{"record":{"id":"451287597e6ea737","repo":"hashicorp/packer","slug":"attestation-envelope-has-no-signatures","errorCode":null,"errorMessage":"attestation envelope has no signatures","messagePattern":"attestation envelope has no signatures","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":365,"sourceCode":"}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")\n\t}\n\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"attestation envelope has no signatures\")\n\t}\n\n\tbundleSignature := bundleEnvelope.Signature()\n\tfor i, envelopeSignature := range envelope.Signatures {\n\t\tsignature, err := DecodeEnvelopeSignature(envelopeSignature)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"decode attestation envelope signature %d: %w\", i, err)\n\t\t}\n\n\t\tif bytes.Equal(bundleSignature, signature) {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn fmt.Errorf(\"sigstore bundle signature does not match any attestation signature\")\n}\n\nfunc verifyArtifactSubject(subjects []internalprovenance.Subject, artifactPath string) error {","sourceCodeStart":347,"sourceCodeEnd":383,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L347-L383","documentation":"The attestation envelope contains zero signatures, so there is no signature to match against the bundle's signature. Thrown as an input-validation failure: a DSSE envelope without signatures cannot be verified at all.","triggerScenarios":"ensureBundleMatchesEnvelope receives an Envelope whose Signatures slice is empty — e.g. an attestation file produced or deserialized without its signatures array.","commonSituations":"Attestation file truncated or hand-assembled; a pipeline step stripped signatures; JSON deserialization dropped the signatures due to a schema/field-name mismatch; user passed a raw statement (not a signed envelope) as the attestation.","solutions":["Regenerate or re-export the signed attestation so it includes at least one entry in its signatures array","Validate the attestation JSON before verification (signatures array non-empty, payload/payloadType present)","Check the deserialization code/flags that load the envelope to ensure signatures are not dropped"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(envelope.Signatures) == 0 {\n    return fmt.Errorf(\"attestation has no signatures; refusing verification\")\n}","typeGuard":"func hasSignatures(env Envelope) bool {\n    return len(env.Signatures) > 0\n}","tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"no signatures\") {\n        // re-export the signed envelope; check the pipeline step that signs\n    }\n}","preventionTips":["Validate envelope JSON schema (payloadType, payload, non-empty signatures) before verification","Do not pass raw unsigned statements as attestations","Check deserialization mappings so the signatures array is not dropped"],"tags":["dsse","attestation","validation"],"backgroundTag":"envelope-missing-signatures","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}