What causes "no signatures or cannot access %s" in docker/cli?

Authenticate first: docker login (or docker login for Docker Hub) so the notary client can obtain a token.

no signatures or cannot access

Error message

no signatures or cannot access %s

What it means

In lookupTrustInfo (common.go:87-94), notaryRepo.GetAllTargetMetadataByName(tag) returned an error that is NOT client.ErrNoSuchTarget. The code logs NotaryError(remote, err) at debug level, then returns a generic 'no signatures or cannot access <remote>'. This is a fallback for any non-'no such target' failure when fetching signed target metadata - typically auth or transport failures.

Solutions

Authenticate first: docker login <registry> (or docker login for Docker Hub) so the notary client can obtain a token.
Confirm network connectivity to the notary server: curl -v <server>/v2/ and check DNS/firewall/proxy.
Verify DOCKER_CONTENT_TRUST_SERVER is correct (or unset to use the default notary.docker.io).
Run with debug logging (DOCKER_DEBUG=1 or -D) to surface the underlying NotaryError that was logged at debug level.
If the repo genuinely has no signatures yet, push with DOCKER_CONTENT_TRUST=1 first to initialize it.

Example fix

# before: not logged in, inspect fails
docker trust inspect myrepo/img:tag  # -> no signatures or cannot access
# after: login then inspect
docker login
docker trust inspect myrepo/img:tag

Defensive patterns

Strategy: validation

Validate before calling

// Ensure auth and connectivity before lookupTrustInfo's GetAllTargetMetadataByName call.
func preflightLookup(repo client.Repository, remote string) error {
    if _, err := repo.GetAllTargetMetadataByName(""); err != nil {
        if _, ok := err.(client.ErrNoSuchTarget); ok {
            return nil // repo exists but has no targets - acceptable
        }
        return fmt.Errorf("no signatures or cannot access %s: %w", remote, err)
    }
    return nil
}

Type guard

func isErrNoSuchTarget(err error) bool {
    if err == nil {
        return false
    }
    _, ok := err.(client.ErrNoSuchTarget)
    return ok
}

Try / catch

allSigned, err := notaryRepo.GetAllTargetMetadataByName(tag)
if err != nil {
    logrus.Debug(trust.NotaryError(remote, err))
    if _, ok := err.(client.ErrNoSuchTarget); !ok {
        return nil, nil, nil, fmt.Errorf("no signatures or cannot access %s", remote)
    }
}

Prevention

Always 'docker login' before running 'docker trust inspect'.
Use -D / debug logging to surface the underlying NotaryError that is otherwise swallowed.
Validate DOCKER_CONTENT_TRUST_SERVER and network path to the notary endpoint.
Distinguish 'repo has no signatures' (ErrNoSuchTarget) from 'cannot access' to give users better guidance.

When it happens

Trigger: Calling 'docker trust inspect'/'docker trust view' when GetAllTargetMetadataByName fails due to a network/transport error to the notary server, an authentication failure (no/invalid registry credentials), a TLS error, or a server-side metadata corruption that is not the specific ErrNoSuchTarget type.

Common situations: Running trust inspect without 'docker login' first so token auth fails; DOCKER_CONTENT_TRUST_SERVER unreachable or misconfigured; corporate firewall blocks notary.docker.io; notary server returns malformed metadata (json.SyntaxError mapped by NotaryError to 'no trust data available'); expired registry token.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/53003ea40693c1ae. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/common.go:92

	}
	tag := imgRefAndAuth.Tag()
	notaryRepo, err := newNotaryClient(cli, imgRefAndAuth, trust.ActionsPullOnly)
	if err != nil {
		return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, trust.NotaryError(imgRefAndAuth.Reference().Name(), err)
	}

	if err = clearChangeList(notaryRepo); err != nil {
		return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, err
	}
	defer clearChangeList(notaryRepo)

	// Retrieve all released signatures, match them, and pretty print them
	allSignedTargets, err := notaryRepo.GetAllTargetMetadataByName(tag)
	if err != nil {
		logrus.Debug(trust.NotaryError(remote, err))
		// print an empty table if we don't have signed targets, but have an initialized notary repo
		if _, ok := err.(client.ErrNoSuchTarget); !ok {
			return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf("no signatures or cannot access %s", remote)
		}
	}
	signatureRows := matchReleasedSignatures(allSignedTargets)

	// get the administrative roles
	adminRolesWithSigs, err := notaryRepo.ListRoles()
	if err != nil {
		return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf("no signers for %s", remote)
	}

	// get delegation roles with the canonical key IDs
	delegationRoles, err := notaryRepo.GetDelegationRoles()
	if err != nil {
		logrus.Debugf("no delegation roles found, or error fetching them for %s: %v", remote, err)
	}

	return signatureRows, adminRolesWithSigs, delegationRoles, nil
}

View on GitHub (pinned to 4f84911bfe)