{"record":{"id":"4fccce8e5085ff46","repo":"hashicorp/packer","slug":"signing-mode-q-requires-a-recognized-kms-or-vault","errorCode":null,"errorMessage":"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://","messagePattern":"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":405,"sourceCode":"\tswitch mode {\n\tcase internalattestation.SigningModeNone:\n\t\treturn internalattestation.BackendConfig{Mode: mode}, nil\n\tcase internalattestation.SigningModeKey:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKMS:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\tif !isRecognizedKMSSigner(signerRef) {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKeyless:\n\t\tif p.config.Verifier != \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\tif strings.TrimSpace(p.config.KeylessIdentity) == \"\" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:              mode,\n\t\t\tEnv:               p.currentEnv(),\n\t\t\tFulcioURL:         p.config.FulcioURL,","sourceCodeStart":387,"sourceCodeEnd":423,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L387-L423","documentation":"signingBackendConfig validates that a KMS signer reference starts with a recognized scheme via isRecognizedKMSSigner. Only awskms://, gcpkms://, azurekms://, and hashivault:// URIs are accepted for signing_mode \"kms\".","triggerScenarios":"SigningModeKMS with non-empty signerRef whose value lacks a recognized prefix (e.g. plain key ID, file://, or a typo'd scheme like aws-kms://); raised in Configure/writeAttestation.","commonSituations":"Passing a bare AWS key ARN/alias instead of an awskms:// URI; using vault:// instead of hashivault://; using a scheme supported by cosign/other tooling but not this post-processor.","solutions":["Prefix the reference with a supported scheme: awskms://, gcpkms://, azurekms://, or hashivault://.","Correct scheme typos (aws-kms:// -> awskms://, vault:// -> hashivault://).","Convert a bare key ARN to awskms://<arn-or-alias>.","Check isRecognizedKMSSigner in post-processor/provenance/post-processor.go for the current allow-list."],"exampleFix":"// before\n\"signer\": \"arn:aws:kms:us-east-1:123456789:key/abcd\"\n// after\n\"signer\": \"awskms://arn:aws:kms:us-east-1:123456789:key/abcd\"","handlingStrategy":"validation","validationCode":"var kmsSchemes = []string{\"awskms://\", \"gcpkms://\", \"azurekms://\", \"hashivault://\"}\nfunc isRecognizedKMSSigner(v string) bool {\n\tfor _, p := range kmsSchemes {\n\t\tif strings.HasPrefix(v, p) { return true }\n\t}\n\treturn false\n}\n// check before configuring: isRecognizedKMSSigner(cfg.Signer)","typeGuard":null,"tryCatchPattern":"if err := p.Configure(raws); err != nil {\n\tif strings.Contains(err.Error(), \"recognized KMS or Vault URI\") {\n\t\treturn fmt.Errorf(\"fix signer URI scheme: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Always use one of awskms://, gcpkms://, azurekms://, hashivault:// prefixes.","Don't pass bare ARNs, aliases, or file:// paths in kms mode.","Centralize KMS URI construction in a helper reviewed by the team."],"tags":["kms","configuration","uri-scheme"],"backgroundTag":"unrecognized-uri-scheme","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}