{"record":{"id":"90e8bc945bf088b3","repo":"hashicorp/packer","slug":"marshal-signed-envelope-w","errorCode":null,"errorMessage":"marshal signed envelope: %w","messagePattern":"marshal signed envelope: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":333,"sourceCode":"\t\tenvelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation with Sigstore bundle: %w\", err)\n\t\t}\n\t} else {\n\t\tsignature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)\n\t\tif signErr != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation: %w\", signErr)\n\t\t}\n\t\tenvelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)\n\t}\n\n\tif err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify signed attestation: %w\", err)\n\t}\n\n\toutput, err := json.MarshalIndent(envelope, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal signed envelope: %w\", err)\n\t}\n\n\tif err := atomicWriteFile(outputPath, output, 0664); err != nil {\n\t\treturn fmt.Errorf(\"write attestation %q: %w\", outputPath, err)\n\t}\n\n\tif len(bundleJSON) > 0 {\n\t\tif err := atomicWriteFile(bundlePath, bundleJSON, 0664); err != nil {\n\t\t\treturn fmt.Errorf(\"write Sigstore bundle %q: %w\", bundlePath, err)\n\t\t}\n\t\tui.Say(fmt.Sprintf(\"Wrote Sigstore bundle to %s\", bundlePath))\n\t}\n\n\tui.Say(fmt.Sprintf(\"Wrote attestation to %s\", outputPath))\n\treturn nil\n}\n\nfunc (p *PostProcessor) signingResources(ctx context.Context, backendConfig internalattestation.BackendConfig) (internalattestation.Signer, internalattestation.Verifier, error) {","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L315-L351","documentation":"Once verification succeeds, the signed envelope is serialized with json.MarshalIndent before writing. A marshal failure is wrapped as `marshal signed envelope: %w`. The Envelope struct is a fixed internal type, so this indicates an internal inconsistency rather than user error.","triggerScenarios":"writeAttestation's envelope ends up containing a value json.MarshalIndent can't encode — practically only via internal type changes or corrupted signature/payload data from a signer.","commonSituations":"Rare; usually only seen after library upgrades or when a custom signer returns a malformed signature structure.","solutions":["Check the wrapped json error text for the offending type.","Verify the custom signer implementation returns a well-formed internalattestation.Signature if one is configured.","Update the provenance plugin/sigstore deps to matched versions.","File a bug with the full wrapped error if using stock configuration."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := pp.PostProcess(ctx, ui, artifact); err != nil {\n    if strings.Contains(err.Error(), \"marshal signed envelope\") {\n        // internal inconsistency: report bug, keep prior attestation artifacts\n    }\n}","preventionTips":["Keep provenance plugin and sigstore deps on matched versions.","Implement custom signers returning well-formed internal Signature types.","File a bug with the wrapped error if it occurs with stock config."],"tags":["json","serialization","envelope","provenance"],"backgroundTag":"json-marshal-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}