{"record":{"id":"c882dcd28f7babe4","repo":"hashicorp/packer","slug":"load-keyless-trusted-root-w-c882dc","errorCode":null,"errorMessage":"load keyless trusted root: %w","messagePattern":"load keyless trusted root: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":295,"sourceCode":"\treturn policy.RequireTransparencyLog || policy.RequireObserverTimestamp\n}\n\nfunc verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {\n\tif strings.TrimSpace(policy.SigstoreBundlePath) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires -bundle\")\n\t}\n\n\tif normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification currently requires a keyless attestation\")\n\t}\n\n\tif strings.TrimSpace(cfg.KeylessIdentity) == \"\" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == \"\" {\n\t\treturn fmt.Errorf(\"bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer\")\n\t}\n\n\ttrustedMaterial, err := loadKeylessTrustedMaterial(cfg)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load keyless trusted root: %w\", err)\n\t}\n\n\tbundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"load Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\tif err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {\n\t\treturn err\n\t}\n\n\tverifierOptions := []sigstoreverify.VerifierOption{}\n\tif policy.RequireTransparencyLog {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))\n\t}\n\tif policy.RequireObserverTimestamp {\n\t\tverifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))\n\t}","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L277-L313","documentation":"Keyless bundle verification first loads trusted root material (Fulcio CA certificates and Rekor keys/tuf roots) via loadKeylessTrustedMaterial. This error wraps any failure of that loading step — unreadable custom root files, invalid PEM, or failures building the sigstore trust material from embedded/embedded TUF data.","triggerScenarios":"verifySigstoreBundleEvidenceImpl with keyless config where the custom root/key paths (or default embedded trust material) cannot be read or parsed — e.g. missing root CA file, wrong PEM type, corrupted TUF metadata.","commonSituations":"Pointing cfg at a custom Sigstore root that was exported incorrectly; air-gapped environments without the embedded TUF targets; expired or rotated trust roots; file permission problems on the root certificate path.","solutions":["Read the wrapped error for the root cause (missing file, bad PEM, TUF failure) and fix that underlying problem.","Verify any custom root/certificate paths in BackendConfig point to readable, valid PEM Fulcio/CTFE/Rekor keys.","Refresh embedded TUF root material or supply an explicit trusted root appropriate for your Sigstore deployment.","Check filesystem permissions and that the process can read the trust files."],"exampleFix":"// before\ncfg.TrustedRootPath = \"/etc/sigstore/root.pem\" // file missing\n// after\ncfg.TrustedRootPath = \"./keys/sigstore_root.pem\" // valid, readable PEM root","handlingStrategy":"try-catch","validationCode":"if cfg.TrustedRootPath != \"\" {\n\tif _, err := os.ReadFile(cfg.TrustedRootPath); err != nil {\n\t\treturn fmt.Errorf(\"trusted root unreadable before verification: %w\", err)\n\t}\n}","typeGuard":null,"tryCatchPattern":"err := VerifyAttestation(...)\nif err != nil && strings.HasPrefix(err.Error(), \"load keyless trusted root:\") {\n\t// inspect wrapped cause: refresh root files, fix PEM, or check permissions\n\treturn fmt.Errorf(\"sigstore trust setup failed: %w\", err)\n}","preventionTips":["Validate trusted root PEM files parse before deploying verification configs","Keep Sigstore TUF root material current (sigstore-tuf-update) and account for rotations","Check file permissions/readability of custom root paths in air-gapped or restricted environments"],"tags":["sigstore","trust-root","initialization"],"backgroundTag":"sigstore-trusted-root-load-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}