{"record":{"id":"81207ab022004577","repo":"hashicorp/packer","slug":"load-sigstore-bundle-q-w","errorCode":null,"errorMessage":"load Sigstore bundle %q: %w","messagePattern":"load Sigstore bundle %q: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":300,"sourceCode":"\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")\n\t}\n\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tbundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\tif err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {\n\t\treturn err\n\t}\n\n\tverifierOptions := []sigstoreverify.VerifierOption{}\n\tif policy.RequireTransparencyLog {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))\n\t}\n\tif policy.RequireObserverTimestamp {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}\n\tif len(verifierOptions) == 0 {\n\t\t// A trusted time source is required to validate the short-lived Fulcio\n\t\t// certificate as of signing time; default to observer timestamps when the\n\t\t// caller has not explicitly required Rekor or timestamp evidence.\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L282-L318","documentation":"This error wraps any failure from loadSigstoreBundle() while reading and parsing the Sigstore bundle file passed via policy.SigstoreBundlePath (the -bundle flag). It is thrown because bundle-based Rekor/timestamp verification is impossible without a parseable bundle. The wrapped inner error tells whether it was an I/O failure (missing/unreadable file) or a format/parsing failure.","triggerScenarios":"verifySigstoreBundleEvidenceImpl is called with a non-empty SigstoreBundlePath, but loadSigstoreBundle fails: the file does not exist, is unreadable (permissions), is empty, or is not a valid Sigstore bundle (bad JSON/protobuf, wrong media type).","commonSituations":"Typo in the -bundle path; running from a different working directory with a relative path; downloading an incomplete or truncated bundle; passing an attestation or signature file instead of a .sigstore bundle; bundle produced by a newer sigstore-go format than the parser supports.","solutions":["Verify the file exists and is readable at the exact path (ls -l, try cat) and use an absolute path","Regenerate or re-download the bundle from the publisher/Rekor and confirm it is a valid Sigstore bundle (JSON with messageSignature/dsseEnvelope)","Check you are passing the bundle file, not the attestation or artifact file, to -bundle"],"exampleFix":"// before\npacker verify -bundle ./attestation.json attestation.intoto.jsonl\n// after\npacker verify -bundle $(pwd)/release.intoto.sigstore attestation.intoto.jsonl","handlingStrategy":"validation","validationCode":"info, err := os.Stat(bundlePath)\nif err != nil || info.IsDir() {\n    return fmt.Errorf(\"bundle %q unavailable: %w\", bundlePath, err)\n}\nb, err := os.ReadFile(bundlePath)\nif err == nil && !json.Valid(b) {\n    return fmt.Errorf(\"bundle %q is not valid JSON\", bundlePath)\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) && strings.Contains(err.Error(), \"load Sigstore bundle\") {\n        // prompt for correct -bundle path\n    }\n}","preventionTips":["Use absolute paths for -bundle","Keep bundle and attestation files paired in the same release directory","Sanity-check the bundle with jq/JSON validation before verification"],"tags":["sigstore","file-io","bundle"],"backgroundTag":"sigstore-bundle-load-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}