docker/cli · error

unable to read public key from file: %w

Error message

unable to read public key from file: %w

What it means

Error "unable to read public key from file: %w" thrown in docker/cli.

Source

Thrown at cmd/docker-trust/trust/signer_add.go:121

		}
	}

	newSignerRoleName := data.RoleName(path.Join(data.CanonicalTargetsRole.String(), signerName))

	if err := addStagedSigner(notaryRepo, newSignerRoleName, signerPubKeys); err != nil {
		return fmt.Errorf("could not add signer to repo: %s: %w", strings.TrimPrefix(newSignerRoleName.String(), "targets/"), err)
	}

	return notaryRepo.Publish()
}

func ingestPublicKeys(pubKeyPaths []string) ([]data.PublicKey, error) {
	pubKeys := []data.PublicKey{}
	for _, pubKeyPath := range pubKeyPaths {
		// Read public key bytes from PEM file, limit to 1 KiB
		pubKeyFile, err := os.OpenFile(pubKeyPath, os.O_RDONLY, 0o666)
		if err != nil {
			return nil, fmt.Errorf("unable to read public key from file: %w", err)
		}
		defer pubKeyFile.Close()
		// limit to
		l := io.LimitReader(pubKeyFile, 1<<20)
		pubKeyBytes, err := io.ReadAll(l)
		if err != nil {
			return nil, fmt.Errorf("unable to read public key from file: %w", err)
		}

		// Parse PEM bytes into type PublicKey
		pubKey, err := tufutils.ParsePEMPublicKey(pubKeyBytes)
		if err != nil {
			return nil, fmt.Errorf("could not parse public key from file: %s: %w", pubKeyPath, err)
		}
		pubKeys = append(pubKeys, pubKey)
	}
	return pubKeys, nil
}

View on GitHub (pinned to e9452d6e78)

When it happens

Trigger: Thrown at cmd/docker-trust/trust/signer_add.go:121 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of docker/cli@e9452d6e78 (2026-08-01). Data as JSON: /data/errors/5619492f779ee8cb.json. Report an issue: GitHub.