{"record":{"id":"651f0fd062a832d8","repo":"hashicorp/packer","slug":"signing-mode-q-does-not-support-verifier-override","errorCode":null,"errorMessage":"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer","messagePattern":"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":415,"sourceCode":"\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKMS:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\tif !isRecognizedKMSSigner(signerRef) {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKeyless:\n\t\tif p.config.Verifier != \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\tif strings.TrimSpace(p.config.KeylessIdentity) == \"\" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:              mode,\n\t\t\tEnv:               p.currentEnv(),\n\t\t\tFulcioURL:         p.config.FulcioURL,\n\t\t\tRekorURL:          p.config.RekorURL,\n\t\t\tUploadTlog:        p.config.UploadTlog,\n\t\t\tTrustedRootPath:   p.config.TrustedRootPath,\n\t\t\tKeylessIdentity:   p.config.KeylessIdentity,\n\t\t\tKeylessOIDCIssuer: p.config.KeylessOIDCIssuer,\n\t\t}, nil\n\tdefault:\n\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q is not implemented\", mode)\n\t}\n}","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L397-L433","documentation":"In keyless signing mode, verification identity comes from keyless_identity and keyless_oidc_issuer, so a custom `verifier` reference is not allowed. Setting both is contradictory and rejected at config time.","triggerScenarios":"SigningModeKeyless with p.config.Verifier non-empty; raised by signingBackendConfig during Configure or writeAttestation.","commonSituations":"Template reuses a `verifier` field from key/kms mode while switching to keyless; user tries to pin a public key for keyless verification, which is unsupported.","solutions":["Remove the `verifier` field from the config.","Rely on keyless_identity + keyless_oidc_issuer for verification.","Switch to signing_mode \"key\" or \"kms\" if a fixed verifier key is actually required."],"exampleFix":"// before\n\"signing_mode\": \"keyless\",\n\"verifier\": \"file:///keys/pub.pem\",\n\"keyless_identity\": \"ci@example.com\"\n// after\n\"signing_mode\": \"keyless\",\n\"keyless_identity\": \"ci@example.com\",\n\"keyless_oidc_issuer\": \"https://token.actions.githubusercontent.com\"","handlingStrategy":"validation","validationCode":"func checkKeylessOverride(mode, verifier string) error {\n\tif mode == \"keyless\" && verifier != \"\" {\n\t\treturn fmt.Errorf(\"keyless mode ignores verifier; remove it\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := p.Configure(raws); err != nil {\n\tif strings.Contains(err.Error(), \"does not support verifier overrides\") {\n\t\treturn fmt.Errorf(\"drop verifier for keyless mode: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Remove verifier fields when switching modes to keyless.","Keep per-mode config blocks separated in templates.","Run packer validate when changing signing_mode."],"tags":["configuration","keyless","sigstore"],"backgroundTag":"conflicting-config-fields","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}