{"record":{"id":"cc07b35fc1ec0e1b","repo":"hashicorp/packer","slug":"verify-signed-attestation-w","errorCode":null,"errorMessage":"verify signed attestation: %w","messagePattern":"verify signed attestation: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":328,"sourceCode":"\n\tbundlePath := sigstoreBundleOutputPath(outputPath)\n\tbundleJSON := []byte(nil)\n\tvar envelope internalattestation.Envelope\n\tif backendConfig.Mode == internalattestation.SigningModeKeyless {\n\t\tenvelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation with Sigstore bundle: %w\", err)\n\t\t}\n\t} else {\n\t\tsignature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)\n\t\tif signErr != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation: %w\", signErr)\n\t\t}\n\t\tenvelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)\n\t}\n\n\tif err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify signed attestation: %w\", err)\n\t}\n\n\toutput, err := json.MarshalIndent(envelope, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal signed envelope: %w\", err)\n\t}\n\n\tif err := atomicWriteFile(outputPath, output, 0664); err != nil {\n\t\treturn fmt.Errorf(\"write attestation %q: %w\", outputPath, err)\n\t}\n\n\tif len(bundleJSON) > 0 {\n\t\tif err := atomicWriteFile(bundlePath, bundleJSON, 0664); err != nil {\n\t\t\treturn fmt.Errorf(\"write Sigstore bundle %q: %w\", bundlePath, err)\n\t\t}\n\t\tui.Say(fmt.Sprintf(\"Wrote Sigstore bundle to %s\", bundlePath))\n\t}\n","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L310-L346","documentation":"After signing, writeAttestation immediately verifies the envelope with internalattestation.VerifyEnvelope to guarantee the signature is internally consistent before writing anything. A verification failure is wrapped as `verify signed attestation: %w`. This almost always indicates a mismatched signer/verifier pair or a tampered/buggy bundle rather than user config.","triggerScenarios":"The verifier configured (or derived from the signer's public key) does not match the signing key; the Sigstore bundle's certificate chain doesn't validate against expected roots (Fulcio root/Rekor transparency log mismatch, clock skew outside cert validity).","commonSituations":"Sign-time clock skew making keyless certificates appear expired; using a custom Fulcio/Rekor instance while verification checks public sigstore roots; plugin bug after upgrading sigstore libraries.","solutions":["Check system clock accuracy (NTP) — keyless certs are time-sensitive.","Ensure the Fulcio/Rekor URLs used for signing match those used for verification (custom instance configuration).","Confirm the verifier's public key matches the signing key.","Upgrade/downgrade the sigstore libraries or file an issue if it persists with consistent configuration."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// sync clock and match signing/verification endpoints before the build\nif drift, _ := checkNTPDrift(); drift > 2*time.Minute { return errors.New(\"fix clock skew\") }\nif cfg.FulcioURL != \"\" && cfg.FulcioURL != verifierFulcioURL { return errors.New(\"fulcio URL mismatch\") }","typeGuard":null,"tryCatchPattern":"if err := pp.PostProcess(ctx, ui, artifact); err != nil {\n    if strings.Contains(err.Error(), \"verify signed attestation\") {\n        // keep the unsigned statement as a fallback artifact and alert\n    }\n}","preventionTips":["Run NTP on build hosts (keyless certs are time-bound).","Use the same Fulcio/Rekor URLs for signing and verification.","Pin sigstore library versions across the toolchain.","Rotate keys before expiry and verify sign->verify round-trips in CI."],"tags":["verification","sigstore","signing","provenance"],"backgroundTag":"signature-verification-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}