{"record":{"id":"bc942878f9b93893","repo":"hashicorp/packer","slug":"sign-payload-with-keyless-signer-w","errorCode":null,"errorMessage":"sign payload with keyless signer: %w","messagePattern":"sign payload with keyless signer: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":139,"sourceCode":"\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})\n\tverifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create keyless verifier: %w\", err)\n\t}\n\n\treturn &keylessSigner{\n\t\tkeypair:  keypair,\n\t\tcertPEM:  certPEM,\n\t\tcert:     certificate,\n\t\tverifier: verifier,\n\t\tkeyID:    hex.EncodeToString(keypair.GetHint()),\n\t}, nil\n}\n\nfunc (s *keylessSigner) Sign(ctx context.Context, payloadType string, payload []byte) (Signature, error) {\n\tsignature, _, err := s.keypair.SignData(ctx, PreAuthEncode(payloadType, payload))\n\tif err != nil {\n\t\treturn Signature{}, fmt.Errorf(\"sign payload with keyless signer: %w\", err)\n\t}\n\n\treturn Signature{\n\t\tKeyID:   s.keyID,\n\t\tSig:     signature,\n\t\tCertPEM: append([]byte(nil), s.certPEM...),\n\t}, nil\n}\n\nfunc (s *keylessSigner) SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error) {\n\tcontent := &sigstoregosign.DSSEData{Data: payload, PayloadType: payloadType}\n\toptions := sigstoregosign.BundleOptions{\n\t\tCertificateProvider: staticCertificateProvider{certDER: append([]byte(nil), s.cert.Raw...)},\n\t\tContext:             ctx,\n\t}\n\n\tif cfg.UploadTlog {\n\t\trekorURL := strings.TrimSpace(cfg.RekorURL)","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L121-L157","documentation":"keylessSigner.Sign signs the pre-auth-encoded payload with the ephemeral keypair's SignData; any failure from the sigstore-go keypair signer is wrapped as 'sign payload with keyless signer'. Since the key is ephemeral and in-memory, this indicates a low-level signing failure inside sigstore-go (e.g. nil context, signer state, or crypto operation error) rather than a config problem.","triggerScenarios":"Calling Sign(ctx, payloadType, payload) on a keylessSigner created by newKeylessSigner; s.keypair.SignData(ctx, PreAuthEncode(payloadType, payload)) returns an error (internal/attestation/sign_keyless.go:137-140).","commonSituations":"Canceled/expired context passed to Sign; sigstore-go version bug or mismatch in SignData; nil keypair state after a partially failed signer construction in tests.","solutions":["Check that the ctx passed to Sign is not already canceled or past its deadline before calling","Ensure the signer was constructed successfully (no earlier partial error) before calling Sign","Retry the whole signing flow — the keypair is ephemeral and regenerated on each newKeylessSigner call","If reproducible, check the sigstore-go version for known SignData issues and upgrade"],"exampleFix":"// before\nctx := context.Background() // possibly canceled upstream\nsig, err := signer.Sign(ctx, ptype, payload)\n// after\nif ctx.Err() != nil { return fmt.Errorf(\"context canceled before signing: %w\", ctx.Err()) }\nsig, err := signer.Sign(ctx, ptype, payload)","handlingStrategy":"try-catch","validationCode":"if ctx == nil || ctx.Err() != nil { return fmt.Errorf(\"invalid or canceled context before Sign\") }","typeGuard":null,"tryCatchPattern":"sig, err := signer.Sign(ctx, payloadType, payload)\nif err != nil {\n\tif ctx.Err() != nil {\n\t\treturn fmt.Errorf(\"signing canceled: %w\", ctx.Err())\n\t}\n\treturn fmt.Errorf(\"keyless sign failed (retry signer construction): %w\", err)\n}","preventionTips":["Always pass a live, non-canceled context to Sign","Treat Sign failures as retryable by reconstructing the signer (fresh ephemeral keypair)","Keep sigstore-go up to date"],"tags":["go","sigstore","keyless-signing","signing"],"backgroundTag":"payload-signing-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}