{"record":{"id":"8c83589f805c1e1b","repo":"hashicorp/packer","slug":"request-fulcio-certificate-w","errorCode":null,"errorMessage":"request Fulcio certificate: %w","messagePattern":"request Fulcio certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":113,"sourceCode":"\tfulcioURL := strings.TrimSpace(cfg.FulcioURL)\n\tif fulcioURL == \"\" {\n\t\tfulcioURL = defaultFulcioURL\n\t}\n\n\tidToken, err := resolveAmbientIDToken(ctx, cfg.Env)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tkeypair, err := newKeylessEphemeralKeypair()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"generate ephemeral keypair: %w\", err)\n\t}\n\n\tfulcio := newKeylessFulcio(fulcioURL)\n\tcertDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"request Fulcio certificate: %w\", err)\n\t}\n\n\tcertificate, err := x509.ParseCertificate(certDER)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parse Fulcio certificate: %w\", err)\n\t}\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tverifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}\n\n\treturn &keylessSigner{\n\t\tkeypair:  keypair,\n\t\tcertPEM:  certPEM,\n\t\tcert:     certificate,\n\t\tverifier: verifier,","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L95-L131","documentation":"This error wraps a failure from the Fulcio CertificateProvider's GetCertificate call, which exchanges the ambient OIDC ID token for a short-lived signing certificate bound to the ephemeral keypair. The library throws it when the Fulcio CA rejects or cannot process the request — most commonly an expired/invalid/insufficient-audience OIDC token, a network failure, or an unreachable/misconfigured Fulcio URL.","triggerScenarios":"newKeylessSigner (internal/attestation/sign_keyless.go:110-114) calls fulcio.GetCertificate(ctx, keypair, options) with the resolved ambient ID token; error occurs on HTTP failure at cfg.FulcioURL (default https://fulcio.sigstore.dev), OIDC token rejection, or request signing failure.","commonSituations":"SIGSTORE_ID_TOKEN expired or with wrong audience (Fulcio expects sigstore audience); GitHub Actions workflow lacks `permissions: id-token: write` so the token request returns nothing usable; corporate proxy/firewall blocking fulcio.sigstore.dev; custom fulcio_url pointing at a down or wrong-versioned Fulcio instance; clock skew invalidating the token.","solutions":["Verify the OIDC token is fresh and its audience matches the Fulcio deployment's expected audience (sigstore for public good); request a new token.","Check network reachability of the configured fulcio_url (`curl -I <fulcio_url>`) and fix proxy/egress rules.","For GitHub Actions, ensure the workflow sets `permissions: id-token: write`.","Confirm fulcio_url in the backend config points to the correct Fulcio instance for the OIDC issuer used.","Check system clock skew (NTP) if the token is rejected as invalid."],"exampleFix":"// before (GitHub Actions workflow)\njobs:\n  release:\n    steps: [...]\n// after\njobs:\n  release:\n    permissions:\n      id-token: write\n      contents: read\n    steps: [...]","handlingStrategy":"retry","validationCode":"// Pre-flight checks before signing:\n// 1) an ambient OIDC token is resolvable\n// (SIGSTORE_ID_TOKEN / CI_JOB_JWT_V2 / GitHub ACTIONS_ID_TOKEN_REQUEST_URL)\n// 2) Fulcio is reachable\nresp, err := http.Get(fulcioURL + \"/api/v1/rootCert\")\nif err != nil || resp.StatusCode != 200 {\n    return fmt.Errorf(\"Fulcio %s unreachable\", fulcioURL)\n}","typeGuard":null,"tryCatchPattern":"signer, err := newKeylessSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"request Fulcio certificate\") {\n    // refresh the OIDC token and retry with backoff; check network/proxy\n}","preventionTips":["For GitHub Actions, always set `permissions: id-token: write`.","Request OIDC tokens with the audience Fulcio expects (sigstore for public instances) and use them before expiry.","Confirm fulcio_url egress is allowed from CI runners; test with curl before runs.","Keep host clocks NTP-synced to avoid token validity rejections."],"tags":["network","oidc","fulcio","keyless-signing"],"backgroundTag":"fulcio-certificate-request-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}