aaif-goose/goose · error

No identity in certificate

Error message

No identity in certificate

What it means

After sigstore_verify::verify succeeds, goose extracts the signer identity from the verified certificate to check it against the expected GitHub Actions workflow. This error means the certificate verified but carried no identity (missing SAN extension) — a malformed provenance certificate from the release pipeline rather than a local environment problem.

Source

Thrown at crates/goose-cli/src/commands/update.rs:176

// Verify a single attestation bundle against the artifact digest and workflow.
fn verify_bundle(
    bundle_json: &serde_json::Value,
    artifact_digest: Sha256Hash,
    policy: &VerificationPolicy,
    trusted_root: &TrustedRoot,
    workflow: &str,
) -> Result<()> {
    let bundle_str = serde_json::to_string(bundle_json)?;
    let bundle = Bundle::from_json(&bundle_str)
        .map_err(|e| anyhow::anyhow!("Failed to parse bundle: {e}"))?;

    let result = sigstore_verify::verify(artifact_digest, &bundle, policy, trusted_root)
        .map_err(|e| anyhow::anyhow!("{e}"))?;

    let identity = result
        .identity
        .as_deref()
        .ok_or_else(|| anyhow::anyhow!("No identity in certificate"))?;

    let expected = format!("/.github/workflows/{workflow}");
    if !identity.contains(&expected) {
        bail!("Workflow mismatch: expected {workflow}, got {identity}");
    }

    Ok(())
}

/// Returns `Ok(())` when the downloaded archive has verified provenance.
async fn verify_provenance(archive_data: &[u8], tag: &str) -> Result<()> {
    let digest = sha256_hex(archive_data);
    println!("Archive SHA-256: {digest}");

    let workflow = match tag {
        "canary" => "canary.yml",
        _ => "release.yml",
    };

View on GitHub (pinned to 3810898a74)

Solutions

1. Retry after the next release — the provenance generation is at fault, not your machine
2. Keep goose itself updated (pinned trusted roots and checks evolve)
3. Report the release tag to goose maintainers with the error text

match verify_bundle(&bundle_json, digest, &policy, &trusted_root, workflow) {
    Err(e) if e.to_string() == "No identity in certificate" => {
        // release-side defect: report tag, do not install
        anyhow::bail!("release provenance lacks signer identity; report to maintainers");
    }
    other => other,
}

When it happens

Trigger: A release whose attestation certificate was issued without the identity extension; verification libraries accepting a bundle whose cert lacks the SAN goose expects.

Common situations: Upstream release pipeline changes (signing step misconfigured); rare/regional CA issuance quirks; almost never caused by user config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• {e}
• Sigstore verification failed: {} Aborting update due to sec
• Failed to parse bundle: {e}
• goose serve TLS certificate fingerprint did not match readin
• GOOSE_SERVER__SECRET_KEY must be set to start `goose serve`;

AI-assisted analysis of aaif-goose/goose@3810898a74 (2026-08-16). Data as JSON: /api/errors/b35ea153b1dbabc3. Report an issue: GitHub.