{"record":{"id":"bd73789d9fafdcda","repo":"hashicorp/packer","slug":"verify-keyless-certificate-identity-w","errorCode":null,"errorMessage":"verify keyless certificate identity: %w","messagePattern":"verify keyless certificate identity: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":76,"sourceCode":"\t// When using the public Sigstore root (no custom trusted root configured),\n\t// require a valid SCT so certificates issued outside a public CT log are rejected.\n\tif strings.TrimSpace(trustedRootPath) == \"\" {\n\t\tif err := sigstoreverify.VerifySignedCertificateTimestamp(chains, 1, trustedMaterial); err != nil {\n\t\t\treturn fmt.Errorf(\"verify Fulcio certificate SCT: %w\", err)\n\t\t}\n\t}\n\n\tsummary, err := fulciocertificate.SummarizeCertificate(certificate)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"summarize Fulcio certificate: %w\", err)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(expectedOIDCIssuer, \"\", expectedIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\tif err := identity.Verify(summary); err != nil {\n\t\treturn fmt.Errorf(\"verify keyless certificate identity: %w\", err)\n\t}\n\n\treturn nil\n}\n\nfunc init() {\n\tRegisterSigner(SigningModeKeyless, newKeylessSigner)\n}\n\ntype keylessSigner struct {\n\tkeypair  sigstoregosign.Keypair\n\tcertPEM  []byte\n\tcert     *x509.Certificate\n\tverifier Verifier\n\tkeyID    string\n}\n\nfunc newKeylessSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L58-L94","documentation":"This error wraps a failed identity.Verify(summary) call: the Fulcio certificate's summarized identities (SANs, issuer) did not match the expected keyless identity policy built from the configured keyless_identity and keyless_oidc_issuer. The library throws it during keyless attestation verification to reject certificates that were issued to a different identity or OIDC provider than the one configured, preventing signature forgery by an unrelated valid certificate.","triggerScenarios":"keylessVerifier.Verify -> verifyKeylessCertificate -> identity.Verify(summary) returns mismatch when the certificate's SAN does not equal cfg.KeylessIdentity or its OIDC issuer does not equal cfg.KeylessOIDCIssuer (internal/attestation/sign_keyless.go:75-77).","commonSituations":"Verifying an artifact signed by a different workflow/repo than configured (e.g. identity set to repo A but signed from repo B); using the wrong OIDC issuer (GitLab vs GitHub); expected identity includes a ref/branch while the cert SAN omits it; case or trailing-slash differences in the issuer URL.","solutions":["Compare the certificate's actual SAN and issuer (from the Fulcio cert or Rekor entry) and set keyless_identity / keyless_oidc_issuer to exactly those values.","Re-sign the artifact from the intended workflow/identity if the artifact came from an unintended source.","If the identity includes workflow ref/sha, ensure the expectation matches the sigstore SAN format (e.g. https://github.com/org/repo/.github/workflows/wf.yml@refs/heads/main) or relax to the repo-level URI.","Verify the trusted root corresponds to the OIDC provider that issued the signing token."],"exampleFix":"// before\nkeyless_identity = \"https://github.com/org/other-repo/...\"\nkeyless_oidc_issuer = \"https://token.actions.githubusercontent.com\"\n// after\nkeyless_identity = \"https://github.com/org/repo/.github/workflows/release.yml@refs/tags/v1.0.0\"\nkeyless_oidc_issuer = \"https://token.actions.githubusercontent.com\"","handlingStrategy":"validation","validationCode":"// Before verifying, confirm the expected identity matches the signing workflow:\n// expected: \"https://github.com/org/repo/.github/workflows/release.yml@refs/tags/v1.0.0\"\n// issuer:   \"https://token.actions.githubusercontent.com\"\nif !strings.HasPrefix(expectedIdentity, \"https://github.com/org/repo/.github/workflows/\") {\n    return fmt.Errorf(\"expected identity does not match the signing workflow\")\n}","typeGuard":null,"tryCatchPattern":"err := verifier.Verify(ctx, payloadType, payload, sig)\nif err != nil && strings.Contains(err.Error(), \"verify keyless certificate identity\") {\n    // inspect cert SAN/issuer vs configured identity; fail closed, do not retry\n}","preventionTips":["Copy the identity/issuer values from a known-good Rekor entry or `cosign verify` output for the same artifact.","Pin the full workflow ref in keyless_identity, or use the repo-level SAN prefix consistently.","Use the issuer URL that matches the CI system that signed (GitHub vs GitLab)."],"tags":["sigstore","keyless-signing","identity-mismatch"],"backgroundTag":"certificate-identity-mismatch","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}