{"record":{"id":"9d9eb9b978ddac35","repo":"hashicorp/packer","slug":"extract-dsse-envelope-from-sigstore-bundle-w","errorCode":null,"errorMessage":"extract DSSE envelope from Sigstore bundle: %w","messagePattern":"extract DSSE envelope from Sigstore bundle: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":352,"sourceCode":"\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, \"\", cfg.KeylessIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))\n\tif _, err := verifier.Verify(bundle, policyBuilder); err != nil {\n\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")\n\t}\n\n\tif len(envelope.Signatures) == 0 {\n\t\treturn fmt.Errorf(\"attestation envelope has no signatures\")\n\t}\n\n\tbundleSignature := bundleEnvelope.Signature()\n\tfor i, envelopeSignature := range envelope.Signatures {\n\t\tsignature, err := DecodeEnvelopeSignature(envelopeSignature)","sourceCodeStart":334,"sourceCodeEnd":370,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L334-L370","documentation":"bundle.Envelope() failed, meaning the bundle could not yield its DSSE envelope. The library throws this because bundle-vs-attestation matching (and DSSE verification) requires the envelope inside the bundle. Most bundles store either a message signature or a DSSE envelope; this fails when the stored media type is not a DSSE envelope or the embedded envelope is malformed.","triggerScenarios":"ensureBundleMatchesEnvelope is called on a bundle whose media type is a plain message signature (e.g. messageSignature bundle) rather than dsseEnvelope, or whose embedded envelope bytes do not parse as a DSSE envelope.","commonSituations":"Passing a binary-artifact signature bundle (cosign sign-blob style) where a DSSE attestation bundle is expected; bundle truncated/corrupted so the envelope is unreadable; version mismatch in bundle format.","solutions":["Generate the bundle from the DSSE attestation (cosign attest --bundle / sigstore attestation flow) so it contains a dsseEnvelope, not a messageSignature","Inspect the bundle JSON: it must have a dsseEnvelope field; if it only has messageSignature, it is the wrong bundle type","Re-download the bundle in case of truncation/corruption"],"exampleFix":"// before (binary signature bundle)\npacker verify -bundle blob.signature.bundle attestation.intoto.jsonl\n// after (DSSE attestation bundle)\npacker verify -bundle attestation.intoto.dsse.bundle attestation.intoto.jsonl","handlingStrategy":"validation","validationCode":"var probe struct {\n    DSSEEnvelope json.RawMessage `json:\"dsseEnvelope\"`\n}\nb, _ := os.ReadFile(bundlePath)\nif err := json.Unmarshal(b, &probe); err != nil || len(probe.DSSEEnvelope) == 0 {\n    return fmt.Errorf(\"bundle %q has no dsseEnvelope\", bundlePath)\n}","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"extract DSSE envelope from Sigstore bundle\") {\n        // wrong bundle type; regenerate as a DSSE attestation bundle\n    }\n}","preventionTips":["Confirm the bundle JSON contains a dsseEnvelope before verification","Use attestation-specific signing flows (not sign-blob) to produce bundles","Guard against truncated downloads with checksums"],"tags":["sigstore","dsse","bundle"],"backgroundTag":"dsse-envelope-missing","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}