{"record":{"id":"0dcf1491c1fde621","repo":"hashicorp/packer","slug":"bundle-based-rekor-or-timestamp-verification-curre","errorCode":null,"errorMessage":"bundle-based Rekor or timestamp verification currently requires a keyless attestation","messagePattern":"bundle-based Rekor or timestamp verification currently requires a keyless attestation","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":286,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"attestation does not contain expected source URI %q\", policy.SourceURI)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn &statement, nil\n}\n\nfunc requiresSigstoreBundle(policy VerificationPolicy) bool {\n\treturn policy.RequireTransparencyLog || policy.RequireObserverTimestamp\n}\n\nfunc verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\tif strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")\n\t}\n\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tbundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\tif err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {\n\t\treturn err","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L268-L304","documentation":"Bundle-based verification of Fulcio-issued, short-lived certificates requires keyless (certificate-based) signatures; a plain key signature has no certificate or OIDC identity to validate against the bundle's trust material. This error means the envelope is not keyless and carries no certificate, yet bundle-based Rekor/timestamp verification was requested.","triggerScenarios":"verifySigstoreBundleEvidenceImpl called with an envelope signed in key mode (no cert fields in any signature) and BackendConfig mode not keyless, while a bundle path is provided.","commonSituations":"Artifacts signed with a long-lived key or KMS signer but verified with keyless bundle requirements; mixed signing pipelines where some artifacts are key-signed; mode explicitly set to \"key\" while expecting Rekor bundle verification.","solutions":["Re-sign the artifact in keyless mode (Fulcio certificate + OIDC) so the envelope carries a certificate.","If key signing is intentional, drop the bundle-based Rekor/timestamp requirements and verify against the trusted public key instead.","Set cfg mode to keyless only when the envelope actually contains a certificate; otherwise verify with key-based options."],"exampleFix":"// before\ncfg.SignerRef = \"hashivault://transit/keys/release\" // key-based signing, bundle verification requested\n// after\ncfg.KeylessIdentity = \"user@example.com\"; cfg.KeylessOIDCIssuer = \"https://token.actions.githubusercontent.com\" // keyless signing + bundle","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(policy.SigstoreBundlePath) != \"\" {\n\thasCert := false\n\tfor _, sig := range envelope.Signatures {\n\t\tif strings.TrimSpace(sig.Cert) != \"\" { hasCert = true }\n\t}\n\tif cfg.Mode == \"key\" || (!hasCert && cfg.Mode == \"\") {\n\t\treturn fmt.Errorf(\"bundle verification needs a keyless (certificate-bearing) attestation\")\n\t}\n}","typeGuard":"func envelopeIsKeyless(envelope Envelope) bool {\n\tfor _, sig := range envelope.Signatures {\n\t\tif strings.TrimSpace(sig.Cert) != \"\" { return true }\n\t}\n\treturn false\n}","tryCatchPattern":"err := VerifyAttestation(...)\nif err != nil && strings.Contains(err.Error(), \"requires a keyless attestation\") {\n\t// verify with key-based options instead, or re-sign keylessly\n}","preventionTips":["Use keyless (Fulcio/OIDC) signing whenever artifacts will be verified against Sigstore bundles","Do not mix key-signed artifacts into keyless verification pipelines","Check that signatures embed a certificate before requiring bundle-based evidence"],"tags":["sigstore","keyless","unsupported-mode"],"backgroundTag":"sigstore-keyless-required","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}