{"record":{"id":"45b112763b2d35f1","repo":"hashicorp/packer","slug":"envelope-has-no-signatures","errorCode":null,"errorMessage":"envelope has no signatures","messagePattern":"envelope has no signatures","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/signer.go","lineNumber":74,"sourceCode":"\tfactory, ok := signerFactories[cfg.Mode]\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q is not implemented\", cfg.Mode)\n\t}\n\n\treturn factory(ctx, cfg)\n}\n\nfunc NewVerifier(ctx context.Context, cfg BackendConfig, signer Signer) (Verifier, error) {\n\tif cfg.VerifierRef != \"\" {\n\t\treturn LoadPEMVerifier(cfg.VerifierRef)\n\t}\n\n\treturn signer.Verifier(ctx, cfg)\n}\n\nfunc VerifyEnvelope(ctx context.Context, envelope Envelope, verifier Verifier) error {\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"envelope has no signatures\")\n\t}\n\n\tpayload, err := DecodeEnvelopePayload(envelope)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tfor _, signature := range envelope.Signatures {\n\t\tdecodedSignature, decodeErr := DecodeEnvelopeSignature(signature)\n\t\tif decodeErr != nil {\n\t\t\treturn decodeErr\n\t\t}\n\n\t\tif verifyErr := verifier.Verify(ctx, envelope.PayloadType, payload, decodedSignature); verifyErr == nil {\n\t\t\treturn nil\n\t\t}\n\t}\n","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/signer.go#L56-L92","documentation":"Verification error from VerifyEnvelope: the DSSE envelope being checked contains zero signatures, so there is nothing to verify. Usually means the envelope was constructed without signing or was truncated/corrupted.","triggerScenarios":"Thrown at internal/attestation/signer.go:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the attestation with signing enabled so the envelope carries at least one signature","Verify you are pointing at the complete, unmodified attestation file"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}