{"record":{"id":"356cc640e1917832","repo":"hashicorp/packer","slug":"build-keyless-identity-policy-w","errorCode":null,"errorMessage":"build keyless identity policy: %w","messagePattern":"build keyless identity policy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":73,"sourceCode":"\t\treturn fmt.Errorf(\"verify Fulcio certificate chain: %w\", err)\n\t}\n\n\t// When using the public Sigstore root (no custom trusted root configured),\n\t// require a valid SCT so certificates issued outside a public CT log are rejected.\n\tif strings.TrimSpace(trustedRootPath) == \"\" {\n\t\tif err := sigstoreverify.VerifySignedCertificateTimestamp(chains, 1, trustedMaterial); err != nil {\n\t\t\treturn fmt.Errorf(\"verify Fulcio certificate SCT: %w\", err)\n\t\t}\n\t}\n\n\tsummary, err := fulciocertificate.SummarizeCertificate(certificate)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"summarize Fulcio certificate: %w\", err)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(expectedOIDCIssuer, \"\", expectedIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\tif err := identity.Verify(summary); err != nil {\n\t\treturn fmt.Errorf(\"verify keyless certificate identity: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc init() {\n\tRegisterSigner(SigningModeKeyless, newKeylessSigner)\n}\n\ntype keylessSigner struct {\n\tkeypair  sigstoregosign.Keypair\n\tcertPEM  []byte\n\tcert     *x509.Certificate\n\tverifier Verifier\n\tkeyID    string","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L55-L91","documentation":"This error wraps a failure from sigstore-go's verify.NewShortCertificateIdentity, which constructs the keyless identity policy used to match a Fulcio certificate against the expected signer. The library throws it when the policy cannot be built, almost always because the expected OIDC issuer and identity values are empty or invalid (NewShortCertificateIdentity requires at least one matchable field and returns an error when all inputs are empty). It is returned from verifyKeylessCertificate while validating the signer's certificate during keyless attestation verification.","triggerScenarios":"Calling keylessVerifier.Verify (which invokes verifyKeylessCertificate in internal/attestation/sign_keyless.go:71-74) with BackendConfig where KeylessOIDCIssuer or KeylessIdentity resolve to empty strings at this point, or NewShortCertificateIdentity rejecting the combination (e.g. both expectedOIDCIssuer and expectedIdentity empty).","commonSituations":"A template/backend config omits keyless_identity or keyless_oidc_issuer and the code path reached verifyKeylessCertificate without the earlier newKeylessVerifier guard (e.g. a Verifier supplied explicitly with blank identity fields); values set only with surrounding whitespace; a refactor passed \"\" for both parameters.","solutions":["Set both keyless_identity and keyless_oidc_issuer in the backend config to the expected signer identity (e.g. email or workflow URI) and the OIDC issuer URL (e.g. https://token.actions.githubusercontent.com).","Trim and validate the values before calling verify; ensure at least one of issuer/identity is non-empty.","Check sigstore-go version compatibility for NewShortCertificateIdentity argument semantics (issuer, SAN, identity, SAN values)."],"exampleFix":"// before\nidentity, err := sigstoreverify.NewShortCertificateIdentity(\"\", \"\", \"\", \"\")\n// after\nif expectedOIDCIssuer == \"\" || expectedIdentity == \"\" {\n    return fmt.Errorf(\"keyless verification requires keyless_oidc_issuer and keyless_identity\")\n}\nidentity, err := sigstoreverify.NewShortCertificateIdentity(expectedOIDCIssuer, \"\", expectedIdentity, \"\")","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n    return fmt.Errorf(\"keyless verification requires keyless_identity and keyless_oidc_issuer\")\n}","typeGuard":"func hasKeylessIdentityPolicy(identity, issuer string) bool {\n    return strings.TrimSpace(identity) != \"\" && strings.TrimSpace(issuer) != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always configure both keyless_identity and keyless_oidc_issuer for signing_mode=\"keyless\" backends.","Trim whitespace from config values before use.","Rely on the newKeylessVerifier guard that already rejects blank identity fields, and keep that check upstream of all verify paths."],"tags":["sigstore","keyless-signing","configuration"],"backgroundTag":"invalid-identity-policy","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}