{"record":{"id":"904bdeb04f7277c7","repo":"hashicorp/packer","slug":"initialize-kms-signer-q-w","errorCode":null,"errorMessage":"initialize KMS signer %q: %w","messagePattern":"initialize KMS signer %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":43,"sourceCode":"\ntype kmsSigner struct {\n\tsignerVerifier sigstorekms.SignerVerifier\n\tverifier       Verifier\n\tkeyID          string\n}\n\nfunc newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {\n\tif cfg.SignerRef == \"\" {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q requires signer or key\", SigningModeKMS)\n\t}\n\n\tsignerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)\n\tif err != nil {\n\t\tvar notFound *sigstorekms.ProviderNotFoundError\n\t\tif errors.As(err, &notFound) {\n\t\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w%s\", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tpublicKey, err := signerVerifier.PublicKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load KMS public key %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create KMS verifier %q: %w\", cfg.SignerRef, err)\n\t}\n\n\treturn &kmsSigner{\n\t\tsignerVerifier: signerVerifier,\n\t\tverifier:       verifier,\n\t\tkeyID:          verifier.KeyID(),\n\t}, nil\n}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L25-L61","documentation":"This is the generic failure path of newKMSSigner when sigstore's kms.Get fails to construct the SignerVerifier for the configured key and the error is NOT a ProviderNotFoundError. It wraps whatever the KMS provider returned (auth failure, nonexistent key, bad URI format, network error, unsupported key algorithm) with the offending key resource ID for context. It is thrown because the signer cannot be built without a working provider handle.","triggerScenarios":"Calling signing_mode \"kms\" where sigstorekms.Get(ctx, cfg.SignerRef, crypto.SHA256) returns a non-ProviderNotFound error: invalid/malformed key resource ID, credentials missing or denied, key does not exist in the KMS, network/API failure reaching the KMS service.","commonSituations":"Typo in the key ARN/alias or Vault path; IAM role or workload identity lacks kms:Sign/GetPublicKey permissions; missing cloud credentials in the environment (AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS, Azure login, Vault token); wrong scheme prefix so the URI doesn't match any provider format; key deleted/rotated away between config write and run.","solutions":["Read the wrapped cause in the error message; it names the underlying provider failure (auth, not-found, network, invalid URI).","Validate the key resource ID format for your provider (e.g. arn:aws:kms:region:acct:key/... or awskms://alias/name) and confirm the key exists in the KMS console/CLI.","Verify credentials are available and authorized: cloud credentials env/instance role, Vault token, or workload identity, plus sign/get-public-key permissions on the key.","Test connectivity to the KMS endpoint from the failing environment (proxy/firewall/region settings).","If the message ends with a 'provider is not compiled into this build' hint, it is actually the ProviderNotFound case — rebuild with the appropriate build tag."],"exampleFix":"# before\nsigner = \"awskms:///alias/my-key\"   # malformed URI -> provider init fails\n# after\nsigner = \"awskms://alias/my-key\"    # and ensure IAM policy grants kms:Sign","handlingStrategy":"try-catch","validationCode":"// pre-flight: resolve credentials and key existence before initializing\nswitch {\ncase strings.HasPrefix(ref, \"awskms://\"):\n\t_, err := kmsClient.DescribeKey(&kms.DescribeKeyInput{KeyId: aws.String(keyIDFromRef(ref))})\ncase strings.HasPrefix(ref, \"hashivault://\"):\n\t_, err := vaultClient.Logical().Read(\"transit/keys/\" + keyNameFromRef(ref))\n}\nif err != nil { return fmt.Errorf(\"KMS key %q unavailable before signing: %w\", ref, err) }","typeGuard":null,"tryCatchPattern":"signer, err := attestation.NewSigner(ctx, cfg)\nif err != nil && strings.Contains(err.Error(), \"initialize KMS signer\") {\n\t// inspect wrapped cause: auth? not-found? network?\n\t// retry transient errors, fix credentials/URI for permanent ones\n\tvar retryable bool = isTransient(err) // e.g. net.Error, 5xx\n\tif retryable { return retryInit(ctx, cfg) }\n\treturn fmt.Errorf(\"check KMS key URI and credentials: %w\", err)\n}","preventionTips":["Use full, canonical key IDs or verified aliases in config; validate URIs before deploy.","Ensure the runtime identity has sign + get-public-key IAM permissions.","Provision cloud credentials (env vars, instance role, workload identity, Vault token) in the environment.","Smoke-test key resolution with the cloud CLI using the same credentials before running builds.","Retry transient network/API errors with backoff at the caller level."],"tags":["kms","sigstore","authentication","configuration"],"backgroundTag":"kms-signer-init-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}