{"record":{"id":"ce9109e30744373a","repo":"hashicorp/packer","slug":"unsupported-private-key-data","errorCode":null,"errorMessage":"unsupported private key data","messagePattern":"unsupported private key data","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_key.go","lineNumber":210,"sourceCode":"func loadPEMPrivateKeyAsPublic(contents []byte) (crypto.PublicKey, []byte, error) {\n\tblock, _ := pem.Decode(contents)\n\tif block == nil {\n\t\treturn nil, nil, fmt.Errorf(\"no PEM block found\")\n\t}\n\n\tvar signer crypto.Signer\n\tif key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {\n\t\tvar ok bool\n\t\tsigner, ok = key.(crypto.Signer)\n\t\tif !ok {\n\t\t\treturn nil, nil, fmt.Errorf(\"private key does not implement crypto.Signer\")\n\t\t}\n\t} else if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {\n\t\tsigner = key\n\t} else if key, err := x509.ParseECPrivateKey(block.Bytes); err == nil {\n\t\tsigner = key\n\t} else {\n\t\treturn nil, nil, fmt.Errorf(\"unsupported private key data\")\n\t}\n\n\tpublicKeyPEM, err := marshalPublicKeyPEM(signer.Public())\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tpublicKey, _, err := loadPEMPublicKey(publicKeyPEM)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\treturn publicKey, publicKeyPEM, nil\n}\n\nfunc marshalPublicKeyPEM(publicKey crypto.PublicKey) ([]byte, error) {\n\tencoded, err := x509.MarshalPKIXPublicKey(publicKey)\n\tif err != nil {","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_key.go#L192-L228","documentation":"This error comes from loadPEMPrivateKeyAsPublic, which is a fallback path used when loading a verifier: the supplied PEM block failed to parse as a PKIX public key, a certificate, PKCS#8, PKCS#1, or SEC1/EC private key. The library only supports RSA (PKCS#1/PKCS#8) and EC (SEC1/PKCS#8) private keys here, so any other DER payload — malformed bytes, an Ed25519 PKCS#8 body that fails to decode, a DSA key, or a completely different PEM type (e.g. a CSR or encrypted key) — falls through to this error.","triggerScenarios":"Calling LoadPEMVerifier(path) or LoadPEMVerifierBytes(contents) with a PEM file whose block.Bytes does not parse as PKIX public key, x509 certificate, PKCS#8 private key, PKCS#1 RSA private key, or EC private key. Reached only via the loadPEMPublicKey fallback chain, so it is wrapped as \"load verifier %q: ...\" or surfaces after the earlier parse attempts fail.","commonSituations":"Pointing the verifier at a full signing key in an unusual format (e.g. OpenSSH \"OPENSSH PRIVATE KEY\" format instead of PKCS#8/PEM), passing a certificate request or encrypted (\"ENCRYPTED PRIVATE KEY\") PEM, a truncated or corrupt key file, or a DSA key. Note PKCS#8 keys that decode but do not implement crypto.Signer produce a different message, so this specific error means even DER-level parsing failed.","solutions":["Convert the key to a supported format: for RSA use PKCS#1 or PKCS#8 PEM ('openssl rsa -in key.pem -traditional' or 'openssl pkcs8 -topk8 -nocrypt'), for EC use SEC1 or PKCS#8 ('openssl ec -in key.pem').","If using an Ed25519 key from OpenSSH, convert it: 'ssh-keygen -p -m PKCS8 -f id_ed25519' so it parses as PKCS#8.","If the file is meant to be a public key, export it as SubjectPublicKeyInfo: 'openssl pkey -pubin' / 'openssl pkey -in key.pem -pubout'.","Decrypt the key first if it is passphrase-protected (encrypted PEM blocks never parse); supply the key unencrypted to the verifier path.","Verify the file is not truncated or corrupted by checking it with 'openssl pkey -in file.pem -noout -check'."],"exampleFix":"// before: verifier pointed at OpenSSH-format private key\n// -----BEGIN OPENSSH PRIVATE KEY----- ...\n// after: convert once, then reference the PKCS#8 file\n//   ssh-keygen -p -m PKCS8 -f ~/.ssh/id_ed25519\n// verifier_pem = \"~/.ssh/id_ed25519\"  // now parses via x509.ParsePKCS8PrivateKey","handlingStrategy":"validation","validationCode":"// pre-check before handing PEM to LoadPEMVerifier\nfunc pemKeySupported(path string) error {\n\tdata, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn err\n\t}\n\tblock, _ := pem.Decode(data)\n\tif block == nil {\n\t\treturn fmt.Errorf(\"no PEM block\")\n\t}\n\tswitch {\n\tcase x509.IsEncryptedPEMBlock(block): //nolint:staticcheck\n\t\treturn fmt.Errorf(\"encrypted PEM not supported\")\n\t}\n\tif _, err := x509.ParsePKIXPublicKey(block.Bytes); err == nil {\n\t\treturn nil\n\t}\n\tif _, err := x509.ParseCertificate(block.Bytes); err == nil {\n\t\treturn nil\n\t}\n\tif _, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {\n\t\treturn nil\n\t}\n\tif _, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {\n\t\treturn nil\n\t}\n\tif _, err := x509.ParseECPrivateKey(block.Bytes); err == nil {\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"%s: unsupported PEM type %q; use PKCS#8/PKCS#1/SEC1 key or SPKI public key\", path, block.Type)\n}","typeGuard":"// narrow parsed PKCS#8 content to a supported signer key\nfunc isSupportedSignerKey(key any) bool {\n\tswitch key.(type) {\n\tcase *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey:\n\t\treturn true\n\tdefault:\n\t\treturn false\n\t}\n}","tryCatchPattern":"verifier, err := attestation.LoadPEMVerifier(keyPath)\nif err != nil {\n\tvar unsupported = strings.Contains(err.Error(), \"unsupported\")\n\tswitch {\n\tcase unsupported:\n\t\treturn fmt.Errorf(\"verifier key %s: convert to PKCS#8 PEM ('openssl pkcs8 -topk8 -nocrypt'); got: %w\", keyPath, err)\n\tdefault:\n\t\treturn fmt.Errorf(\"load verifier: %w\", err)\n\t}\n}","preventionTips":["Store verifier/verifying keys as PKCS#8 ('BEGIN PRIVATE KEY') or SPKI ('BEGIN PUBLIC KEY') PEM, never OpenSSH ('BEGIN OPENSSH PRIVATE KEY') or encrypted PEM.","Validate every key file with 'openssl pkey -in f.pem -noout' as part of config setup or CI.","Use LoadPEMVerifier only for public keys/certificates; keep signing keys out of verifier paths.","Pin key algorithms to RSA, ECDSA, or Ed25519 in your provisioning docs; reject DSA keys."],"tags":["go","crypto","pem","key-format"],"backgroundTag":"unsupported-key-format","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}