{"record":{"id":"2670b866dd13bba9","repo":"hashicorp/packer","slug":"sigstore-bundle-payload-does-not-match-attestation","errorCode":null,"errorMessage":"sigstore bundle payload does not match attestation","messagePattern":"sigstore bundle payload does not match attestation","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":361,"sourceCode":"\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")\n\t}\n\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"attestation envelope has no signatures\")\n\t}\n\n\tbundleSignature := bundleEnvelope.Signature()\n\tfor i, envelopeSignature := range envelope.Signatures {\n\t\tsignature, err := DecodeEnvelopeSignature(envelopeSignature)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"decode attestation envelope signature %d: %w\", i, err)\n\t\t}\n\n\t\tif bytes.Equal(bundleSignature, signature) {\n\t\t\treturn nil\n\t\t}\n\t}\n","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L343-L379","documentation":"The bundle's DSSE payloadType or payload differs from the attestation envelope being verified, so the bundle does not attest this attestation. Thrown to fail fast before cryptographic verification, since verifying a bundle for different content would be meaningless.","triggerScenarios":"ensureBundleMatchesEnvelope compares rawEnvelope.PayloadType/Payload against envelope.PayloadType/Payload and any field differs — e.g. bundle signed for a different attestation version, predicate, or subject set.","commonSituations":"Mixing bundles and attestations from different builds or releases; attestation regenerated (new payload) while reusing an old bundle; predicate schema upgrade changing serialized payload; wrong file pairing in CI artifacts.","solutions":["Regenerate the bundle together with the attestation in the same signing run and keep them paired (same release artifact set)","Check that you are passing the bundle that corresponds to this exact attestation file (compare payloads manually if needed)","Pin/align predicate schema versions between signing and verification tooling"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"b, _ := os.ReadFile(bundlePath)\nvar probe struct {\n    DSSEEnvelope struct {\n        PayloadType string `json:\"payloadType\"`\n        Payload     string `json:\"payload\"`\n    } `json:\"dsseEnvelope\"`\n}\n_ = json.Unmarshal(b, &probe)\na, _ := os.ReadFile(attestationPath)\nvar env struct {\n    PayloadType string `json:\"payloadType\"`\n    Payload     string `json:\"payload\"`\n}\n_ = json.Unmarshal(a, &env)\nif probe.DSSEEnvelope.PayloadType != env.PayloadType || probe.DSSEEnvelope.Payload != env.Payload {\n    return fmt.Errorf(\"bundle and attestation payloads differ\")\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"payload does not match attestation\") {\n        // re-pair bundle with the matching attestation from the same build\n    }\n}","preventionTips":["Emit bundle and attestation together in one signing step and store them adjacently","Version-control or content-address the (attestation, bundle) pair per release","Avoid regenerating attestations while reusing old bundles"],"tags":["sigstore","dsse","payload-mismatch"],"backgroundTag":"bundle-attestation-mismatch","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}