{"record":{"id":"33a0d8497b24c2a4","repo":"cli/cli","slug":"failed-to-get-envelope-from-bundle-v","errorCode":null,"errorMessage":"failed to get envelope from bundle: %v","messagePattern":"failed to get envelope from bundle: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/attestation/inspect/bundle.go","lineNumber":80,"sourceCode":"\t\tif !found {\n\t\t\treturn \"\", \"\", fmt.Errorf(\"failed to get org and repo from %s\", repoURL)\n\t\t}\n\t} else {\n\t\tafter, found = strings.CutPrefix(repoURL,\n\t\t\tfmt.Sprintf(\"https://%s.ghe.com/\", tenant))\n\t\tif !found {\n\t\t\treturn \"\", \"\", fmt.Errorf(\"failed to get org and repo from %s\", repoURL)\n\t\t}\n\t}\n\n\tparts := strings.Split(after, \"/\")\n\treturn parts[0], parts[1], nil\n}\n\nfunc getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetail, error) {\n\tenvelope, err := attr.Bundle.Envelope()\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to get envelope from bundle: %v\", err)\n\t}\n\n\tstatement, err := envelope.EnvelopeContent().Statement()\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to get statement from envelope: %v\", err)\n\t}\n\n\tvar predicate Predicate\n\tpredicateJson, err := json.Marshal(statement.Predicate)\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to marshal predicate: %v\", err)\n\t}\n\n\terr = json.Unmarshal(predicateJson, &predicate)\n\tif err != nil {\n\t\treturn AttestationDetail{}, fmt.Errorf(\"failed to unmarshal predicate: %v\", err)\n\t}\n","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/cli/cli/blob/0eeec0b92edbe70199f9768522f831d3534f41ad/pkg/cmd/attestation/inspect/bundle.go#L62-L98","documentation":"Thrown by getAttestationDetail in `gh attestation inspect` when attr.Bundle.Envelope() fails, i.e. the DSSE envelope cannot be decoded from the attestation bundle. The bundle's base64 payload or envelope structure does not match the expected sigstore bundle format.","triggerScenarios":"Bundle.Envelope() errors on malformed base64, missing 'DSSE' payload fields, or an unsupported mediaType inside the bundle's verification material.","commonSituations":"Inspecting a hand-crafted or truncated .jsonl bundle file, a bundle produced by a newer sigstore format the CLI does not understand, or file corruption during download.","solutions":["Re-fetch the attestation from the API rather than using a possibly corrupted local bundle","Confirm the file is a valid sigstore bundle (check bundle.mediaType)","Upgrade gh to a version supporting the bundle format used by the artifact"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if b.MediaVersion == 0 || b.VerificationMaterial == nil {\n\treturn errors.New(\"bundle missing verification material; not a valid sigstore bundle\")\n}","typeGuard":"func hasDecodableEnvelope(b *sigstore.Bundle) bool {\n\t_, err := b.Envelope()\n\treturn err == nil\n}","tryCatchPattern":"env, err := attr.Bundle.Envelope()\nif err != nil {\n\treturn fmt.Errorf(\"decode DSSE envelope (bundle may be corrupt): %w\", err)\n}","preventionTips":["Re-download bundles from the API instead of reusing possibly truncated local files","Verify bundle.mediaType matches a supported sigstore version before inspection","Upgrade gh when new bundle media types appear"],"tags":["attestation","dsse","bundle","parsing"],"backgroundTag":null,"analyzedSha":"0eeec0b92edbe70199f9768522f831d3534f41ad","analyzedAt":"2026-08-15T12:31:05.478Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}