{"record":{"id":"60fc5111b21683fb","repo":"hashicorp/packer","slug":"bundle-based-rekor-or-timestamp-verification-requi-60fc51","errorCode":null,"errorMessage":"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer","messagePattern":"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":290,"sourceCode":"\n\treturn &statement, nil\n}\n\nfunc requiresSigstoreBundle(policy VerificationPolicy) bool {\n\treturn policy.RequireTransparencyLog || policy.RequireObserverTimestamp\n}\n\nfunc verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\tif strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")\n\t}\n\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tbundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\tif err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {\n\t\treturn err\n\t}\n\n\tverifierOptions := []sigstoreverify.VerifierOption{}\n\tif policy.RequireTransparencyLog {","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L272-L308","documentation":"Keyless bundle verification must check the expected OIDC identity and issuer against the Fulcio certificate. This error means cfg.KeylessIdentity or cfg.KeylessOIDCIssuer is empty while bundle-based keyless verification was requested.","triggerScenarios":"verifySigstoreBundleEvidenceImpl invoked with a keyless (or certificate-bearing) envelope and a bundle path, but BackendConfig.KeylessIdentity and/or KeylessOIDCIssuer left unset.","commonSituations":"Forgetting to pass keyless_identity/keyless_oidc_issuer flags or config fields; CI tokens from a new provider whose issuer URL was never configured; partially migrated verification configs after switching from key to keyless signing.","solutions":["Set both cfg.KeylessIdentity (expected SAN identity) and cfg.KeylessOIDCIssuer (expected OIDC issuer URL) before verification.","For GitHub Actions, use the identity from the token (e.g. repo owner/repo ref) and issuer https://token.actions.githubusercontent.com.","Double-check for whitespace-only values; the check trims strings, so \" \" still counts as missing.","If the certificate allows multiple identities (SAN extensions), configure the identity option that matches how it was signed."],"exampleFix":"// before\ncfg := BackendConfig{Mode: SigningModeKeyless} // identity/issuer missing\n// after\ncfg := BackendConfig{Mode: SigningModeKeyless, KeylessIdentity: \"https://github.com/org/repo/.github/workflows/release.yml@refs/tags/v1.0.0\", KeylessOIDCIssuer: \"https://token.actions.githubusercontent.com\"}","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\treturn fmt.Errorf(\"keyless_identity and keyless_oidc_issuer must be set for bundle verification\")\n}","typeGuard":null,"tryCatchPattern":"err := VerifyAttestation(...)\nif err != nil && strings.Contains(err.Error(), \"requires keyless_identity and keyless_oidc_issuer\") {\n\t// surface a config error telling the user which flags to set\n}","preventionTips":["Set KeylessIdentity and KeylessOIDCIssuer alongside any keyless verification config","For GitHub Actions use issuer https://token.actions.githubusercontent.com and the workflow-based identity","Trim inputs before storing config so whitespace-only values never pass downstream checks"],"tags":["sigstore","keyless","missing-config"],"backgroundTag":"missing-keyless-identity","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}