{"record":{"id":"495d193084182156","repo":"hashicorp/packer","slug":"create-keyless-verifier-w","errorCode":null,"errorMessage":"create keyless verifier: %w","messagePattern":"create keyless verifier: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":124,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generate ephemeral keypair: %w\", err)\n\t}\n\n\tfulcio := newKeylessFulcio(fulcioURL)\n\tcertDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"request Fulcio certificate: %w\", err)\n\t}\n\n\tcertificate, err := x509.ParseCertificate(certDER)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse Fulcio certificate: %w\", err)\n\t}\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tverifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}\n\n\treturn &keylessSigner{\n\t\tkeypair:  keypair,\n\t\tcertPEM:  certPEM,\n\t\tcert:     certificate,\n\t\tverifier: verifier,\n\t\tkeyID:    hex.EncodeToString(keypair.GetHint()),\n\t}, nil\n}\n\nfunc (s *keylessSigner) Sign(ctx context.Context, payloadType string, payload []byte) (Signature, error) {\n\tsignature, _, err := s.keypair.SignData(ctx, PreAuthEncode(payloadType, payload))\n\tif err != nil {\n\t\treturn Signature{}, fmt.Errorf(\"sign payload with keyless signer: %w\", err)\n\t}\n\n\treturn Signature{","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L106-L142","documentation":"This error wraps failures while constructing the in-process signature verifier from the public key of a freshly obtained Fulcio keyless certificate during signer creation (newKeylessSigner). newSigstoreVerifierFromPublicKey builds a sigstore-go signature verifier from certificate.PublicKey; failure means the certificate's key could not be turned into a usable verifier (nil/unsupported key or underlying verifier construction error). It is almost always a symptom of an unexpected/unsupported Fulcio certificate key, not a user config error.","triggerScenarios":"Calling attestation signing with signing_mode=\"keyless\" and the Fulcio certificate returned from the CA has a nil or unsupported public key (e.g. unexpected algorithm), so newSigstoreVerifierFromPublicKey fails at internal/attestation/sign_keyless.go:122-124.","commonSituations":"A Fulcio mirror or custom FulcioURL (cfg.FulcioURL) issues certificates with an ECDSA/RSA variant unsupported by sigstore-go; a mocked/broken Fulcio returns a malformed certificate; sigstore-go library version upgrade changes supported key algorithms.","solutions":["Verify the Fulcio instance (default https://fulcio.sigstore.dev or cfg.FulcioURL) is genuine and issuing standard ECDSA P-256 certificates","Inspect certificate.PublicKey type; confirm sigstore-go supports the algorithm for your pinned sigstore-go version","Update or pin the sigstore-go dependency to a version that supports the key type being issued","Retry the operation — the ephemeral keypair is generated per-run, so a fresh run gets a new key and certificate"],"exampleFix":"// before (custom Fulcio issuing RSA certs)\nfulcioURL := \"https://fulcio.internal.example.com\"\n// after (use public Fulcio or one configured for ECDSA P-256)\nfulcioURL := \"\" // falls back to defaultFulcioURL https://fulcio.sigstore.dev","handlingStrategy":"validation","validationCode":"cert, err := x509.ParseCertificate(certDER)\nif err != nil { return err }\nswitch cert.PublicKey.(type) {\ncase *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:\n\t// supported by sigstore-go\ndefault:\n\treturn fmt.Errorf(\"unsupported Fulcio certificate key type %T\", cert.PublicKey)\n}","typeGuard":"func hasSupportedKey(cert *x509.Certificate) bool {\n\tswitch cert.PublicKey.(type) {\n\tcase *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":null,"preventionTips":["Use the public Fulcio instance or an internal one configured for ECDSA P-256","Pin a recent sigstore-go version and test keyless signing after upgrades","Fail fast by parsing the certificate and checking its key type before signing"],"tags":["go","sigstore","keyless-signing","cryptographic-key"],"backgroundTag":"unsupported-signing-key","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}