{"record":{"id":"387d914717fb3ff5","repo":"hashicorp/packer","slug":"create-sigstore-bundle-verifier-w","errorCode":null,"errorMessage":"create Sigstore bundle verifier: %w","messagePattern":"create Sigstore bundle verifier: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":323,"sourceCode":"\t}\n\n\tverifierOptions := []sigstoreverify.VerifierOption{}\n\tif policy.RequireTransparencyLog {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))\n\t}\n\tif policy.RequireObserverTimestamp {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}\n\tif len(verifierOptions) == 0 {\n\t\t// A trusted time source is required to validate the short-lived Fulcio\n\t\t// certificate as of signing time; default to observer timestamps when the\n\t\t// caller has not explicitly required Rekor or timestamp evidence.\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}\n\n\tverifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create Sigstore bundle verifier: %w\", err)\n\t}\n\n\tartifactPolicy := sigstoreverify.WithoutArtifactUnsafe()\n\tif policy.ArtifactPath != \"\" {\n\t\tartifact, err := os.Open(policy.ArtifactPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"open artifact %q for bundle verification: %w\", policy.ArtifactPath, err)\n\t\t}\n\t\tdefer func() { _ = artifact.Close() }()\n\t\tartifactPolicy = sigstoreverify.WithArtifact(artifact)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, \"\", cfg.KeylessIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L305-L341","documentation":"newSigstoreBundleVerifier() failed to construct the sigstore-go bundle verifier from the loaded trusted root material and verifier options. This is thrown because certificate-chain/timestamp verification cannot proceed without a verifier. The inner error usually points to invalid trusted material (Fulcio/Rekor/TUF roots) or incompatible options.","triggerScenarios":"Called after loadKeylessTrustedMaterial succeeds but sigstore.NewVerifier/option application fails: malformed trusted root, empty trusted material, or conflicting verifier options (WithTransparencyLog/WithObserverTimestamps).","commonSituations":"Corrupted or outdated embedded/TUF-fetched trusted root; offline environment where trusted material could not be fully populated; a sigstore library version change altering verifier construction requirements.","solutions":["Refresh the Sigstore trusted root (update TUF roots / re-fetch Fulcio and Rekor certificates) and retry","Inspect the wrapped inner error to identify whether the Fulcio root, Rekor key, or timestamp authority material is invalid","Upgrade/downgrade the sigstore-go dependency to a compatible version and rebuild"],"exampleFix":"// before\nverifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)\n// after (diagnose trusted material first)\nif trustedMaterial == nil || len(trustedMaterial.FulcioCertificates()) == 0 {\n    return fmt.Errorf(\"no Fulcio trusted material loaded; refresh trusted root\")\n}\nverifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)","handlingStrategy":"fallback","validationCode":"if trustedMaterial == nil {\n    return fmt.Errorf(\"trusted material not loaded\")\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"create Sigstore bundle verifier\") {\n        // refresh trusted root / TUF cache, then retry once\n    }\n}","preventionTips":["Keep the Sigstore trusted root (TUF cache) fresh","Pin compatible sigstore-go versions in go.mod","Run in an environment where trusted material can be fetched or is embedded"],"tags":["sigstore","trust-root","initialization"],"backgroundTag":"sigstore-verifier-init-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}