{"record":{"id":"5f6d83177343f2a0","repo":"hashicorp/packer","slug":"signing-mode-q-is-not-implemented-5f6d83","errorCode":null,"errorMessage":"signing_mode %q is not implemented","messagePattern":"signing_mode %q is not implemented","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":431,"sourceCode":"\tcase internalattestation.SigningModeKeyless:\n\t\tif p.config.Verifier != \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\tif strings.TrimSpace(p.config.KeylessIdentity) == \"\" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:              mode,\n\t\t\tEnv:               p.currentEnv(),\n\t\t\tFulcioURL:         p.config.FulcioURL,\n\t\t\tRekorURL:          p.config.RekorURL,\n\t\t\tUploadTlog:        p.config.UploadTlog,\n\t\t\tTrustedRootPath:   p.config.TrustedRootPath,\n\t\t\tKeylessIdentity:   p.config.KeylessIdentity,\n\t\t\tKeylessOIDCIssuer: p.config.KeylessOIDCIssuer,\n\t\t}, nil\n\tdefault:\n\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q is not implemented\", mode)\n\t}\n}\n\nfunc isRecognizedKMSSigner(value string) bool {\n\tfor _, prefix := range []string{\"awskms://\", \"gcpkms://\", \"azurekms://\", \"hashivault://\"} {\n\t\tif strings.HasPrefix(value, prefix) {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\nfunc (p *PostProcessor) resolveSBOM(ctx context.Context, source packersdk.Artifact, paths outputPaths) (internalsbom.Format, []byte, error) {\n\t// The SBOM is always regenerated so it reflects the artifact being attested.\n\t// Reusing a pre-existing SBOM file could attest stale contents if the\n\t// artifact changed between runs.\n\tformat, err := internalsbom.ParseFormatFromArgs(p.config.SBOMFormat)","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L413-L449","documentation":"Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is not one of the implemented modes handled by the switch (none/file/kms/keyless), i.e. a typo'd or future mode string.","triggerScenarios":"The mode value parsed from signing_mode does not match none/key/kms/keyless cases in signingBackendConfig; raised during Configure or writeAttestation.","commonSituations":"Typo in signing_mode (e.g. \"keys\", \"kms-awskms\"); an internal mode enum value added upstream but not handled here; invalid value slipping past earlier template validation.","solutions":["Set signing_mode to one of: \"\" (none), \"file\", \"kms\", or \"keyless\"","Check for typos in the signing_mode attribute"],"exampleFix":"// before\n\"signing_mode\": \"kms-awskms\"\n// after\n\"signing_mode\": \"kms\",\n\"signer\": \"awskms://alias/packer-signing\"","handlingStrategy":"validation","validationCode":"var validModes = map[string]bool{\"none\": true, \"key\": true, \"kms\": true, \"keyless\": true}\nfunc checkSigningMode(m string) error {\n\tif !validModes[m] {\n\t\treturn fmt.Errorf(\"invalid signing_mode %q; use none|key|kms|keyless\", m)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := p.Configure(raws); err != nil {\n\tif strings.Contains(err.Error(), \"is not implemented\") {\n\t\treturn fmt.Errorf(\"use none|key|kms|keyless: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Restrict signing_mode values to none|key|kms|keyless in templates.","Run packer validate early in CI.","Keep a shared, reviewed signing config snippet for teams."],"tags":["configuration","signing","invalid-value"],"backgroundTag":"invalid-enum-value","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}