{"record":{"id":"22b7e01877779c76","repo":"hashicorp/packer","slug":"create-kms-verifier-q-w","errorCode":null,"errorMessage":"create KMS verifier %q: %w","messagePattern":"create KMS verifier %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":53,"sourceCode":"\t}\n\n\tsignerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)\n\tif err != nil {\n\t\tvar notFound *sigstorekms.ProviderNotFoundError\n\t\tif errors.As(err, &notFound) {\n\t\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w%s\", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tpublicKey, err := signerVerifier.PublicKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load KMS public key %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create KMS verifier %q: %w\", cfg.SignerRef, err)\n\t}\n\n\treturn &kmsSigner{\n\t\tsignerVerifier: signerVerifier,\n\t\tverifier:       verifier,\n\t\tkeyID:          verifier.KeyID(),\n\t}, nil\n}\n\nfunc (s *kmsSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {\n\tencoded := PreAuthEncode(payloadType, payload)\n\tsignature, err := s.signerVerifier.SignMessage(bytes.NewReader(encoded))\n\tif err != nil {\n\t\treturn Signature{}, fmt.Errorf(\"sign payload with KMS: %w\", err)\n\t}\n\n\treturn Signature{\n\t\tKeyID: s.keyID,","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L35-L71","documentation":"Initialization error in the KMS signing backend (newKMSSigner): the public key retrieved from the KMS signer could not be turned into a sigstore verifier, meaning the key is usable for signing but not verifiable with the default verifier — often an unsupported key type or format.","triggerScenarios":"Thrown at internal/attestation/sign_kms.go:53 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the KMS key references an supported asymmetric signing algorithm (e.g. RSA/ECDSA)","Provide an explicit verifier with the `verifier` config pointing to a PEM public key that matches the KMS key"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}