{"record":{"id":"1f794b1dc49cb591","repo":"hashicorp/packer","slug":"sign-payload-with-kms-w","errorCode":null,"errorMessage":"sign payload with KMS: %w","messagePattern":"sign payload with KMS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":67,"sourceCode":"\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create KMS verifier %q: %w\", cfg.SignerRef, err)\n\t}\n\n\treturn &kmsSigner{\n\t\tsignerVerifier: signerVerifier,\n\t\tverifier:       verifier,\n\t\tkeyID:          verifier.KeyID(),\n\t}, nil\n}\n\nfunc (s *kmsSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {\n\tencoded := PreAuthEncode(payloadType, payload)\n\tsignature, err := s.signerVerifier.SignMessage(bytes.NewReader(encoded))\n\tif err != nil {\n\t\treturn Signature{}, fmt.Errorf(\"sign payload with KMS: %w\", err)\n\t}\n\n\treturn Signature{\n\t\tKeyID: s.keyID,\n\t\tSig:   signature,\n\t}, nil\n}\n\nfunc (s *kmsSigner) Verifier(context.Context, BackendConfig) (Verifier, error) {\n\treturn s.verifier, nil\n}\n\n// kmsProviderBuildTags maps a KMS/Vault URI scheme to the build tag that\n// compiles its provider into the binary. Providers are included by default;\n// builds using the \"kms_cherrypick\" tag opt in to individual providers.\nvar kmsProviderBuildTags = map[string]string{\n\t\"awskms\":     \"kms_aws\",\n\t\"gcpkms\":     \"kms_gcp\",","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L49-L85","documentation":"Signing failure in kmsSigner.Sign: the pre-auth-encoded payload could not be signed by the KMS provider (SignMessage returned an error). Typically a KMS-side failure: key disabled, permissions denied, network/API error, or unsupported message size.","triggerScenarios":"Thrown at internal/attestation/sign_kms.go:67 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that the KMS key is enabled and the credentials used have kms:Sign permission","Verify network access and the key reference URI (awskms://, gcpkms://, azurekms://, hashivault://)","Retry the build — transient KMS API errors are common"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}