{"record":{"id":"6283a36eff7c9c12","repo":"hashicorp/packer","slug":"read-attestation-q-w","errorCode":null,"errorMessage":"read attestation %q: %w","messagePattern":"read attestation %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":44,"sourceCode":"\tSourceURI                string\n\tArtifactPath             string\n\tSigstoreBundlePath       string\n\tRequireTransparencyLog   bool\n\tRequireObserverTimestamp bool\n}\n\nvar loadSigstoreBundle = sigstorebundle.LoadJSONFromPath\n\nvar newSigstoreBundleVerifier = sigstoreverify.NewVerifier\n\nvar verifySigstoreBundleEvidence = func(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\treturn verifySigstoreBundleEvidenceImpl(envelope, cfg, policy)\n}\n\nfunc VerifyAttestationFile(ctx context.Context, path string, cfg BackendConfig, policy VerificationPolicy) (*internalprovenance.Statement, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read attestation %q: %w\", path, err)\n\t}\n\n\tvar envelope Envelope\n\tif err := json.Unmarshal(contents, &envelope); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode attestation envelope %q: %w\", path, err)\n\t}\n\n\tif envelope.PayloadType != InTotoPayloadType {\n\t\treturn nil, fmt.Errorf(\"attestation %q has unexpected payloadType %q (want %q)\",\n\t\t\tpath, envelope.PayloadType, InTotoPayloadType)\n\t}\n\n\tif err := verifyEnvelopeSignature(ctx, path, cfg, policy, envelope); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpayload, err := DecodeEnvelopePayload(envelope)\n\tif err != nil {","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L26-L62","documentation":"VerifyAttestationFile wraps the os.ReadFile failure for the attestation path in `read attestation %q: %w`. It means the file at the given path could not be opened or read — typically it does not exist, the path is wrong, or permissions deny access. The underlying OS error is preserved for diagnosis.","triggerScenarios":"Calling VerifyAttestationFile(ctx, path, cfg, policy) with a path that does not exist, a directory instead of a file, a path with a typo, or a file the process lacks read permission for; running before the signing step produced the attestation.","commonSituations":"Relative vs absolute path confusion when invoking packer from a different working directory; attestation written to a different output directory than expected; CI artifact not downloaded/mounted; restrictive file modes after artifact upload.","solutions":["Verify the path exists with os.Stat or ls and correct typos","Use an absolute path or run from the directory you expect","Check file read permissions for the invoking user","Ensure the signing pipeline actually wrote the attestation before verification runs"],"exampleFix":"// before\nstmt, err := attestation.VerifyAttestationFile(ctx, \"attest.json\", cfg, policy)\n\n// after: check existence first\nif _, err := os.Stat(\"dist/attest.json\"); err != nil { log.Fatal(err) }\nstmt, err := attestation.VerifyAttestationFile(ctx, \"dist/attest.json\", cfg, policy)","handlingStrategy":"validation","validationCode":"if info, err := os.Stat(path); err != nil { return fmt.Errorf\"attestation %s unavailable: %w\", path, err) } else if info.IsDir() { return fmt.Errorf\"%s is a directory\", path) }","typeGuard":null,"tryCatchPattern":"stmt, err := attestation.VerifyAttestationFile(ctx, path, cfg, policy)\nif err != nil {\n    var pe *fs.PathError\n    if errors.As(err, &pe) && errors.Is(err, fs.ErrNotExist) {\n        return fmt.Errorf\"attestation file missing at %s — did signing run?\", path)\n    }\n    return err\n}","preventionTips":["Stat the attestation path before verification","Use absolute paths derived from the artifact output directory","Ensure the signing step completes (and uploads the file) before verification in CI","Check file permissions after artifact transfer"],"tags":["filesystem","io","attestation"],"backgroundTag":"file-not-found","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}