{"record":{"id":"813dc2c576f0f575","repo":"hashicorp/packer","slug":"unable-to-determine-attestation-signing-mode-set","errorCode":null,"errorMessage":"unable to determine attestation signing mode; set signing_mode or verifier explicitly","messagePattern":"unable to determine attestation signing mode; set signing_mode or verifier explicitly","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":176,"sourceCode":"\tswitch mode {\n\tcase SigningModeKey:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires verifier or key\", SigningModeKey)\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.SignerRef)\n\tcase SigningModeKMS:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires key or verifier\", SigningModeKMS)\n\t\t}\n\t\tsigner, err := NewSigner(ctx, cfg)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn signer.Verifier(ctx, cfg)\n\tcase SigningModeKeyless:\n\t\treturn newKeylessVerifierForEnvelope(cfg, envelope)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unable to determine attestation signing mode; set signing_mode or verifier explicitly\")\n\t}\n}\n\nfunc normalizeVerificationMode(cfg BackendConfig, envelope Envelope) string {\n\tif cfg.Mode != \"\" {\n\t\treturn cfg.Mode\n\t}\n\n\tif envelopeHasCertificate(envelope) {\n\t\treturn SigningModeKeyless\n\t}\n\n\tif isRecognizedKMSReference(cfg.SignerRef) {\n\t\treturn SigningModeKMS\n\t}\n\n\tif cfg.SignerRef != \"\" || cfg.VerifierRef != \"\" {\n\t\treturn SigningModeKey","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L158-L194","documentation":"verifierForEnvelope reaches the default branch when normalizeVerificationMode cannot determine a mode: cfg.Mode is empty, the envelope has no certificate, SignerRef is neither a recognized KMS URI nor set, and VerifierRef is empty. Verification cannot proceed without knowing what kind of verifier to build, so the library asks the caller to set signing_mode or verifier explicitly.","triggerScenarios":"VerifyAttestationFile called with a completely empty (or near-empty) BackendConfig against a plain key-signed envelope lacking a cert; SignerRef set to an unrecognized URI scheme without an explicit Mode; config struct zero-valued in tests or partially decoded config.","commonSituations":"Users assume auto-detection works from the file alone; custom KMS plugins whose URI prefix is not in the recognized list; config not wired through so BackendConfig{} arrives empty; typos in signing_mode values that fall through the switch.","solutions":["Set cfg.Mode explicitly (key, kms, or keyless) to match how the attestation was signed","Set cfg.VerifierRef to a PEM verifier, or cfg.SignerRef to a recognized key/KMS reference","If using a custom KMS URI scheme, set Mode=SigningModeKMS explicitly so the prefix check is bypassed","Check signing_mode spelling/interpolation — an unrecognized string lands in the default branch"],"exampleFix":"// before\ncfg := attestation.BackendConfig{} // nothing set\n\n// after\ncfg := attestation.BackendConfig{Mode: attestation.SigningModeKey, SignerRef: \"keys/signer.pub\"}","handlingStrategy":"validation","validationCode":"if cfg.Mode == \"\" && cfg.SignerRef == \"\" && cfg.VerifierRef == \"\" {\n    return errors.New\"no verification mode determinable: set signing_mode or verifier\")\n}","typeGuard":null,"tryCatchPattern":"if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"unable to determine attestation signing mode\") {\n        return fmt.Errorf\"configure signing_mode (key|kms|keyless) or a verifier: %w\", err)\n    }\n    return err\n}","preventionTips":["Always set signing_mode explicitly in shared/reusable verification configs","If using a custom KMS scheme, set Mode=SigningModeKMS rather than relying on prefix detection","Reject empty BackendConfig at CLI/config-parse time","For keyless files rely on envelope certificate detection instead of clearing Mode"],"tags":["attestation","config","missing-config"],"backgroundTag":"missing-required-config","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}