{"record":{"id":"58da44a7431ce12d","repo":"hashicorp/packer","slug":"verify-attestation-envelope-q-w","errorCode":null,"errorMessage":"verify attestation envelope %q: %w","messagePattern":"verify attestation envelope %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":98,"sourceCode":"\t// Keyless attestations are signed with a short-lived Fulcio certificate that\n\t// appears expired against wall-clock time moments after signing. When a\n\t// Sigstore bundle carrying transparency-log or timestamp evidence is\n\t// available, prefer it so the certificate is validated as of the signing\n\t// time recorded in that evidence rather than the current time.\n\tif envelopeHasCertificate(envelope) {\n\t\tif bundlePath := resolveSigstoreBundlePath(policy, path); bundlePath != \"\" && bundleAnchorsSigningTime(bundlePath) {\n\t\t\tpolicy.SigstoreBundlePath = bundlePath\n\t\t\treturn verifySigstoreBundleEvidence(envelope, cfg, policy)\n\t\t}\n\t}\n\n\tverifier, err := verifierForEnvelope(ctx, cfg, envelope)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify attestation envelope %q: %w\", path, err)\n\t}\n\n\treturn nil\n}\n\n// resolveSigstoreBundlePath returns an explicitly configured bundle path, or the\n// conventional \"<attestation>.sigstore.json\" sidecar written alongside signed\n// attestations when it exists on disk.\nfunc resolveSigstoreBundlePath(policy VerificationPolicy, attestationPath string) string {\n\tif trimmed := strings.TrimSpace(policy.SigstoreBundlePath); trimmed != \"\" {\n\t\treturn trimmed\n\t}\n\n\tcandidate := defaultSigstoreBundlePath(attestationPath)\n\tif info, err := os.Stat(candidate); err == nil && !info.IsDir() {\n\t\treturn candidate\n\t}\n","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L80-L116","documentation":"verifyEnvelopeSignature wraps any VerifyEnvelope failure with `verify attestation envelope %q: %w` so the failing file path is included. The underlying cause is almost always error 150: no signature in the envelope validated against the chosen verifier. The wrapped error chain preserves the root reason.","triggerScenarios":"VerifyAttestationFile proceeds past payloadType validation, builds a verifier via verifierForEnvelope, and VerifyEnvelope rejects all signatures — wrong key, tampered payload, or an envelope with undecodable signatures.","commonSituations":"Verifying with a public key from a different signer; envelope edited or corrupted after signing; a KMS key reference that does not match the original signing key after rotation; mismatch between keyless and key-mode configuration.","solutions":["Check the wrapped inner error and fix per its cause (usually key mismatch)","Load the public key corresponding to the actual signing key of this file","Re-verify the envelope's integrity or re-generate the attestation","For keyless files, supply keyless_identity/keyless_oidc_issuer and the Sigstore bundle"],"exampleFix":"// before\n// key.pub from an older signing key\nattestation.VerifyAttestationFile(ctx, path, cfgWith(\"key.pub\"), policy) // verify attestation envelope \"a.json\": signature verification failed\n\n// after\n// current signer's public key\nattestation.VerifyAttestationFile(ctx, path, cfgWith(\"current-key.pub\"), policy)","handlingStrategy":"try-catch","validationCode":"// confirm config matches signing mode before verification\nif cfg.Mode == attestation.SigningModeKey && cfg.SignerRef == \"\" && cfg.VerifierRef == \"\" {\n    return errors.New\"key mode needs a key or verifier reference\")\n}","typeGuard":null,"tryCatchPattern":"if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"verify attestation envelope\") {\n        return fmt.Errorf\"could not verify %s with configured verifier: %w\", path, err)\n    }\n    return err\n}","preventionTips":["Track which key signed each artifact and load the matching verifier","Use errors.As/Is on the wrapped chain to reach the root cause","Keep envelopes immutable after signing","Run a sign-then-verify smoke test in the same pipeline"],"tags":["attestation","signature","dsse"],"backgroundTag":"signature-verification-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}