{"record":{"id":"4d1e5862ed4bee6f","repo":"hashicorp/packer","slug":"verifier-overrides-are-not-supported-for-keyless-a","errorCode":null,"errorMessage":"verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead","messagePattern":"verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":153,"sourceCode":"\t}\n\n\tif entries, err := bundle.TlogEntries(); err == nil && len(entries) > 0 {\n\t\treturn true\n\t}\n\n\tif timestamps, err := bundle.Timestamps(); err == nil && len(timestamps) > 0 {\n\t\treturn true\n\t}\n\n\treturn false\n}\n\nfunc verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {\n\tmode := normalizeVerificationMode(cfg, envelope)\n\n\tif cfg.VerifierRef != \"\" {\n\t\tif mode == SigningModeKeyless || envelopeHasCertificate(envelope) {\n\t\t\treturn nil, fmt.Errorf(\"verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead\")\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.VerifierRef)\n\t}\n\n\tswitch mode {\n\tcase SigningModeKey:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires verifier or key\", SigningModeKey)\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.SignerRef)\n\tcase SigningModeKMS:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires key or verifier\", SigningModeKMS)\n\t\t}\n\t\tsigner, err := NewSigner(ctx, cfg)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L135-L171","documentation":"verifierForEnvelope refuses a VerifierRef override when the envelope is keyless — either signing_mode is keyless or the envelope's signatures carry an X.509 certificate. Keyless attestations are signed with short-lived Fulcio certificates, so a static PEM verifier cannot validate them; callers must use keyless_identity and keyless_oidc_issuer (with Sigstore trust material) instead.","triggerScenarios":"Calling VerifyAttestationFile with BackendConfig.VerifierRef set on an envelope whose signatures include a cert field, or with Mode=SigningModeKeyless while VerifierRef is also set; combining a --verifier flag with a keyless-signed attestation.","commonSituations":"Reusing a key-based verification config for artifacts signed via keyless/Fulcio (e.g. GitHub Actions OIDC); copying a template stanza from a key-based pipeline into a keyless one; setting verifier globally in config and forgetting it applies to keyless files too.","solutions":["Remove VerifierRef and set KeylessIdentity plus KeylessOIDCIssuer on the config","Let the Sigstore bundle sidecar (<file>.sigstore.json) be discovered, or set policy.SigstoreBundlePath explicitly","Re-sign with a static key if PEM-based verification is required","Set signing_mode=key only when the envelope truly lacks certificates"],"exampleFix":"// before\ncfg := attestation.BackendConfig{VerifierRef: \"key.pub\"}\n\n// after\ncfg := attestation.BackendConfig{\n  Mode:             attestation.SigningModeKeyless,\n  KeylessIdentity:  \"https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main\",\n  KeylessOIDCIssuer: \"https://token.actions.githubusercontent.com\",\n}","handlingStrategy":"validation","validationCode":"var probe struct{ Signatures []struct{ Cert string `json:\"cert\"` } `json:\"signatures\"` }\n_ = json.Unmarshal(contents, &probe)\nfor _, s := range probe.Signatures {\n    if s.Cert != \"\" && cfg.VerifierRef != \"\" {\n        return errors.New\"certificate-bearing (keyless) envelope cannot use VerifierRef\")\n    }\n}","typeGuard":"func isKeylessEnvelope(e attestation.Envelope) bool {\n    for _, s := range e.Signatures { if strings.TrimSpace(s.Cert) != \"\" { return true } }\n    return false\n}","tryCatchPattern":"if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"verifier overrides are not supported for keyless\") {\n        return fmt.Errorf\"switch to keyless_identity/keyless_oidc_issuer verification: %w\", err)\n    }\n    return err\n}","preventionTips":["Branch verification config on the envelope's signature type, not a single static config","Set keyless_identity and keyless_oidc_issuer whenever artifacts are keyless-signed","Keep the .sigstore.json sidecar next to keyless attestations","Document in pipeline config which mode produced each artifact"],"tags":["attestation","keyless","sigstore","config"],"backgroundTag":"incompatible-verifier-config","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}