docker/cli · error

no signer for repository

Error message

no signer %s for repository %s

What it means

Returned by removeSingleSigner() in `docker trust signer remove` when GetDelegationRoles() succeeds but none of the returned delegation roles matches the requested signer (targets/<name>). The signer simply does not exist on that repository. %s is the signer name, the second %s is the repository name.

Solutions

1. List current signers with `docker trust inspect <repo>` to see the exact delegation role names.
2. Use the exact signer name shown by the inspect output.
3. If already removed, no action is needed — treat as success.
4. Verify you are targeting the correct repository.

Example fix

// before
$ docker trust signer remove alic reg.io/app
Error: no signer alic for repository reg.io/app

// after — confirm the real name then remove
$ docker trust inspect reg.io/app   # shows signer 'alice'
$ docker trust signer remove alice reg.io/app

// Confirm the signer exists on the repo before attempting removal
func signerPresent(repo, signer string) (bool, error) {
    out, err := exec.Command("docker", "trust", "inspect", repo).CombinedOutput()
    if err != nil { return false, err }
    return strings.Contains(string(out), "\""+signer+"\""), nil
}

// Treat 'no signer' as idempotent success in automation
out, err := exec.CommandContext(ctx, "docker", "trust", "signer", "remove", name, repo).CombinedOutput()
if err != nil && strings.Contains(string(out), "no signer "+name) {
    return nil // already absent; nothing to do
}
return err

When it happens

Trigger: Calling `docker trust signer remove <name> <repo>` where <name> was never added, was already removed, or is misspelled. Also if the wrong repository was specified.

Common situations: Typo in signer name; attempting to remove a signer on the wrong repo; the signer was already removed in a prior run; confusion between local username and the signer role name.

Related errors

• no tag specified
• releases is a reserved keyword, use a different signer name
• path to a public key must be provided using the `--key` flag
• key name " " must start with lowercase alphanumeric…
• public key path does not exist

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/a49c9c4062cab355. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/signer_remove.go:119

		return false, errors.New("releases is a reserved keyword and cannot be removed")
	}
	notaryRepo, err := newNotaryClient(dockerCLI, imgRefAndAuth, trust.ActionsPushAndPull)
	if err != nil {
		return false, trust.NotaryError(imgRefAndAuth.Reference().Name(), err)
	}
	delegationRoles, err := notaryRepo.GetDelegationRoles()
	if err != nil {
		return false, fmt.Errorf("error retrieving signers for %s: %w", repoName, err)
	}
	var role data.Role
	for _, delRole := range delegationRoles {
		if delRole.Name == signerDelegation {
			role = delRole
			break
		}
	}
	if role.Name == "" {
		return false, fmt.Errorf("no signer %s for repository %s", signerName, repoName)
	}
	allRoles, err := notaryRepo.ListRoles()
	if err != nil {
		return false, err
	}

	isLastSigner, err := isLastSignerForReleases(role, allRoles)
	if err != nil {
		return false, err
	}

	ok, err := maybePromptForSignerRemoval(ctx, dockerCLI, repoName, signerName, isLastSigner, forceYes)
	if err != nil {
		return false, err
	}
	if !ok {
		return false, nil
	}

View on GitHub (pinned to 4f84911bfe)