{"record":{"id":"653c76a3583c21bf","repo":"hashicorp/packer","slug":"build-keyless-identity-policy-w-653c76","errorCode":null,"errorMessage":"build keyless identity policy: %w","messagePattern":"build keyless identity policy: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":338,"sourceCode":"\n\tverifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create Sigstore bundle verifier: %w\", err)\n\t}\n\n\tartifactPolicy := sigstoreverify.WithoutArtifactUnsafe()\n\tif policy.ArtifactPath != \"\" {\n\t\tartifact, err := os.Open(policy.ArtifactPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"open artifact %q for bundle verification: %w\", policy.ArtifactPath, err)\n\t\t}\n\t\tdefer func() { _ = artifact.Close() }()\n\t\tartifactPolicy = sigstoreverify.WithArtifact(artifact)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, \"\", cfg.KeylessIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))\n\tif _, err := verifier.Verify(bundle, policyBuilder); err != nil {\n\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L320-L356","documentation":"sigstoreverify.NewShortCertificateIdentity rejected the keyless identity parameters, so the certificate-identity policy cannot be built. It is thrown because bundle verification requires a well-formed issuer/identity pair to match against the Fulcio certificate SAN. The inner error describes the specific validation failure.","triggerScenarios":"cfg.KeylessOIDCIssuer or cfg.KeylessIdentity is empty (partially checked earlier, but invalid forms slip through), or contains values NewShortCertificateIdentity cannot parse/accept (e.g. malformed issuer URL, empty required field for the short-form constructor).","commonSituations":"keyless_identity or keyless_oidc_issuer mistyped or swapped in config; using an email where the cert SAN holds 'usersanta:' style subject; trailing whitespace; changing OIDC provider so the issuer string no longer matches (e.g. accounts.google.com vs token.actions.githubusercontent.com).","solutions":["Set both keyless_identity and keyless_oidc_issuer exactly as encoded in the Fulcio certificate SAN/OID (issuer must match the OIDC issuer, identity the SAN)","Copy the identity/issuer values verbatim from the attestation or certificate (sigstorectl / cosign info can show them)","Trim whitespace and remove quotes/escaping mistakes from config values"],"exampleFix":"// before\ncfg.KeylessOIDCIssuer = \"github\"\ncfg.KeylessIdentity = \"my-org\"\n// after\ncfg.KeylessOIDCIssuer = \"https://token.actions.githubusercontent.com\"\ncfg.KeylessIdentity = \"https://github.com/my-org/my-repo/.github/workflows/release.yml@refs/tags/v1.0.0\"","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n    return fmt.Errorf(\"keyless_identity and keyless_oidc_issuer are required\")\n}\nif _, err := url.ParseRequestURI(cfg.KeylessOIDCIssuer); err != nil {\n    return fmt.Errorf(\"keyless_oidc_issuer %q is not a valid URL\", cfg.KeylessOIDCIssuer)\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"build keyless identity policy\") {\n        // surface config guidance: check identity/issuer values against the cert SAN\n    }\n}","preventionTips":["Copy identity/issuer verbatim from the Fulcio certificate SAN/OID values","Trim and unquote config values before use","Test the identity pair once with cosign verify to confirm it matches"],"tags":["sigstore","keyless","identity-policy"],"backgroundTag":"sigstore-identity-policy-invalid","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}