{"record":{"id":"7fcbbad447636f8e","repo":"hashicorp/packer","slug":"attestation-q-has-unexpected-payloadtype-q-want","errorCode":null,"errorMessage":"attestation %q has unexpected payloadType %q (want %q)","messagePattern":"attestation %q has unexpected payloadType %q \\(want %q\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":53,"sourceCode":"var newSigstoreBundleVerifier = sigstoreverify.NewVerifier\n\nvar verifySigstoreBundleEvidence = func(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\treturn verifySigstoreBundleEvidenceImpl(envelope, cfg, policy)\n}\n\nfunc VerifyAttestationFile(ctx context.Context, path string, cfg BackendConfig, policy VerificationPolicy) (*internalprovenance.Statement, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read attestation %q: %w\", path, err)\n\t}\n\n\tvar envelope Envelope\n\tif err := json.Unmarshal(contents, &envelope); err != nil {\n\t\treturn nil, fmt.Errorf(\"decode attestation envelope %q: %w\", path, err)\n\t}\n\n\tif envelope.PayloadType != InTotoPayloadType {\n\t\treturn nil, fmt.Errorf(\"attestation %q has unexpected payloadType %q (want %q)\",\n\t\t\tpath, envelope.PayloadType, InTotoPayloadType)\n\t}\n\n\tif err := verifyEnvelopeSignature(ctx, path, cfg, policy, envelope); err != nil {\n\t\treturn nil, err\n\t}\n\n\tpayload, err := DecodeEnvelopePayload(envelope)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tstatement, err := verifyPolicy(payload, policy)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn statement, nil","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L35-L71","documentation":"VerifyAttestationFile rejects envelopes whose payloadType is not InTotoPayloadType (the in-toto/DSSE ITE-6 payload type). The library only understands in-toto statements, so any other DSSE payload type is refused before signature verification. The actual and expected payload types are echoed in the message.","triggerScenarios":"Verifying a DSSE envelope signed with a different payload type (e.g. a SLSA v0.2 layout, a custom payload, or a helm/scorecard attestation); producing an envelope with a hand-written payloadType string that does not match the constant; mixing outputs from other sigstore tools that use different payload types.","commonSituations":"Feeding a cosign-attested artifact of a non-in-toto type into this verifier; template/config wiring pointing at the wrong provenance file; upstream tool changed its payloadType after a version upgrade.","solutions":["Verify the payloadType field in the envelope JSON matches the in-toto value (application/vnd.in-toto+json)","Re-generate the attestation so it embeds an in-toto statement payload","Use the appropriate verifier for other payload types instead of this one","Check that the file is this library's attestation output and not another tool's DSSE envelope"],"exampleFix":"// before: envelope produced with a custom type\n// \"payloadType\": \"application/vnd.example.custom\"\n\n// after: ensure signing emits the in-toto payload type\n// \"payloadType\": \"application/vnd.in-toto+json\"","handlingStrategy":"validation","validationCode":"var probe struct{ PayloadType string `json:\"payloadType\"` }\nif err := json.Unmarshal(contents, &probe); err != nil { return err }\nif probe.PayloadType != \"application/vnd.in-toto+json\" {\n    return fmt.Errorf\"unsupported payloadType %q; need in-toto\", probe.PayloadType)\n}","typeGuard":"func isInTotoEnvelope(e attestation.Envelope) bool {\n    return e.PayloadType == attestation.InTotoPayloadType\n}","tryCatchPattern":"if _, err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"unexpected payloadType\") {\n        return fmt.Errorf\"file is signed but not an in-toto attestation\"%w\", err)\n    }\n    return err\n}","preventionTips":["Only feed this library attestations produced with its own signing path","Check payloadType in the envelope before dispatching to a verifier","Pin the upstream attesting tool version to avoid schema drift","Reject other sigstore DSSE payloads with a clear up-front message"],"tags":["attestation","dsse","intoto","validation"],"backgroundTag":"unexpected-payload-type","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}