{"record":{"id":"9536b25f7ef19c7b","repo":"hashicorp/packer","slug":"build-sigstore-bundle-w","errorCode":null,"errorMessage":"build Sigstore bundle: %w","messagePattern":"build Sigstore bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":173,"sourceCode":"\n\tif cfg.UploadTlog {\n\t\trekorURL := strings.TrimSpace(cfg.RekorURL)\n\t\tif rekorURL == \"\" {\n\t\t\trekorURL = defaultRekorURL\n\t\t}\n\n\t\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\t\tif err != nil {\n\t\t\treturn Envelope{}, nil, fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t\t}\n\n\t\toptions.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}\n\t\toptions.TrustedRoot = trustedMaterial\n\t}\n\n\tprotobufBundle, err := newKeylessBundle(content, s.keypair, options)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"build Sigstore bundle: %w\", err)\n\t}\n\n\tbundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"decode Sigstore bundle: %w\", err)\n\t}\n\n\tbundleEnvelope, err := bundleWrapper.Envelope()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"extract envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tbundleJSON, err := bundleWrapper.MarshalJSON()","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L155-L191","documentation":"newKeylessBundle (sigstoregosign.Bundle) assembles the Sigstore protobuf bundle: DSSE content signed by the ephemeral keypair, the Fulcio certificate, and (when UploadTlog is set) a Rekor transparency-log entry. Any failure inside bundle construction (signing, tlog upload, marshaling protobuf) is wrapped as 'build Sigstore bundle'. With UploadTlog=true this commonly surfaces Rekor upload failures.","triggerScenarios":"SignBundle calls newKeylessBundle(content, s.keypair, options) at internal/attestation/sign_keyless.go:171-173; fails when DSSE signing fails, or when options.TransparencyLogs is set and the Rekor entry upload is rejected/fails (bad cert, Rekor outage, idempotency/conflict), or invalid BundleOptions.","commonSituations":"Rekor (https://rekor.sigstore.dev) outage or rate limiting during CI; custom cfg.RekorURL pointing at a wrong/unreachable Rekor instance; trusted root not matching the Rekor instance; transient network errors during tlog upload.","solutions":["Retry SignBundle — Rekor uploads are transient-sensitive and idempotent for identical artifacts","If cfg.RekorURL is set, confirm the Rekor instance is reachable and compatible with the trusted root","If a transparency-log entry is not required, set cfg.UploadTlog=false so no Rekor interaction occurs","Check network egress/TLS to the Rekor endpoint and inspect the wrapped inner error for HTTP status details"],"exampleFix":"// before\ncfg := BackendConfig{UploadTlog: true, RekorURL: \"https://rekor.internal.example.com\"} // wrong instance\n// after\ncfg := BackendConfig{UploadTlog: true} // uses default https://rekor.sigstore.dev","handlingStrategy":"retry","validationCode":"if cfg.UploadTlog {\n\trekorURL := cfg.RekorURL\n\tif rekorURL == \"\" { rekorURL = \"https://rekor.sigstore.dev\" }\n\tresp, err := http.Get(rekorURL + \"/api/v1/log\")\n\tif err != nil || resp.StatusCode != 200 {\n\t\treturn fmt.Errorf(\"Rekor %s unreachable before signing\", rekorURL)\n\t}\n\tresp.Body.Close()\n}","typeGuard":null,"tryCatchPattern":"envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)\nif err != nil && strings.Contains(err.Error(), \"build Sigstore bundle\") {\n\t// transient Rekor/network issue: retry with backoff\n\ttime.Sleep(2 * time.Second)\n\tenvelope, bundle, err = signer.SignBundle(ctx, ptype, payload, cfg)\n}","preventionTips":["Retry bundle creation with exponential backoff for tlog uploads","Verify custom RekorURL reachability and compatibility with your trusted root","Set UploadTlog=false if a tlog entry is not required"],"tags":["network","sigstore","rekor","bundle","keyless-signing"],"backgroundTag":"rekor-upload-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}