no targets found, provide a specific tag in order to sign it

Error message

no targets found, provide a specific tag in order to sign it

What it means

Returned by PushTrustedReference when the push stream produced no valid signable target: the handleTarget callback either was never invoked with a usable PushResult or set notaryTarget to nil because the manifest digest could not be hex-decoded. Without a target (name+hash+size) there is nothing to register in the trust metadata.

Solutions

Retry the push — transient registry aux-omission can resolve on a clean push.
Ensure you are pushing a concrete tag (not a digest or bare name) against a registry that returns push aux metadata.
Verify the image manifest is valid and the digest is a standard sha256; rebuild the image if the manifest is corrupt.

Example fix

# before: docker push myrepo:latest  # no usable target extracted
# after:  docker build -t myrepo:latest . && docker push myrepo:latest   # retry with a fresh manifest

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure an explicit tag is used so the push aux callback can extract a target
func ensureTagForTrust(ref reference.Named) (string, error) {
	if t, ok := ref.(reference.Tagged); ok { return t.Tag(), nil }
	return "", errors.New("provide a specific tag in order to sign it")
}

Try / catch

// Retry once on 'no targets found' since it can be a transient aux omission
err = trust.PushTrustedReference(...)
if err != nil && strings.Contains(err.Error(), "no targets found") {
    // rebuild/re-push by tag and retry
    err = trust.PushTrustedReference(...)
}

Prevention

Push a concrete tag (not a digest or bare name) so the registry returns push aux metadata.
Verify the manifest is valid (docker image inspect) before trusted push.
Retry once on transient target-extraction failures before treating as a hard error.

When it happens

Trigger: A trusted push whose aux JSON message had an unparseable or empty digest, or cnt==0 because the registry returned no push-result aux payload for the tag; essentially the push succeeded at the registry level but the trust layer could not extract a target to sign.

Common situations: Pushing with an explicit tag but the registry/manifest format did not emit the expected aux field; partial/older registry that omits PushResult digest; a manifest digest algorithm the client cannot hex-decode.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/32a8a71c064085d2. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust_push.go:97

		// We want trust signatures to always take an explicit tag,
		// otherwise it will act as an untrusted push.
		if err := jsonstream.Display(ctx, in, ioStreams.Out()); err != nil {
			return err
		}
		_, _ = fmt.Fprintln(ioStreams.Err(), "No tag specified, skipping trust metadata push")
		return nil
	}

	if err := jsonstream.Display(ctx, in, ioStreams.Out(), jsonstream.WithAuxCallback(handleTarget)); err != nil {
		return err
	}

	if cnt > 1 {
		return errors.New("internal error: only one call to handleTarget expected")
	}

	if notaryTarget == nil {
		return errors.New("no targets found, provide a specific tag in order to sign it")
	}

	_, _ = fmt.Fprintln(ioStreams.Out(), "Signing and pushing trust metadata")

	repo, err := GetNotaryRepository(ioStreams.In(), ioStreams.Out(), userAgent, repoInfo, &authConfig, "push", "pull")
	if err != nil {
		return fmt.Errorf("error establishing connection to trust repository: %w", err)
	}

	// get the latest repository metadata so we can figure out which roles to sign
	_, err = repo.ListTargets()

	switch err.(type) {
	case client.ErrRepoNotInitialized, client.ErrRepositoryNotExist:
		keys := repo.GetCryptoService().ListKeys(data.CanonicalRootRole)
		var rootKeyID string
		// always select the first root key
		if len(keys) > 0 {

View on GitHub (pinned to 4f84911bfe)