releases is a reserved keyword, use a different signer name

Error message

releases is a reserved keyword, use a different signer name

What it means

Returned by addSigner when the requested signer name is 'releases'. The name 'releases' maps to the reserved targets/releases role in Notary, which Docker manages internally; creating a user signer with that name would collide with the reserved delegation role.

Solutions

Pick a different signer name such as 'release-team', 'deploy', or a username.
Check reserved keywords (currently 'releases') before choosing a signer name.
If you already published data under targets/releases, it is system-managed — use a distinct delegation name for human signers.

Example fix

# before: docker trust signer add releases alice.pub myrepo
# after:  docker trust signer add release-team alice.pub myrepo

Defensive patterns

Strategy: validation

Validate before calling

// Reject reserved signer names up front
func validateSignerName(name string) error {
	if name == "releases" {
		return errors.New("releases is a reserved keyword, use a different signer name")
	}
	return nil
}

Prevention

Avoid 'releases' as a signer name; it is reserved for targets/releases.
Validate signer names against the reserved-keyword list before invoking add.
Adopt a naming convention (team/user names) that never collides with TUF reserved roles.

When it happens

Trigger: Running 'docker trust signer add releases ...' — the name check at signer_add.go:55 rejects it after the general name-format regex passes.

Common situations: Choosing 'releases' as a team/role name; migrating from a naming scheme that used 'releases'; misunderstanding that 'releases' is special in DCT.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/2bd31ff6e6bac172. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/trust/signer_add.go:56

			return addSigner(cmd.Context(), dockerCLI, options)
		},
		DisableFlagsInUseLine: true,
	}
	flags := cmd.Flags()
	options.keys = opts.NewListOpts(nil)
	flags.Var(&options.keys, "key", "Path to the signer's public key file")
	return cmd
}

var validSignerName = lazyregexp.New(`^[a-z0-9][a-z0-9\_\-]*$`).MatchString

func addSigner(ctx context.Context, dockerCLI command.Cli, options signerAddOptions) error {
	signerName := options.signer
	if !validSignerName(signerName) {
		return fmt.Errorf("signer name \"%s\" must start with lowercase alphanumeric characters and can include \"-\" or \"_\" after the first character", signerName)
	}
	if signerName == "releases" {
		return errors.New("releases is a reserved keyword, use a different signer name")
	}

	if options.keys.Len() == 0 {
		return errors.New("path to a public key must be provided using the `--key` flag")
	}
	signerPubKeys, err := ingestPublicKeys(options.keys.GetSlice())
	if err != nil {
		return err
	}
	var errRepos []string
	for _, repoName := range options.repos {
		_, _ = fmt.Fprintf(dockerCLI.Out(), "Adding signer \"%s\" to %s...\n", signerName, repoName)
		if err := addSignerToRepo(ctx, dockerCLI, signerName, repoName, signerPubKeys); err != nil {
			_, _ = fmt.Fprintln(dockerCLI.Err(), err.Error()+"\n")
			errRepos = append(errRepos, repoName)
		} else {
			_, _ = fmt.Fprintf(dockerCLI.Out(), "Successfully added signer: %s to %s\n\n", signerName, repoName)
		}

View on GitHub (pinned to 4f84911bfe)