{"record":{"id":"635dad9255af2c52","repo":"hashicorp/packer","slug":"unexpected-attestation-statement-type-q","errorCode":null,"errorMessage":"unexpected attestation statement type %q","messagePattern":"unexpected attestation statement type %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":227,"sourceCode":"\nfunc isRecognizedKMSReference(value string) bool {\n\tfor _, prefix := range []string{\"awskms://\", \"gcpkms://\", \"azurekms://\", \"hashivault://\"} {\n\t\tif strings.HasPrefix(value, prefix) {\n\t\t\treturn true\n\t\t}\n\t}\n\n\treturn false\n}\n\nfunc verifyPolicy(payload []byte, policy VerificationPolicy) (*internalprovenance.Statement, error) {\n\tvar statement internalprovenance.Statement\n\tif err := json.Unmarshal(payload, &statement); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode attestation statement: %w\", err)\n\t}\n\n\tif statement.Type != internalprovenance.StatementType {\n\t\treturn nil, fmt.Errorf(\"unexpected attestation statement type %q\", statement.Type)\n\t}\n\n\tif policy.PredicateType != \"\" && statement.PredicateType != policy.PredicateType {\n\t\treturn nil, fmt.Errorf(\"attestation predicate type %q does not match expected %q\", statement.PredicateType, policy.PredicateType)\n\t}\n\n\tif policy.ArtifactPath != \"\" {\n\t\tif err := verifyArtifactSubject(statement.Subject, policy.ArtifactPath); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\tif policy.BuilderID != \"\" || policy.SourceURI != \"\" {\n\t\tif statement.PredicateType != internalprovenance.SLSAProvenanceV1PredicateType {\n\t\t\treturn nil, fmt.Errorf(\"builder and source policy checks require predicate type %q, got %q\", internalprovenance.SLSAProvenanceV1PredicateType, statement.PredicateType)\n\t\t}\n\n\t\tvar typedStatement struct {","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L209-L245","documentation":"verifyPolicy decodes an in-toto attestation payload and requires the top-level statement `_type` to equal the canonical in-toto statement type (internalprovenance.StatementType, e.g. \"https://in-toto.io/Statement/v1\"). This error means the payload parsed as JSON but its `_type` field is missing or set to an unexpected value, so it is not a valid in-toto statement for verification.","triggerScenarios":"Calling VerifyAttestationFile (which calls verifyPolicy) with an attestation file whose `_type` is empty, an older in-toto version (e.g. Statement/v0.1), or a non-statement JSON document.","commonSituations":"Pointing the attestation policy at a raw Sigstore bundle, DSSE envelope, or SBOM/scan report instead of an extracted in-toto statement; attestations generated by older tooling that used v0.1 statements; hand-written or truncated JSON files.","solutions":["Open the attestation file and check the top-level `_type` field; ensure it is the expected in-toto statement URI (https://in-toto.io/Statement/v1).","Regenerate the attestation with a current version of the producing tool so it emits a v1 in-toto statement.","Verify you are passing the extracted statement, not a DSSE envelope or bundle file, to verification.","If a custom predicate type is used, confirm only the predicateType differs and the `_type` remains the standard statement type."],"exampleFix":"// before\n{\"_type\":\"https://in-toto.io/Statement/v0.1\",\"predicateType\":\"https://slsa.dev/provenance/v1\",...}\n// after\n{\"_type\":\"https://in-toto.io/Statement/v1\",\"predicateType\":\"https://slsa.dev/provenance/v1\",...}","handlingStrategy":"validation","validationCode":"var s struct{ Type string `json:\"_type\"` }\nif err := json.Unmarshal(payload, &s); err != nil || s.Type != \"https://in-toto.io/Statement/v1\" {\n\treturn fmt.Errorf(\"not an in-toto v1 statement: type=%q\", s.Type)\n}","typeGuard":"func isInTotoStatement(payload []byte) bool {\n\tvar s struct{ Type string `json:\"_type\"` }\n\treturn json.Unmarshal(payload, &s) == nil && s.Type == \"https://in-toto.io/Statement/v1\"\n}","tryCatchPattern":"stmt, err := VerifyAttestationFile(path, policy)\nif err != nil {\n\tvar decodeErr *json.UnmarshalTypeError\n\tif errors.As(err, &decodeErr) || strings.Contains(err.Error(), \"unexpected attestation statement type\") {\n\t\t// wrong file format: check you extracted the statement, not the envelope\n\t}\n\treturn err\n}","preventionTips":["Always feed the extracted in-toto statement (not the DSSE envelope or bundle) to verification","Check _type in the attestation file before running policy checks","Pin the producing tool's version so statement format (v1) is stable"],"tags":["attestation","in-toto","validation"],"backgroundTag":"in-toto-statement-type-mismatch","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}