{"record":{"id":"b8020a9eb8b9edba","repo":"hashicorp/packer","slug":"signing-mode-q-does-not-support-sigstore-bundle-e","errorCode":null,"errorMessage":"signing_mode %q does not support Sigstore bundle emission","messagePattern":"signing_mode %q does not support Sigstore bundle emission","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/bundle.go","lineNumber":18,"sourceCode":"// Copyright IBM Corp. 2024, 2025\n// SPDX-License-Identifier: BUSL-1.1\n\npackage attestation\n\nimport (\n\t\"context\"\n\t\"fmt\"\n)\n\ntype bundleSigner interface {\n\tSignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)\n}\n\nfunc BuildBundleForSigner(ctx context.Context, signer Signer, cfg BackendConfig, payloadType string, payload []byte) (Envelope, []byte, error) {\n\tbundler, ok := signer.(bundleSigner)\n\tif !ok {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"signing_mode %q does not support Sigstore bundle emission\", cfg.Mode)\n\t}\n\n\treturn bundler.SignBundle(ctx, payloadType, payload, cfg)\n}\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/bundle.go#L1-L23","documentation":"BuildBundleForSigner produces a Sigstore bundle (DSSE envelope + Rekor data) but only when the signer implements the internal bundleSigner interface (SignBundle method). Packer throws this error when the signer's configured signing_mode produces a signer that does not support Sigstore bundle emission, so a bundle was requested but cannot be created for that mode.","triggerScenarios":"Calling BuildBundleForSigner with a signer whose concrete type lacks SignBundle — i.e. a signing mode that only emits plain signatures; cfg.Mode names the mode in the message. Exercised by TestBuildBundleForKeylessSigner and TestKeylessBundleAndRekorIntegration, which use the keyless signer that does support bundles.","commonSituations":"Configuring a non-keyless signing mode (e.g. a plain key-based mode) while the pipeline also requests Sigstore bundles/Rekor integration; version drift where an older signer implementation predates bundle support.","solutions":["Switch the signing_mode configuration to a mode whose signer supports bundles (e.g. the keyless/Sigstore mode)","If you must keep the current mode, stop requesting bundle emission and use the plain signature output instead","Upgrade the signer implementation/plugin to a version that implements SignBundle for your mode","Inspect cfg.Mode in the error to confirm which mode was used, and align the pipeline's bundle expectations with that mode"],"exampleFix":"// before\ncfg := BackendConfig{Mode: \"plain-key\"}\nenv, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)\n// after\ncfg := BackendConfig{Mode: \"keyless\"} // mode backed by a bundleSigner implementation\nenv, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)","handlingStrategy":"type-guard","validationCode":"_, isBundler := signer.(interface {\n\tSignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)\n})\nif !isBundler {\n\t// request a plain signature path or reconfigure signing_mode before calling\n}","typeGuard":"func supportsBundleEmission(signer Signer) bool {\n\t_, ok := signer.(interface {\n\t\tSignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)\n\t})\n\treturn ok\n}","tryCatchPattern":"env, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)\nif err != nil {\n\tif strings.Contains(err.Error(), \"does not support Sigstore bundle emission\") {\n\t\t// fall back to non-bundle signature path or surface a config error\n\t\treturn fallbackPlainSignature(ctx, signer, payloadType, payload)\n\t}\n\treturn err\n}","preventionTips":["Type-assert the signer for bundle support at configuration load time instead of at signing time","Align signing_mode with the bundle feature: only request bundles for modes with bundleSigner implementations","Pin signer/plugin versions known to implement SignBundle","Document which signing modes emit bundles in your pipeline config"],"tags":["attestation","sigstore","signing","dsse","go"],"backgroundTag":"signer-does-not-support-bundles","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}