docker/cli · error

no valid signing keys for delegation roles

Error message

no valid signing keys for delegation roles

What it means

Error "no valid signing keys for delegation roles" thrown in docker/cli.

Source

Thrown at cmd/docker-trust/internal/trust/trust.go:317

	// and attempt to sign in to all those roles.
	for _, delegationRole := range allDelegationRoles {
		// We do not support signing any delegation role that isn't a direct child of the targets role.
		// Also don't bother checking the keys if we can't add the target
		// to this role due to path restrictions
		if path.Dir(delegationRole.Name.String()) != data.CanonicalTargetsRole.String() || !delegationRole.CheckPaths(target.Name) {
			continue
		}

		for _, canonicalKeyID := range delegationRole.KeyIDs {
			if _, ok := allCanonicalKeyIDs[canonicalKeyID]; ok {
				signableRoles = append(signableRoles, delegationRole.Name)
				break
			}
		}
	}

	if len(signableRoles) == 0 {
		return signableRoles, errors.New("no valid signing keys for delegation roles")
	}

	return signableRoles, nil
}

// ImageRefAndAuth contains all reference information and the auth config for an image request
type ImageRefAndAuth struct {
	original   string
	authConfig *registrytypes.AuthConfig
	reference  reference.Named
	repoInfo   *RepositoryInfo
	tag        string
	digest     digest.Digest
}

// RepositoryInfo describes a repository
type RepositoryInfo struct {
	Name reference.Named

View on GitHub (pinned to e9452d6e78)

When it happens

Trigger: Thrown at cmd/docker-trust/internal/trust/trust.go:317 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/c96a2321968545e6.json. Report an issue: GitHub.