{"record":{"id":"8bdcd5cd29113377","repo":"hashicorp/packer","slug":"decode-attestation-envelope-signature-d-w","errorCode":null,"errorMessage":"decode attestation envelope signature %d: %w","messagePattern":"decode attestation envelope signature (.+?): %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":372,"sourceCode":"\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")\n\t}\n\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"attestation envelope has no signatures\")\n\t}\n\n\tbundleSignature := bundleEnvelope.Signature()\n\tfor i, envelopeSignature := range envelope.Signatures {\n\t\tsignature, err := DecodeEnvelopeSignature(envelopeSignature)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"decode attestation envelope signature %d: %w\", i, err)\n\t\t}\n\n\t\tif bytes.Equal(bundleSignature, signature) {\n\t\t\treturn nil\n\t\t}\n\t}\n\n\treturn fmt.Errorf(\"sigstore bundle signature does not match any attestation signature\")\n}\n\nfunc verifyArtifactSubject(subjects []internalprovenance.Subject, artifactPath string) error {\n\tdigest, err := sha256File(artifactPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"hash artifact %q: %w\", artifactPath, err)\n\t}\n\n\tartifactName := filepath.Base(artifactPath)\n\tfor _, subject := range subjects {","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L354-L390","documentation":"DecodeEnvelopeSignature failed for signature at index i of the attestation envelope, so that signature cannot be compared with the bundle's signature. Thrown to identify exactly which envelope signature entry is malformed, wrapping the decoding error.","triggerScenarios":"ensureBundleMatchesEnvelope iterates envelope.Signatures and DecodeEnvelopeSignature rejects entry i — e.g. invalid base64 sig, empty keyid/sig fields, or unsupported signature encoding.","commonSituations":"Attestation produced by a tool writing signatures in a different encoding; corrupted/truncated signatures array; manually edited envelope; mixed tool versions where DecodeEnvelopeSignature expects a stricter format.","solutions":["Inspect envelope.Signatures[i] and fix its encoding (valid base64, non-empty sig) or regenerate the attestation with the signing tool","Align signing and verification tool versions so signature encoding matches what DecodeEnvelopeSignature expects","Decode the signature yourself (base64.StdEncoding.DecodeString) to see the precise failure before re-running"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for i, s := range envelope.Signatures {\n    if _, err := DecodeEnvelopeSignature(s); err != nil {\n        return fmt.Errorf(\"signature %d invalid before verification: %w\", i, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"decode attestation envelope signature\") {\n        // inspect the indexed signature entry and fix encoding or regenerate\n    }\n}","preventionTips":["Pre-decode all envelope signatures to validate base64 encoding","Keep signing and verifying tooling on compatible versions","Never hand-edit signature fields in attestation JSON"],"tags":["dsse","signature","decoding"],"backgroundTag":"signature-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}