{"record":{"id":"42742ac2be854702","repo":"hashicorp/packer","slug":"decode-attestation-envelope-q-w","errorCode":null,"errorMessage":"decode attestation envelope %q: %w","messagePattern":"decode attestation envelope %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":49,"sourceCode":"}\n\nvar loadSigstoreBundle = sigstorebundle.LoadJSONFromPath\n\nvar newSigstoreBundleVerifier = sigstoreverify.NewVerifier\n\nvar verifySigstoreBundleEvidence = func(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\treturn verifySigstoreBundleEvidenceImpl(envelope, cfg, policy)\n}\n\nfunc VerifyAttestationFile(ctx context.Context, path string, cfg BackendConfig, policy VerificationPolicy) (*internalprovenance.Statement, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read attestation %q: %w\", path, err)\n\t}\n\n\tvar envelope Envelope\n\tif err := json.Unmarshal(contents, &envelope); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode attestation envelope %q: %w\", path, err)\n\t}\n\n\tif envelope.PayloadType != InTotoPayloadType {\n\t\treturn nil, fmt.Errorf(\"attestation %q has unexpected payloadType %q (want %q)\",\n\t\t\tpath, envelope.PayloadType, InTotoPayloadType)\n\t}\n\n\tif err := verifyEnvelopeSignature(ctx, path, cfg, policy, envelope); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpayload, err := DecodeEnvelopePayload(envelope)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tstatement, err := verifyPolicy(payload, policy)\n\tif err != nil {","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L31-L67","documentation":"VerifyAttestationFile wraps the json.Unmarshal failure for the envelope in `decode attestation envelope %q: %w`. It means the file contents are not valid JSON matching the Envelope shape (payload, payloadType, signatures). The raw JSON syntax error from encoding/json is preserved.","triggerScenarios":"Passing a non-JSON file (binary artifact, empty file, truncated download, HTML error page) to VerifyAttestationFile; passing a JSON file whose top level is an array or has mismatched types (e.g. signatures as a string); file corrupted in transfer.","commonSituations":"Pointing the verifier at the artifact instead of the .attestation.json sidecar; partial uploads in CI; editing the envelope by hand and breaking JSON syntax; a proxy returning an error page saved as the attestation.","solutions":["Validate the file with `jq . file` or json.Valid to confirm it parses as JSON","Ensure you are passing the DSSE envelope file, not the signed artifact or bundle","Re-download or re-generate the attestation if it was truncated or empty","Check that top-level fields have the right types (payload/payloadType strings, signatures array)"],"exampleFix":"// before\nstmt, err := attestation.VerifyAttestationFile(ctx, \"bin/app\", cfg, policy)\n\n// after: verify the envelope file\ncontents, _ := os.ReadFile(\"bin/app.attestation.json\")\nif !json.Valid(contents) { log.Fatal(\"not valid JSON\") }\nstmt, err := attestation.VerifyAttestationFile(ctx, \"bin/app.attestation.json\", cfg, policy)","handlingStrategy":"validation","validationCode":"contents, err := os.ReadFile(path)\nif err != nil { return err }\nif !json.Valid(contents) { return fmt.Errorf\"%s is not valid JSON\", path) }\nvar probe struct{ PayloadType string `json:\"payloadType\"` }\nif json.Unmarshal(contents, &probe) != nil || probe.PayloadType == \"\" { return fmt.Errorf\"%s is not a DSSE envelope\", path) }","typeGuard":"func looksLikeEnvelope(b []byte) bool {\n    var e attestation.Envelope\n    return json.Unmarshal(b, &e) == nil && e.PayloadType != \"\"\n}","tryCatchPattern":"if _, err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"decode attestation envelope\") {\n        return fmt.Errorf\"%s is not a DSSE envelope JSON document\", path)\n    }\n    return err\n}","preventionTips":["Never hand-edit envelope JSON; re-sign instead","Verify you pass the envelope file, not the artifact or Sigstore bundle","Checksum files after download to catch truncation","Validate with json.Valid before verification in scripts"],"tags":["json","attestation","parsing"],"backgroundTag":"json-parse-error","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}