docker/cli · error

no signers for

Error message

no signers for %s

What it means

In lookupTrustInfo (common.go:98-101), notaryRepo.ListRoles() failed, so the function returns 'no signers for <remote>'. ListRoles fetches the administrative roles (root, targets, snapshot, timestamp) and any delegation roles from the notary server. A failure here usually means the repository metadata could not be read - the repository may not be initialized, the server is unreachable, or auth failed.

Solutions

1. Confirm the repository is initialized on the notary server by doing a trusted push first (DOCKER_CONTENT_TRUST=1 docker push <img>:<tag>).
2. Re-authenticate: docker login <registry> so the notary client can read role metadata.
3. Verify DOCKER_CONTENT_TRUST_SERVER and network reachability of the notary endpoint.
4. Enable debug logging (-D) to capture the underlying ListRoles error for a more specific cause.
5. If the repository is on Docker Hub, remember DCT for Official Images is being retired - confirm the GUN is still supported.

Example fix

# before: repo not initialized
docker trust inspect myrepo/img:tag  # -> no signers
# after: initialize then inspect
DOCKER_CONTENT_TRUST=1 docker push myrepo/img:tag
docker trust inspect myrepo/img:tag

// Confirm the repo is initialized and reachable before calling ListRoles.
func preflightRoles(repo client.Repository, remote string) error {
    if _, err := repo.ListRoles(); err != nil {
        if _, ok := err.(client.ErrRepositoryNotExist); ok {
            return fmt.Errorf("%s not initialized; trusted-push first", remote)
        }
        return fmt.Errorf("no signers for %s: %w", remote, err)
    }
    return nil
}

adminRoles, err := notaryRepo.ListRoles()
if err != nil {
    return nil, nil, nil, fmt.Errorf("no signers for %s", remote)
}

When it happens

Trigger: Calling 'docker trust inspect'/'docker trust view' on a repository where ListRoles returns an error: repo not initialized on the notary server (no root.json), auth failure reading the roles metadata, network/TLS error reaching the notary server, or the notary server returned an error status.

Common situations: Inspecting an image that was never trust-pushed; 'docker login' not done or credentials expired; DOCKER_CONTENT_TRUST_SERVER points to wrong server; network blocking notary endpoint; the notary repository exists but roles metadata is corrupt/missing after a botched rotation.

Related errors

• no signatures or cannot access
• error establishing connection to trust repository
• error: could not find signing keys for remote repository
• warning: potential malicious behavior - trust data version…
• warning: potential malicious behavior - trust data has…

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/c144dd414558076a. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/common.go:100

		return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, err
	}
	defer clearChangeList(notaryRepo)

	// Retrieve all released signatures, match them, and pretty print them
	allSignedTargets, err := notaryRepo.GetAllTargetMetadataByName(tag)
	if err != nil {
		logrus.Debug(trust.NotaryError(remote, err))
		// print an empty table if we don't have signed targets, but have an initialized notary repo
		if _, ok := err.(client.ErrNoSuchTarget); !ok {
			return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf("no signatures or cannot access %s", remote)
		}
	}
	signatureRows := matchReleasedSignatures(allSignedTargets)

	// get the administrative roles
	adminRolesWithSigs, err := notaryRepo.ListRoles()
	if err != nil {
		return []trustTagRow{}, []client.RoleWithSignatures{}, []data.Role{}, fmt.Errorf("no signers for %s", remote)
	}

	// get delegation roles with the canonical key IDs
	delegationRoles, err := notaryRepo.GetDelegationRoles()
	if err != nil {
		logrus.Debugf("no delegation roles found, or error fetching them for %s: %v", remote, err)
	}

	return signatureRows, adminRolesWithSigs, delegationRoles, nil
}

func formatAdminRole(roleWithSigs client.RoleWithSignatures) string {
	adminKeyList := roleWithSigs.KeyIDs
	sort.Strings(adminKeyList)

	var role string
	switch roleWithSigs.Name {
	case data.CanonicalTargetsRole:

View on GitHub (pinned to 4f84911bfe)