Docker trust key load does not load key into ~/.docker/trust/private #1095

Activity

1. kyrogue

   changed the title [-]Docker trust key load does not load key into ~/.docker/trust/[/-] [+]Docker trust key load does not load key into ~/.docker/trust/private[/+] on May 31, 2018
2. krockpot commented on Sep 22, 2018

   

   krockpot

   on Sep 22, 2018

   Last edited by krockpot

   More actions

   Bit weird, but seems like the code expects your key to have the "path" header set. Figured this out by looking in Notary's documentation. Was able to import a key formatted like:

   -----BEGIN ENCRYPTED PRIVATE KEY-----
   role: signer
   path: keyid
   ====REDACTED KEY DATA====
   -----END ENCRYPTED PRIVATE KEY-----
   

   Relevant doc: https://godoc.org/github.com/docker/notary/trustmanager#ImportKeys

   Also fyi, if you generate the key with notary, the notary key export command will generate a key in this format for you.

   👍React with 👍6Reacted by rbzn325, Sergey Moiseev, krufab, William Desportes, Filipe Esperandio (Pippo) and Britney Wright

   🎉React with 🎉1Reacted by Filipe Esperandio (Pippo)

   ❤️React with ❤️1Reacted by Filipe Esperandio (Pippo)

   🚀React with 🚀1Reacted by Filipe Esperandio (Pippo)
3. krufab commented on Oct 12, 2020

   

   krufab

   on Oct 12, 2020

   Last edited by krufab

   More actions

   It still fails even with Docker Client 19.03.12.
   The docker trust key import operation ends successfully even if no key is really imported.
   On the other hand, notary key import fails with an ambiguous error: key may be encrypted and does not contain path header and fatal: failed to import all keys: invalid key pem block.
   Apparently, both docker trust key generate and notary key generate create keys which are not able to import afterwards.
   The solution, not documented anywhere, except in the comment above (#1095 (comment)), is to edit the key and add the path field with the key id.
   Example:

   -----BEGIN ENCRYPTED PRIVATE KEY-----
   role: devops
   path: hex_key_id_without_dot_key
   ====REDACTED KEY DATA====
   -----END ENCRYPTED PRIVATE KEY-----
   

   and the key will be imported correctly in the private folder with name as the path specified plus .key (in this case would be: hex_key_id_without_dot_key.key

   Ana alternative and better approach is to export the key with notary as explained here: #2031

   notary -d $HOME/.docker/trust key list
   notary -d $HOME/.docker/trust key export --key key-id -o key-name.pem
   

   👍React with 👍3Reacted by joseph-stanton-ax, Britney Wright and Damir Suleymanov
4. bsousaa

   added

   area/trust

   on Jan 24, 2023
5. thaJeztah commented on May 14, 2026

   

   thaJeztah

   on May 14, 2026

   Member

   More actions

   • closing because we removed docker trust from the CLI; remove support for client-side docker content trust validation #6603
6. thaJeztah

   closed this as not plannedon May 14, 2026