{"record":{"id":"7a045274ad3b9502","repo":"hashicorp/packer","slug":"extract-envelope-from-sigstore-bundle-w","errorCode":null,"errorMessage":"extract envelope from Sigstore bundle: %w","messagePattern":"extract envelope from Sigstore bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":183,"sourceCode":"\t\t}\n\n\t\toptions.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}\n\t\toptions.TrustedRoot = trustedMaterial\n\t}\n\n\tprotobufBundle, err := newKeylessBundle(content, s.keypair, options)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"build Sigstore bundle: %w\", err)\n\t}\n\n\tbundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"decode Sigstore bundle: %w\", err)\n\t}\n\n\tbundleEnvelope, err := bundleWrapper.Envelope()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"extract envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tbundleJSON, err := bundleWrapper.MarshalJSON()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"marshal Sigstore bundle: %w\", err)\n\t}\n\n\tenvelope := Envelope{\n\t\tPayloadType: rawEnvelope.PayloadType,\n\t\tPayload:     rawEnvelope.Payload,\n\t\tSignatures: []EnvelopeSignature{{\n\t\t\tKeyID: s.keyID,\n\t\t\tSig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L165-L201","documentation":"The decoded Sigstore bundle should carry the DSSE envelope used for signing; bundleWrapper.Envelope() extracts it and this error wraps any failure. Since the bundle was just built from DSSEData content, failure means sigstore-go could not interpret the bundle's message signature as a DSSE envelope — effectively always an upstream/library or stub inconsistency, not a caller issue.","triggerScenarios":"SignBundle calls bundleWrapper.Envelope() at internal/attestation/sign_keyless.go:181-183 after NewBundle succeeds; fails when the bundle does not expose a DSSE envelope (e.g. bundle built without DSSE content, unexpected bundle variant, or sigstore-go API mismatch).","commonSituations":"A stubbed/mocked newKeylessBundle in tests producing a non-DSSE bundle; sigstore-go version where Envelope() semantics changed; manually constructed protobuf bundle missing the DSSE message signature.","solutions":["Verify the sigstore-go version and that DSSEData-based bundle construction is supported; upgrade if needed","If a test stub replaces newKeylessBundle, make it produce a bundle containing a DSSE envelope","Retry the normal signing path without stubs to confirm the failure is not data-dependent"],"exampleFix":"// before (test stub)\nnewKeylessBundle = func(...) (*pb.Bundle, error) { return &pb.Bundle{}, nil } // no DSSE\n// after\nnewKeylessBundle = sigstoregosign.Bundle // use real constructor in integration path","handlingStrategy":"fallback","validationCode":"// ensure DSSE content is used (the library path does this); in tests, assert the stub\nif newKeylessBundle != (func(...) (*pb.Bundle, error))(sigstoregosign.Bundle) {\n\t// custom constructor must produce a DSSE bundle\n}","typeGuard":null,"tryCatchPattern":"envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)\nif err != nil && strings.Contains(err.Error(), \"extract envelope from Sigstore bundle\") {\n\treturn fmt.Errorf(\"bundle lacks DSSE envelope; rebuild with real Bundle constructor: %w\", err)\n}","preventionTips":["Do not stub sigstoregosign.Bundle in production paths","Upgrade sigstore-go when Envelope() semantics change","Always build bundles from DSSEData content"],"tags":["go","sigstore","dsse","bundle"],"backgroundTag":"dsse-envelope-missing","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}