupPassphraseAndGenerateKeys(streams command.Streams, opts keyGenerateOptions) error {
	targetDir := opts.directory
	if targetDir == "" {
		cwd, err := os.Getwd()
		if err != nil {

View on GitHub (pinned to 4f84911bfe)