{"record":{"id":"6cdf39b9a2af2436","repo":"hashicorp/packer","slug":"parse-keyless-certificate-w","errorCode":null,"errorMessage":"parse keyless certificate: %w","messagePattern":"parse keyless certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":281,"sourceCode":"\nfunc (v *keylessVerifier) KeyID() string {\n\treturn v.signatureVerifier.KeyID()\n}\n\nfunc certificateFromEnvelope(envelope Envelope) (*x509.Certificate, error) {\n\tfor _, signature := range envelope.Signatures {\n\t\tif strings.TrimSpace(signature.Cert) == \"\" {\n\t\t\tcontinue\n\t\t}\n\n\t\tblock, _ := pem.Decode([]byte(signature.Cert))\n\t\tif block == nil {\n\t\t\treturn nil, fmt.Errorf(\"decode keyless certificate: no PEM block found\")\n\t\t}\n\n\t\tcertificate, err := x509.ParseCertificate(block.Bytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"parse keyless certificate: %w\", err)\n\t\t}\n\n\t\treturn certificate, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"keyless attestation does not contain a signing certificate\")\n}\n\ntype staticCertificateProvider struct {\n\tcertDER []byte\n}\n\nfunc (p staticCertificateProvider) GetCertificate(context.Context, sigstoregosign.Keypair, *sigstoregosign.CertificateProviderOptions) ([]byte, error) {\n\tif len(p.certDER) == 0 {\n\t\treturn nil, fmt.Errorf(\"static certificate provider is missing a certificate\")\n\t}\n\n\treturn append([]byte(nil), p.certDER...), nil","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L263-L299","documentation":"A PEM block was successfully decoded from the signature's Cert field, but x509.ParseCertificate rejected the DER bytes inside it. This means the PEM armor is present but its payload is not a parseable X.509 certificate (wrong block type, truncated bytes, or corrupted content).","triggerScenarios":"certificateFromEnvelope is called (via newKeylessVerifierForEnvelope or the TestKeylessBundleAndRekorIntegration test) with an envelope whose signature Cert decodes to PEM containing non-certificate DER, truncated DER, or a private key/CSR block.","commonSituations":"PEM block type mismatch (e.g. CERTIFICATE REQUEST or PRIVATE KEY instead of CERTIFICATE); copy/paste truncation of the final base64 lines; corruption during storage or transmission of the attestation JSON.","solutions":["Check the wrapped x509 error for the specific ASN.1 failure (truncated, wrong type).","Confirm the PEM block type is \"CERTIFICATE\" and the DER is complete (no missing final lines).","Regenerate the attestation envelope from the original keyless signer.","Validate the certificate with openssl x509 -in cert.pem -text -noout outside the library to isolate corruption."],"exampleFix":"// before\nblock, _ := pem.Decode([]byte(sig.Cert))\ncert, err := x509.ParseCertificate(block.Bytes) // fails on non-CERTIFICATE blocks\n// after\nblock, _ := pem.Decode([]byte(sig.Cert))\nif block == nil || block.Type != \"CERTIFICATE\" {\n    return fmt.Errorf(\"expected CERTIFICATE PEM block, got %q\", blockName(block))\n}\ncert, err := x509.ParseCertificate(block.Bytes)","handlingStrategy":"validation","validationCode":"func validCertPEM(s string) (*x509.Certificate, error) {\n    block, _ := pem.Decode([]byte(s))\n    if block == nil || block.Type != \"CERTIFICATE\" {\n        return nil, fmt.Errorf(\"not a CERTIFICATE PEM block\")\n    }\n    return x509.ParseCertificate(block.Bytes)\n}\n// pre-validate\nif _, err := validCertPEM(sig.Cert); err != nil {\n    return fmt.Errorf(\"attestation certificate malformed: %w\", err)\n}","typeGuard":"func parsesAsCertificate(s string) bool {\n    block, _ := pem.Decode([]byte(s))\n    if block == nil || block.Type != \"CERTIFICATE\" {\n        return false\n    }\n    _, err := x509.ParseCertificate(block.Bytes)\n    return err == nil\n}","tryCatchPattern":"verifier, err := newKeylessVerifierForEnvelope(cfg, envelope)\nif err != nil && strings.Contains(err.Error(), \"parse keyless certificate\") {\n    return fmt.Errorf(\"attestation certificate DER is corrupt or wrong type: %w\", err)\n}","preventionTips":["Verify certificate PEMs with openssl x509 before storing attestations.","Guard against truncation: checksum attestations in storage.","Only accept PEM blocks of type CERTIFICATE for the Cert field.","Keep envelopes machine-generated; avoid manual copy/paste edits."],"tags":["go","x509","pem","attestation"],"backgroundTag":"certificate-parse-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}