{"record":{"id":"3bde0458e819398f","repo":"hashicorp/packer","slug":"attestation-predicate-type-q-does-not-match-expec","errorCode":null,"errorMessage":"attestation predicate type %q does not match expected %q","messagePattern":"attestation predicate type %q does not match expected %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":231,"sourceCode":"\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\nfunc verifyPolicy(payload []byte, policy VerificationPolicy) (*internalprovenance.Statement, error) {\n\tvar statement internalprovenance.Statement\n\tif err := json.Unmarshal(payload, &statement); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode attestation statement: %w\", err)\n\t}\n\n\tif statement.Type != internalprovenance.StatementType {\n\t\treturn nil, fmt.Errorf(\"unexpected attestation statement type %q\", statement.Type)\n\t}\n\n\tif policy.PredicateType != \"\" && statement.PredicateType != policy.PredicateType {\n\t\treturn nil, fmt.Errorf(\"attestation predicate type %q does not match expected %q\", statement.PredicateType, policy.PredicateType)\n\t}\n\n\tif policy.ArtifactPath != \"\" {\n\t\tif err := verifyArtifactSubject(statement.Subject, policy.ArtifactPath); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tif policy.BuilderID != \"\" || policy.SourceURI != \"\" {\n\t\tif statement.PredicateType != internalprovenance.SLSAProvenanceV1PredicateType {\n\t\t\treturn nil, fmt.Errorf(\"builder and source policy checks require predicate type %q, got %q\", internalprovenance.SLSAProvenanceV1PredicateType, statement.PredicateType)\n\t\t}\n\n\t\tvar typedStatement struct {\n\t\t\tType          string                                     `json:\"_type\"`\n\t\t\tSubject       []internalprovenance.Subject               `json:\"subject\"`\n\t\t\tPredicateType string                                     `json:\"predicateType\"`\n\t\t\tPredicate     internalprovenance.SLSAProvenancePredicate `json:\"predicate\"`","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L213-L249","documentation":"When the verification policy specifies a PredicateType, verifyPolicy requires the attestation's `predicateType` to match it exactly. This error means the attestation is a valid in-toto statement but describes a different predicate than the policy allows.","triggerScenarios":"VerifyAttestationFile called with a policy whose PredicateType is set (e.g. SLSA provenance v1) while the file's predicateType is something else (e.g. a vulnerability-scan or SBOM predicate).","commonSituations":"Pointing a provenance-verification policy at an SBOM attestation; policy configured for https://slsa.dev/provenance/v1 while the build system still emits v0.2 provenance; copy-pasted policy referencing the wrong predicate URI.","solutions":["Compare the attestation's predicateType with the policy's expected PredicateType and align them (the error message shows both).","Update the policy PredicateType to the predicate actually produced (e.g. switch to v0.2 URI if that is what your builder emits).","Regenerate the attestation with a builder that emits the required predicate version.","If you accept multiple predicate types, run verification once per expected PredicateType instead of a single strict policy."],"exampleFix":"// policy before\npolicy.PredicateType = \"https://slsa.dev/provenance/v1\" // attestation has v0.2\n// after (align with produced attestation)\npolicy.PredicateType = \"https://slsa.dev/provenance/v0.2\"","handlingStrategy":"validation","validationCode":"var s struct{ PredicateType string `json:\"predicateType\"` }\n_ = json.Unmarshal(payload, &s)\nif policy.PredicateType != \"\" && s.PredicateType != policy.PredicateType {\n\treturn fmt.Errorf(\"attestation is %s, policy expects %s\", s.PredicateType, policy.PredicateType)\n}","typeGuard":null,"tryCatchPattern":"_, err := VerifyAttestationFile(path, policy)\nif err != nil && strings.Contains(err.Error(), \"does not match expected\") {\n\t// inspect both predicateType URIs; realign policy or regenerate attestation\n}","preventionTips":["Keep policy.PredicateType in a shared constant with the producing pipeline","Distinguish provenance v0.2 vs v1 URIs when writing policy","Label attestation files with their predicate type in your artifact store"],"tags":["attestation","policy","predicate-type"],"backgroundTag":"predicate-type-mismatch","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}