{"record":{"id":"dabc8b742cd9b492","repo":"hashicorp/packer","slug":"verify-sigstore-bundle-q-w","errorCode":null,"errorMessage":"verify Sigstore bundle %q: %w","messagePattern":"verify Sigstore bundle %q: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":343,"sourceCode":"\n\tartifactPolicy := sigstoreverify.WithoutArtifactUnsafe()\n\tif policy.ArtifactPath != \"\" {\n\t\tartifact, err := os.Open(policy.ArtifactPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"open artifact %q for bundle verification: %w\", policy.ArtifactPath, err)\n\t\t}\n\t\tdefer func() { _ = artifact.Close() }()\n\t\tartifactPolicy = sigstoreverify.WithArtifact(artifact)\n\t}\n\n\tidentity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, \"\", cfg.KeylessIdentity, \"\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"build keyless identity policy: %w\", err)\n\t}\n\n\tpolicyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))\n\tif _, err := verifier.Verify(bundle, policyBuilder); err != nil {\n\t\treturn fmt.Errorf(\"verify Sigstore bundle %q: %w\", policy.SigstoreBundlePath, err)\n\t}\n\n\treturn nil\n}\n\nfunc ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {\n\tbundleEnvelope, err := bundle.Envelope()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"extract DSSE envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tif rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {\n\t\treturn fmt.Errorf(\"sigstore bundle payload does not match attestation\")","sourceCodeStart":325,"sourceCodeEnd":361,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L325-L361","documentation":"The sigstore-go verifier rejected the bundle against the policy: certificate chain, signature, transparency-log inclusion, or timestamp checks failed. This is the terminal verification failure for bundle-based evidence and wraps the underlying sigstore-go error, which names the failing check.","triggerScenarios":"verifier.Verify(bundle, policyBuilder) returns an error: expired/invalid Fulcio cert, signature mismatch, RequireTransparencyLog set but bundle lacks a valid Rekor entry, RequireObserverTimestamp set but no trusted timestamp, or identity policy does not match the certificate.","commonSituations":"Verifying an old bundle after the Fulcio root rotated; artifact bytes changed since signing (digest mismatch); requiring Rekor inclusion on a bundle without an entry; system clock far off (timestamp validation); identity/issuer mismatch with the certificate.","solutions":["Read the wrapped sigstore-go error to see which check failed (certificate, signature, tlog, timestamp)","Re-sync system clock (NTP) and refresh trusted root, then retry","Re-obtain the bundle/attestation from the signing step; confirm the artifact is byte-identical to the signed one","Relax or align policy flags: only pass RequireTransparencyLog/RequireObserverTimestamp if the bundle actually carries that evidence"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := verify(...); err != nil {\n    if strings.Contains(err.Error(), \"verify Sigstore bundle\") {\n        inner := errors.Unwrap(errors.Unwrap(err))\n        log.Printf(\"sigstore verification failed: %v\", inner) // names failing check\n    }\n}","preventionTips":["Keep system clock NTP-synchronized","Refresh the trusted root when Fulcio/Rekor keys rotate","Always verify the exact artifact bytes that were signed","Only enable RequireTransparencyLog/RequireObserverTimestamp when the bundle carries that evidence"],"tags":["sigstore","verification","certificate"],"backgroundTag":"sigstore-bundle-verification-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}