{"record":{"id":"58c3cff92b8f7191","repo":"hashicorp/packer","slug":"signing-mode-q-requires-signer-or-key","errorCode":null,"errorMessage":"signing_mode %q requires signer or key","messagePattern":"signing_mode %q requires signer or key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":34,"sourceCode":")\n\nvar newKMSSignerVerifier = func(ctx context.Context, keyResourceID string) (sigstorekms.SignerVerifier, error) {\n\treturn sigstorekms.Get(ctx, keyResourceID, crypto.SHA256)\n}\n\nfunc init() {\n\tRegisterSigner(SigningModeKMS, newKMSSigner)\n}\n\ntype kmsSigner struct {\n\tsignerVerifier sigstorekms.SignerVerifier\n\tverifier       Verifier\n\tkeyID          string\n}\n\nfunc newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {\n\tif cfg.SignerRef == \"\" {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q requires signer or key\", SigningModeKMS)\n\t}\n\n\tsignerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)\n\tif err != nil {\n\t\tvar notFound *sigstorekms.ProviderNotFoundError\n\t\tif errors.As(err, &notFound) {\n\t\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w%s\", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tpublicKey, err := signerVerifier.PublicKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load KMS public key %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L16-L52","documentation":"newKMSSigner builds a KMS-backed attestation signer, but a KMS signing mode is meaningless without a key reference: cfg.SignerRef (from the 'signer' or 'key' config) identifies which cloud KMS key resource to use. This error is thrown as a fast, explicit config validation failure when SignerRef is empty, before any KMS provider is contacted. It exists to give a clear, actionable message instead of a cryptic provider error about an empty key resource ID.","triggerScenarios":"Configuring signing_mode = \"kms\" (SigningModeKMS) in the attestation backend without setting either the 'signer' or 'key' field, so BackendConfig.SignerRef is the empty string when newKMSSigner is invoked.","commonSituations":"Copy-pasting a config template and deleting the key line; switching from file-based key signing to KMS and forgetting to add the key reference; generating config programmatically and the key field defaulting to empty; typo in the field name so the intended value never lands in SignerRef.","solutions":["Set the KMS key reference in the config, e.g. signer = \"awskms://alias/my-signing-key\" or the equivalent 'key' field value.","Double-check field spelling in your config so the value actually populates SignerRef.","If you do not have a KMS key, use a different signing mode (e.g. a local 'key' file signer) instead of signing_mode \"kms\"."],"exampleFix":"# before\n[attestation.signing]\nsigning_mode = \"kms\"\n# after\n[attestation.signing]\nsigning_mode = \"kms\"\nsigner = \"awskms://alias/my-signing-key\"","handlingStrategy":"validation","validationCode":"if strings.EqualFold(cfg.SigningMode, \"kms\") && cfg.SignerRef == \"\" {\n\treturn errors.New(`signing_mode \"kms\" needs a signer/key, e.g. signer = \"awskms://alias/my-key\"`)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set signer/key when signing_mode is \"kms\".","Validate config at startup with a schema/linter before running builds.","Use one config template that includes the key placeholder for each signing mode.","Check field names carefully — a typo silently yields an empty SignerRef."],"tags":["config","kms","validation"],"backgroundTag":"missing-required-config","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}