Skip to content

Conversation

@thaJeztah
Copy link
Member

Docker Hub's Notary service is being retired, and now produces failures in most cases. Add a warning when attempting to use it, pending full removal of trust;
https://www.docker.com/blog/retiring-docker-content-trust/

With this PR:

DOCKER_CONTENT_TRUST=1 docker pull -q hello-world
WARNING: Docker is retiring DCT for Docker Official Images (DOI).
         For details, refer to https://docs.docker.com/go/dct-deprecation/

could not validate the path to a trusted root: unable to retrieve valid leaf certificates

(cherry picked from commit 5d591f2)

- What I did

- How I did it

- How to verify it

- Human readable description for the release notes

- A picture of a cute animal (not mandatory but encouraged)

return nil, err
}
if server == NotaryServer {
_, _ = fmt.Fprint(os.Stderr, dctDeprecation)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fmt import is missing

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, derp; master is no longer using pkg/errors probably because of that; let me fix

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be good now, PTAL 👍

Docker Hub's Notary service is being retired, and now produces
failures in most cases. Add a warning when attempting to use
it, pending full removal of trust;
https://www.docker.com/blog/retiring-docker-content-trust/

With this PR:

    DOCKER_CONTENT_TRUST=1 docker pull -q hello-world
    WARNING: Docker is retiring DCT for Docker Official Images (DOI).
             For details, refer to https://docs.docker.com/go/dct-deprecation/

    could not validate the path to a trusted root: unable to retrieve valid leaf certificates

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 43b03ef)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah thaJeztah force-pushed the 28.x_backport_dct_retiring branch from 477a9e8 to 0351ece Compare September 26, 2025 09:24
@codecov-commenter
Copy link

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
cli/trust/trust.go 0.00% 3 Missing ⚠️

📢 Thoughts on this report? Let us know!

@thaJeztah thaJeztah requested a review from vvoland September 26, 2025 09:35
@austinvazquez austinvazquez merged commit e5bce5c into docker:28.x Sep 26, 2025
91 of 93 checks passed
@thaJeztah thaJeztah deleted the 28.x_backport_dct_retiring branch September 26, 2025 15:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants