{"record":{"id":"be5eca5dcb7835aa","repo":"hashicorp/packer","slug":"open-artifact-q-for-bundle-verification-w","errorCode":null,"errorMessage":"open artifact %q for bundle verification: %w","messagePattern":"open artifact %q for bundle verification: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":330,"sourceCode":"\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}\n\tif len(verifierOptions) == 0 {\n\t\t// A trusted time source is required to validate the short-lived Fulcio\n\t\t// certificate as of signing time; default to observer timestamps when the\n\t\t// caller has not explicitly required Rekor or timestamp evidence.\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}\n\n\tverifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"create Sigstore bundle verifier: %w\", err)\n\t}\n\n\tartifactPolicy := sigstoreverify.WithoutArtifactUnsafe()\n\tif policy.ArtifactPath != \"\" {\n\t\tartifact, err := os.Open(policy.ArtifactPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"open artifact %q for bundle verification: %w\", policy.ArtifactPath, err)\n\t\t}\n\t\tdefer func() { _ = artifact.Close() }()\n\t\tartifactPolicy = sigstoreverify.WithArtifact(artifact)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, \"\", cfg.KeylessIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))\n\tif _, err := verifier.Verify(bundle, policyBuilder); err != nil {\n\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":312,"sourceCodeEnd":348,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L312-L348","documentation":"os.Open failed on policy.ArtifactPath when the user supplied an artifact for bundle verification, so the artifact-digest check cannot be performed. This error is only thrown when ArtifactPath is non-empty. The wrapped error distinguishes not-found vs permission vs is-a-directory.","triggerScenarios":"verifySigstoreBundleEvidenceImpl called with policy.ArtifactPath set to a path that does not exist, is not readable, or is a directory.","commonSituations":"Typo or wrong relative path for the artifact; artifact deleted between build and verification; running the command from a different directory; pointing at a directory instead of the built file.","solutions":["Check the artifact path exists and is a regular file (ls -l) and switch to an absolute path","Re-download or rebuild the artifact if it was moved or deleted","Verify permissions allow reading by the current user"],"exampleFix":"// before\npacker verify -bundle rel.sigstore -artifact ./missing.bin attestation.intoto.jsonl\n// after\npacker verify -bundle rel.sigstore -artifact $(pwd)/dist/artifact.zip attestation.intoto.jsonl","handlingStrategy":"validation","validationCode":"info, err := os.Stat(artifactPath)\nif err != nil {\n    return fmt.Errorf(\"artifact %q unavailable: %w\", artifactPath, err)\n}\nif info.IsDir() {\n    return fmt.Errorf(\"artifact %q is a directory\", artifactPath)\n}\nfile, err := os.Open(artifactPath)\nif err != nil { return err }\nfile.Close()","typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) && strings.Contains(err.Error(), \"open artifact\") {\n        // fix -artifact path and retry\n    }\n}","preventionTips":["Verify artifact existence with os.Stat before invoking verification","Use absolute paths for -artifact","Rebuild/download the artifact before verifying rather than assuming it is present"],"tags":["file-io","artifact","sigstore"],"backgroundTag":"artifact-file-not-found","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}