{"record":{"id":"83ef2eb3b090fbb5","repo":"hashicorp/packer","slug":"sign-attestation-w","errorCode":null,"errorMessage":"sign attestation: %w","messagePattern":"sign attestation: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":322,"sourceCode":"\t}\n\n\tpayload, err := internalattestation.MarshalPayload(statement)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal canonical attestation payload: %w\", err)\n\t}\n\n\tbundlePath := sigstoreBundleOutputPath(outputPath)\n\tbundleJSON := []byte(nil)\n\tvar envelope internalattestation.Envelope\n\tif backendConfig.Mode == internalattestation.SigningModeKeyless {\n\t\tenvelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation with Sigstore bundle: %w\", err)\n\t\t}\n\t} else {\n\t\tsignature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)\n\t\tif signErr != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation: %w\", signErr)\n\t\t}\n\t\tenvelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)\n\t}\n\n\tif err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify signed attestation: %w\", err)\n\t}\n\n\toutput, err := json.MarshalIndent(envelope, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal signed envelope: %w\", err)\n\t}\n\n\tif err := atomicWriteFile(outputPath, output, 0664); err != nil {\n\t\treturn fmt.Errorf(\"write attestation %q: %w\", outputPath, err)\n\t}\n\n\tif len(bundleJSON) > 0 {","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L304-L340","documentation":"In non-keyless mode, writeAttestation signs the payload with the configured signer via signer.Sign. Any signer failure (bad private key, unsupported key format, passphrase issues, crypto errors) is wrapped as `sign attestation: %w`.","triggerScenarios":"signing_mode `key` with a malformed/encrypted key file, wrong key type for the signer, wrong passphrase, or key file unreadable at sign time.","commonSituations":"Pointing key_path at a public key instead of private; encrypted key without supplying the password; key generated with an algorithm the signer doesn't support (e.g. ed25519 vs RSA mismatch).","solutions":["Verify key_path points to a valid private key in the expected format (PEM).","Supply the key passphrase via the configured password mechanism if the key is encrypted.","Regenerate the key with cosign (`cosign generate-key-pair`) if the format is unsupported.","Read the wrapped crypto error for the precise key problem."],"exampleFix":"// before\nkey_path = \"./cosign.pub\"\n// after\nkey_path = \"./cosign.key\" // private key","handlingStrategy":"validation","validationCode":"// verify the key loads before running the build\nkeyData, err := os.ReadFile(cfg.KeyPath)\nif err != nil { return err }\nblock, _ := pem.Decode(keyData)\nif block == nil { return errors.New(\"key_path is not PEM-encoded\") }","typeGuard":"func looksLikePrivateKey(path string) bool {\n    b, err := os.ReadFile(path)\n    if err != nil { return false }\n    block, _ := pem.Decode(b)\n    return block != nil && strings.Contains(block.Type, \"PRIVATE KEY\")\n}","tryCatchPattern":"if err := pp.PostProcess(ctx, ui, artifact); err != nil {\n    if strings.Contains(err.Error(), \"sign attestation:\") && !strings.Contains(err.Error(), \"Sigstore\") {\n        // re-check key_path, passphrase, and key algorithm\n    }\n}","preventionTips":["Point key_path at the private key, not the .pub.","Generate keys with cosign generate-key-pair for compatible formats.","Provide the key password via the documented env/file mechanism.","Test signing with `cosign sign-blob` before wiring into packer."],"tags":["signing","crypto","keys","provenance"],"backgroundTag":"invalid-private-key","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}