docker/cli · error

no valid signing keys for delegation roles

Error message

no valid signing keys for delegation roles

What it means

Returned by GetSignableRoles when delegation roles exist for a repository but the local trust keystore holds none of the keys referenced by those delegations. Signing a target requires a key matching at least one delegation role's KeyIDs; with zero matches, there is nothing to sign with.

Solutions

1. Load the correct delegation private key with 'docker trust key load <keyfile> --name <signer>'.
2. Reconnect the hardware token (e.g. YubiKey) that holds the signing key.
3. If the key is lost, have a repo admin re-add your public key to the delegation role and load the matching private key.

Example fix

# before: docker trust sign myrepo:v1  # no local delegation key
# after:  docker trust key load signer.priv --name alice && docker trust sign myrepo:v1

// Before signing, verify a local delegation key exists for at least one role
func hasSigningKey(repo client.Repository) bool {
	keys := repo.GetCryptoService().ListAllKeys()
	return len(keys) > 0
}

// Wrap AddToAllSignableRoles and surface a clear message
func signOrGuide(repo client.Repository, t *client.Target) error {
	err := trust.AddToAllSignableRoles(repo, t)
	if err != nil {
		if strings.Contains(err.Error(), "no valid signing keys") {
			return fmt.Errorf("load a delegation key first: %w", err)
		}
		return err
	}
	return repo.Publish()
}

When it happens

Trigger: Calling trust sign or AddToAllSignableRoles on a repository that has delegation roles (e.g. targets/releases or targets/<signer>) configured on the Notary server, but the local machine never imported the corresponding delegation private keys.

Common situations: A teammate set up delegations on the server but you did not load the signer key (docker trust key load); the key was on a YubiKey that is now disconnected; rotating keys without distributing the new private key to all signers.

Related errors

• error: signing keys for remote repository
• failed to sign
• could not add signer to repo
• no targets found, provide a specific tag in order to sign it
• could not decrypt key

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/c96a2321968545e6. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:317

	// and attempt to sign in to all those roles.
	for _, delegationRole := range allDelegationRoles {
		// We do not support signing any delegation role that isn't a direct child of the targets role.
		// Also don't bother checking the keys if we can't add the target
		// to this role due to path restrictions
		if path.Dir(delegationRole.Name.String()) != data.CanonicalTargetsRole.String() || !delegationRole.CheckPaths(target.Name) {
			continue
		}

		for _, canonicalKeyID := range delegationRole.KeyIDs {
			if _, ok := allCanonicalKeyIDs[canonicalKeyID]; ok {
				signableRoles = append(signableRoles, delegationRole.Name)
				break
			}
		}
	}

	if len(signableRoles) == 0 {
		return signableRoles, errors.New("no valid signing keys for delegation roles")
	}

	return signableRoles, nil
}

// ImageRefAndAuth contains all reference information and the auth config for an image request
type ImageRefAndAuth struct {
	original   string
	authConfig *registrytypes.AuthConfig
	reference  reference.Named
	repoInfo   *RepositoryInfo
	tag        string
	digest     digest.Digest
}

// RepositoryInfo describes a repository
type RepositoryInfo struct {
	Name reference.Named

View on GitHub (pinned to 4f84911bfe)