{"record":{"id":"669b0c6541063131","repo":"hashicorp/packer","slug":"sigstore-bundle-does-not-contain-a-dsse-envelope","errorCode":null,"errorMessage":"sigstore bundle does not contain a DSSE envelope","messagePattern":"sigstore bundle does not contain a DSSE envelope","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":188,"sourceCode":"\n\tprotobufBundle, err := newKeylessBundle(content, s.keypair, options)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"build Sigstore bundle: %w\", err)\n\t}\n\n\tbundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"decode Sigstore bundle: %w\", err)\n\t}\n\n\tbundleEnvelope, err := bundleWrapper.Envelope()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"extract envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tbundleJSON, err := bundleWrapper.MarshalJSON()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"marshal Sigstore bundle: %w\", err)\n\t}\n\n\tenvelope := Envelope{\n\t\tPayloadType: rawEnvelope.PayloadType,\n\t\tPayload:     rawEnvelope.Payload,\n\t\tSignatures: []EnvelopeSignature{{\n\t\t\tKeyID: s.keyID,\n\t\t\tSig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),\n\t\t\tCert:  string(s.certPEM),\n\t\t}},\n\t}\n\n\treturn envelope, bundleJSON, nil","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L170-L206","documentation":"After extracting the bundle envelope, SignBundle reads RawEnvelope() to recover the payload type/payload bytes; a nil result means the bundle parsed but contains no raw DSSE envelope structure. Because the bundle was created locally from DSSEData, this defensive check should only fire with library inconsistency or a stub returning an empty envelope.","triggerScenarios":"SignBundle reaches bundleEnvelope.RawEnvelope() == nil at internal/attestation/sign_keyless.go:186-189 — bundle exists but its raw DSSE envelope is nil (empty/malformed envelope from stubbed construction or sigstore-go returning an empty protobuf envelope).","commonSituations":"Test doubles returning empty sigstore-go envelopes; sigstore-go upgrade changing RawEnvelope behavior; hand-assembled protobuf bundles lacking the DSSE envelope message.","solutions":["Use the real sigstoregosign.Bundle constructor path (no stubs) and retry","Upgrade/pin sigstore-go to a version whose Envelope()/RawEnvelope() behavior matches the code's expectations","Check for empty payload/payloadType inputs that could yield a degenerate envelope; pass non-empty content"],"exampleFix":"// before\nenvelope, bundleJSON, err := signer.SignBundle(ctx, \"\", nil, cfg) // empty payload\n// after\nenvelope, bundleJSON, err := signer.SignBundle(ctx, \"application/vnd.in-toto+json\", inTotoBytes, cfg)","handlingStrategy":"validation","validationCode":"if len(payload) == 0 || strings.TrimSpace(payloadType) == \"\" {\n\treturn fmt.Errorf(\"refusing to sign empty payload or payload type\")\n}","typeGuard":null,"tryCatchPattern":"envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)\nif err != nil && strings.Contains(err.Error(), \"does not contain a DSSE envelope\") {\n\treturn fmt.Errorf(\"degenerate bundle produced; check payload inputs and library version: %w\", err)\n}","preventionTips":["Pass non-empty payload and a valid payloadType","Use the unmodified library bundle path","Pin a sigstore-go version matching the code's RawEnvelope expectations"],"tags":["go","sigstore","dsse","bundle"],"backgroundTag":"dsse-envelope-missing","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}