{"record":{"id":"765f9a149741bbbb","repo":"hashicorp/packer","slug":"signing-mode-q-requires-keyless-identity-and-keyl-765f9a","errorCode":null,"errorMessage":"signing_mode %q requires keyless_identity and keyless_oidc_issuer","messagePattern":"signing_mode %q requires keyless_identity and keyless_oidc_issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":418,"sourceCode":"\tcase internalattestation.SigningModeKMS:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\tif !isRecognizedKMSSigner(signerRef) {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKeyless:\n\t\tif p.config.Verifier != \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\tif strings.TrimSpace(p.config.KeylessIdentity) == \"\" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires keyless_identity and keyless_oidc_issuer\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:              mode,\n\t\t\tEnv:               p.currentEnv(),\n\t\t\tFulcioURL:         p.config.FulcioURL,\n\t\t\tRekorURL:          p.config.RekorURL,\n\t\t\tUploadTlog:        p.config.UploadTlog,\n\t\t\tTrustedRootPath:   p.config.TrustedRootPath,\n\t\t\tKeylessIdentity:   p.config.KeylessIdentity,\n\t\t\tKeylessOIDCIssuer: p.config.KeylessOIDCIssuer,\n\t\t}, nil\n\tdefault:\n\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q is not implemented\", mode)\n\t}\n}\n\nfunc isRecognizedKMSSigner(value string) bool {\n\tfor _, prefix := range []string{\"awskms://\", \"gcpkms://\", \"azurekms://\", \"hashivault://\"} {","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L400-L436","documentation":"Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is \"keyless\", but keyless signing needs both `keyless_identity` (the SAN identity, e.g. an email) and `keyless_oidc_issuer` (the issuer URL) to later verify the attestation; one or both are blank.","triggerScenarios":"SigningModeKeyless where strings.TrimSpace(KeylessIdentity) == \"\" or strings.TrimSpace(KeylessOIDCIssuer) == \"\"; raised in signingBackendConfig.","commonSituations":"signing_mode = \"keyless\" set for CI provenance but the identity/issuer fields left blank; whitespace-only values from HCL variables interpolating to empty.","solutions":["Set both keyless_identity and keyless_oidc_issuer, e.g. identity from your OIDC token and its issuer URL","Trim accidental whitespace-only values in those fields"],"exampleFix":"// before\n\"signing_mode\": \"keyless\"\n// after\n\"signing_mode\": \"keyless\",\n\"keyless_identity\": \"https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main\",\n\"keyless_oidc_issuer\": \"https://token.actions.githubusercontent.com\"","handlingStrategy":"validation","validationCode":"func checkKeylessFields(mode, identity, issuer string) error {\n\tif mode == \"keyless\" && (strings.TrimSpace(identity) == \"\" || strings.TrimSpace(issuer) == \"\") {\n\t\treturn fmt.Errorf(\"keyless requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := p.Configure(raws); err != nil {\n\tif strings.Contains(err.Error(), \"keyless_identity and keyless_oidc_issuer\") {\n\t\treturn fmt.Errorf(\"fill keyless identity fields: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Set both keyless_identity and keyless_oidc_issuer whenever signing_mode = \"keyless\".","Check interpolated HCL variables resolve to non-empty values.","Use the well-known GitHub OIDC issuer URL for Actions-based provenance."],"tags":["keyless","configuration","oidc"],"backgroundTag":"missing-required-config-field","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}