{"record":{"id":"b5eb4d0bdec92d1f","repo":"hashicorp/packer","slug":"load-sigstore-verifier-w","errorCode":null,"errorMessage":"load sigstore verifier: %w","messagePattern":"load sigstore verifier: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":110,"sourceCode":"// built with \"kms_cherrypick\" and did not opt that provider in.\nfunc kmsProviderBuildHint(ref string) string {\n\tscheme := ref\n\tif idx := strings.Index(ref, \"://\"); idx >= 0 {\n\t\tscheme = ref[:idx]\n\t}\n\n\ttag, ok := kmsProviderBuildTags[scheme]\n\tif !ok {\n\t\treturn \"\"\n\t}\n\n\treturn fmt.Sprintf(\"; the %s KMS provider is not compiled into this build (rebuild without \\\"kms_cherrypick\\\", or with -tags 'kms_cherrypick %s')\", scheme, tag)\n}\n\nfunc newSigstoreVerifierFromPublicKey(publicKey crypto.PublicKey) (Verifier, error) {\n\tverifier, err := sigstoresignature.LoadDefaultVerifier(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load sigstore verifier: %w\", err)\n\t}\n\n\tpublicKeyPEM, err := marshalPublicKeyPEM(publicKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &sigstoreVerifier{\n\t\tverifier: verifier,\n\t\tkeyID:    sha256Hex(publicKeyPEM),\n\t}, nil\n}\n\ntype sigstoreVerifier struct {\n\tverifier sigstoresignature.Verifier\n\tkeyID    string\n}\n","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L92-L128","documentation":"Initialization error from newSigstoreVerifierFromPublicKey: sigstore's LoadDefaultVerifier rejected the supplied public key — usually because the key type or algorithm is not supported by the default verifier (e.g. an ed25519 or unusual curve from the KMS backend).","triggerScenarios":"Thrown at internal/attestation/sign_kms.go:110 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a signing key with an algorithm supported by sigstore (RSA, ECDSA P-256/384)","Point the `verifier` config at a PEM public key file compatible with sigstore instead of deriving it from the KMS key"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}