{"record":{"id":"6447d8b62d1b011e","repo":"hashicorp/packer","slug":"bundle-based-rekor-or-timestamp-verification-requi","errorCode":null,"errorMessage":"bundle-based Rekor or timestamp verification requires -bundle","messagePattern":"bundle-based Rekor or timestamp verification requires -bundle","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":282,"sourceCode":"\t\t\t\t\tbreak\n\t\t\t\t}\n\t\t\t}\n\t\t\tif !matched {\n\t\t\t\treturn nil, fmt.Errorf(\"attestation does not contain expected source URI %q\", policy.SourceURI)\n\t\t\t}\n\t\t}\n\t}\n\n\treturn &statement, nil\n}\n\nfunc requiresSigstoreBundle(policy VerificationPolicy) bool {\n\treturn policy.RequireTransparencyLog || policy.RequireObserverTimestamp\n}\n\nfunc verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\tif strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")\n\t}\n\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tbundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L264-L300","documentation":"verifySigstoreBundleEvidenceImpl verifies Rekor transparency-log or timestamp evidence from a Sigstore bundle, and policy.SigstoreBundlePath must contain the path to that bundle. This error means bundle-based verification was requested (e.g. RequireTransparencyLog or RequireObserverTimestamp) but no bundle path was supplied.","triggerScenarios":"Calling verification with policy.RequireTransparencyLog or RequireObserverTimestamp true while policy.SigstoreBundlePath is empty/whitespace.","commonSituations":"CLI invocation missing the -bundle flag while requiring Rekor evidence; offline verification workflows that assume the embedded envelope contains enough data; policy structs populated programmatically with only the requirement flags set.","solutions":["Provide the Sigstore bundle path (the -bundle flag / policy.SigstoreBundlePath) produced at signing time.","If no bundle exists, either drop RequireTransparencyLog/RequireObserverTimestamp or re-sign the artifact with bundle generation enabled (e.g. cosign sign-blob --bundle).","For online verification without a bundle, use a verification mode that fetches Rekor evidence rather than the bundle-based path."],"exampleFix":"// before\n// packer verify ... -require-transparency-log\n// after\n// packer verify ... -require-transparency-log -bundle artifact.sigstore.json","handlingStrategy":"validation","validationCode":"if (policy.RequireTransparencyLog || policy.RequireObserverTimestamp) && strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\treturn fmt.Errorf(\"-bundle is required when requiring Rekor/timestamp evidence\")\n}","typeGuard":null,"tryCatchPattern":"err := VerifyAttestation(...)\nif err != nil && strings.Contains(err.Error(), \"requires -bundle\") {\n\t// prompt user to supply the .sigstore.json bundle produced at signing time\n}","preventionTips":["Always pass -bundle when using -require-transparency-log or timestamp requirements","Store the .sigstore.json bundle alongside the signed artifact at release time","Fail fast in your own CLI wrapper when requirement flags are set without a bundle path"],"tags":["sigstore","rekor","missing-argument"],"backgroundTag":"missing-sigstore-bundle","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}