docker/cli · warning

no signed tags to remove

Error message

no signed tags to remove

What it means

Returned by revokeAllSigs when revoking all signatures (no tag given) but ListTargets returned an empty list for the releases and targets roles. There are no signed tags in the repository, so there is nothing to remove.

Solutions

1. Confirm the repository was actually signed: 'docker trust inspect --pretty repo/image'.
2. If you need signatures, sign a tag first with 'docker trust sign repo/image:tag'.
3. Verify you are using the correct repository/image name and registry.

Example fix

# before: docker trust revoke -y myrepo/img  # nothing signed
# after:  docker trust sign myrepo/img:v1    # sign first, then revoke later if needed

// Before revoking all, check whether any signed targets exist
func hasSignedTargets(repo client.Repository) (bool, error) {
	targets, err := repo.ListTargets(trust.ReleasesRole, data.CanonicalTargetsRole)
	if err != nil { return false, err }
	return len(targets) > 0, nil
}

When it happens

Trigger: Running 'docker trust revoke repo/image' (or with -y) against a repository that has no published signed targets — either it was never signed, or all signatures were already revoked.

Common situations: Revoking from a freshly-created repository that was pushed without DCT; revoking again after a previous full revoke; pointing at the wrong repository name.

Related errors

• cannot use a digest reference for IMAGE:TAG
• trust revoke has been cancelled
• no valid signing keys for delegation roles
• cannot push a digest reference
• no targets found, provide a specific tag in order to sign it

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/724b527cbec02032. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/revoke.go:109

}

func revokeSingleSig(notaryRepo client.Repository, tag string) error {
	releasedTargetWithRole, err := notaryRepo.GetTargetByName(tag, trust.ReleasesRole, data.CanonicalTargetsRole)
	if err != nil {
		return err
	}
	releasedTarget := releasedTargetWithRole.Target
	return getSignableRolesForTargetAndRemove(releasedTarget, notaryRepo)
}

func revokeAllSigs(notaryRepo client.Repository) error {
	releasedTargetWithRoleList, err := notaryRepo.ListTargets(trust.ReleasesRole, data.CanonicalTargetsRole)
	if err != nil {
		return err
	}

	if len(releasedTargetWithRoleList) == 0 {
		return errors.New("no signed tags to remove")
	}

	// we need all the roles that signed each released target so we can remove from all roles.
	for _, releasedTargetWithRole := range releasedTargetWithRoleList {
		// remove from all roles
		if err := getSignableRolesForTargetAndRemove(releasedTargetWithRole.Target, notaryRepo); err != nil {
			return err
		}
	}
	return nil
}

// get all the roles that signed the target and removes it from all roles.
func getSignableRolesForTargetAndRemove(releasedTarget client.Target, notaryRepo client.Repository) error {
	signableRoles, err := trust.GetSignableRoles(notaryRepo, &releasedTarget)
	if err != nil {
		return err
	}

View on GitHub (pinned to 4f84911bfe)