{"record":{"id":"a763aa11068e0b55","repo":"hashicorp/packer","slug":"unsupported-public-key-type-t","errorCode":null,"errorMessage":"unsupported public key type %T","messagePattern":"unsupported public key type %T","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_key.go","lineNumber":96,"sourceCode":"\tpae := PreAuthEncode(payloadType, payload)\n\n\tswitch publicKey := v.publicKey.(type) {\n\tcase *rsa.PublicKey:\n\t\tdigest := sha256.Sum256(pae)\n\t\treturn rsa.VerifyPKCS1v15(publicKey, crypto.SHA256, digest[:], signature)\n\tcase *ecdsa.PublicKey:\n\t\tdigest := sha256.Sum256(pae)\n\t\tif !ecdsa.VerifyASN1(publicKey, digest[:], signature) {\n\t\t\treturn fmt.Errorf(\"ECDSA verification failed\")\n\t\t}\n\t\treturn nil\n\tcase ed25519.PublicKey:\n\t\tif !ed25519.Verify(publicKey, pae, signature) {\n\t\t\treturn fmt.Errorf(\"Ed25519 verification failed\")\n\t\t}\n\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported public key type %T\", v.publicKey)\n\t}\n}\n\nfunc (v *pemVerifier) KeyID() string {\n\treturn v.keyID\n}\n\nfunc LoadPEMVerifier(path string) (Verifier, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read verifier %q: %w\", path, err)\n\t}\n\n\tpublicKey, rawVerifier, err := loadPEMPublicKey(contents)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load verifier %q: %w\", path, err)\n\t}\n","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_key.go#L78-L114","documentation":"pemVerifier.Verify only supports three public key types: *rsa.PublicKey, *ecdsa.PublicKey, and ed25519.PublicKey. If the verifier's publicKey holds any other type (e.g. *dsa.PublicKey or an X25519 key parsed from a PEM file), it falls through to the default case and returns \"unsupported public key type %T\" with the Go type name filled in. This is a key-format/algorithm support limitation, surfaced at verification time rather than key-load time.","triggerScenarios":"Calling pemVerifier.Verify (or LoadPEMVerifier/LoadPEMVerifierBytes, which produce the verifier) with a PEM file whose parsed key is not RSA/ECDSA/Ed25519 — e.g. a PKIX PUBLIC KEY block containing an X25519, DSA, or other key type — so the type switch in Verify hits the default branch.","commonSituations":"Pointing the verifier at a key-exchange key (X25519) instead of a signing key; using legacy DSA keys; loading a PEM file that accidentally contains a certificate or key of an exotic algorithm; upstream Go x509.ParsePKIXPublicKey succeeding for an algorithm this verifier does not implement.","solutions":["Read the %T in the error message to see the actual Go key type, then replace the verifier PEM with an RSA, ECDSA, or Ed25519 public key (or a certificate whose public key is one of those).","Regenerate the key pair with an supported algorithm, e.g. `openssl genpkey -algorithm ed25519` or `openssl ecparam -genkey -name prime256v1`, and use the new public key for verification.","Check the key-generation/rotation process that produced the verifier PEM and restrict it to RSA/ECDSA/Ed25519 so unsupported keys never reach verification."],"exampleFix":"// before: X25519 key loaded as verifier -> unsupported public key type *x25519.PublicKey\nverifier, _ := attestation.LoadPEMVerifier(\"x25519-pub.pem\")\n\n// after: use a signing key of a supported type\n// openssl genpkey -algorithm ed25519 -out signer.pem\nverifier, _ := attestation.LoadPEMVerifier(\"ed25519-pub.pem\")","handlingStrategy":"type-guard","validationCode":"pub, _, err := loadPEMPublicKey(contents) // or inspect verifier via a debug hook\nif err != nil {\n\treturn err\n}\nswitch pub.(type) {\ncase *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\n\t// supported, safe to verify\ndefault:\n\treturn fmt.Errorf(\"verifier key type %T unsupported; use RSA, ECDSA, or Ed25519\", pub)\n}","typeGuard":"func isSupportedVerifierKey(pub crypto.PublicKey) bool {\n\tswitch pub.(type) {\n\tcase *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:\n\t\treturn true\n\tdefault:\n\t\treturn false\n\t}\n}","tryCatchPattern":"if err := verifier.Verify(ctx, payloadType, payload, sig.Sig); err != nil {\n\tvar unsupported interface{ Error() string }\n\tif strings.HasPrefix(err.Error(), \"unsupported public key type\") {\n\t\treturn fmt.Errorf(\"verifier PEM must contain an RSA/ECDSA/Ed25519 key: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Restrict key generation for attestation verifiers to RSA, ECDSA (P-256/P-384), or Ed25519.","Never use key-agreement keys (X25519/X448) or DSA keys as attestation verifiers.","Validate the parsed public key type immediately after LoadPEMVerifier, before storing or using the verifier.","Include the key type in operational checks/CI so an unsupported key never ships in production config."],"tags":["attestation","verification","unsupported-algorithm","key-format"],"backgroundTag":"unsupported-key-type","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}