{"record":{"id":"337c4174c9254c98","repo":"hashicorp/packer","slug":"attestation-does-not-contain-expected-source-uri","errorCode":null,"errorMessage":"attestation does not contain expected source URI %q","messagePattern":"attestation does not contain expected source URI %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":268,"sourceCode":"\t\t}\n\t\tif err := json.Unmarshal(payload, &typedStatement); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"decode SLSA predicate for policy verification: %w\", err)\n\t\t}\n\n\t\tif policy.BuilderID != \"\" && typedStatement.Predicate.RunDetails.Builder.ID != policy.BuilderID {\n\t\t\treturn nil, fmt.Errorf(\"attestation builder id %q does not match expected %q\", typedStatement.Predicate.RunDetails.Builder.ID, policy.BuilderID)\n\t\t}\n\n\t\tif policy.SourceURI != \"\" {\n\t\t\tmatched := false\n\t\t\tfor _, dependency := range typedStatement.Predicate.BuildDefinition.ResolvedDependencies {\n\t\t\t\tif dependency.URI == policy.SourceURI {\n\t\t\t\t\tmatched = true\n\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !matched {\n\t\t\t\treturn nil, fmt.Errorf(\"attestation does not contain expected source URI %q\", policy.SourceURI)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn &statement, nil\n}\n\nfunc requiresSigstoreBundle(policy VerificationPolicy) bool {\n\treturn policy.RequireTransparencyLog || policy.RequireObserverTimestamp\n}\n\nfunc verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\tif strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L250-L286","documentation":"When the policy sets SourceURI, verifyPolicy scans predicate.buildDefinition.resolvedDependencies for a dependency whose URI equals the policy value. This error means no resolved dependency in the provenance matches the expected source URI.","triggerScenarios":"VerifyAttestationFile with policy.SourceURI set on a provenance attestation whose resolvedDependencies list omits that URI or uses a different URI form (tag vs digest, different scheme, no git+ prefix).","commonSituations":"Pinning SourceURI to a branch ref while the build recorded the exact commit SHA; missing the git+ scheme prefix (e.g. \"git+https://github.com/org/repo@refs/tags/v1.0.0\"); attestations built from a fork or mirror with a different repository URI.","solutions":["Inspect resolvedDependencies in the attestation and copy the exact dependency URI into policy.SourceURI.","Rebuild the artifact from the expected source revision so the provenance records the required URI.","Relax or remove policy.SourceURI if exact source pinning is not required.","Normalize URI format (scheme, ref vs digest) on both the producer and policy sides so they match byte-for-byte."],"exampleFix":"// before\npolicy.SourceURI = \"https://github.com/org/repo\" // attestation lists git+https://...@refs/tags/v1.0.0\n// after\npolicy.SourceURI = \"git+https://github.com/org/repo@refs/tags/v1.0.0\"","handlingStrategy":"validation","validationCode":"var s struct {\n\tPredicate struct {\n\t\tBuildDefinition struct {\n\t\t\tResolvedDependencies []struct{ URI string `json:\"uri\"` } `json:\"resolvedDependencies\"`\n\t\t} `json:\"buildDefinition\"`\n\t} `json:\"predicate\"`\n}\n_ = json.Unmarshal(payload, &s)\nfor _, d := range s.Predicate.BuildDefinition.ResolvedDependencies {\n\tif d.URI == policy.SourceURI { return nil }\n}\nreturn fmt.Errorf(\"source URI %q absent from provenance\", policy.SourceURI)","typeGuard":null,"tryCatchPattern":"_, err := VerifyAttestationFile(path, policy)\nif err != nil && strings.Contains(err.Error(), \"expected source URI\") {\n\t// inspect resolvedDependencies; align URI scheme/ref format or rebuild from pinned source\n}","preventionTips":["Pin SourceURI using the exact dependency URI format your builder records (git+scheme + ref)","Pin by immutable ref (tag/SHA), not a mutable branch, so producer and policy agree","Dump resolvedDependencies when onboarding a new builder to learn its URI format"],"tags":["attestation","slsa","source-uri"],"backgroundTag":"source-uri-not-in-provenance","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}