{"record":{"id":"db1e079b1ab79593","repo":"hashicorp/packer","slug":"decode-envelope-payload-w","errorCode":null,"errorMessage":"decode envelope payload: %w","messagePattern":"decode envelope payload: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/dsse.go","lineNumber":54,"sourceCode":"\t\tPayloadType: payloadType,\n\t\tPayload:     base64.StdEncoding.EncodeToString(payload),\n\t\tSignatures: []EnvelopeSignature{{\n\t\t\tKeyID: signature.KeyID,\n\t\t\tSig:   base64.StdEncoding.EncodeToString(signature.Sig),\n\t\t}},\n\t}\n\n\tif len(signature.CertPEM) > 0 {\n\t\tenvelope.Signatures[0].Cert = string(signature.CertPEM)\n\t}\n\n\treturn envelope\n}\n\nfunc DecodeEnvelopePayload(envelope Envelope) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(envelope.Payload)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode envelope payload: %w\", err)\n\t}\n\n\treturn decoded, nil\n}\n\nfunc DecodeEnvelopeSignature(signature EnvelopeSignature) ([]byte, error) {\n\tdecoded, err := base64.StdEncoding.DecodeString(signature.Sig)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"decode envelope signature: %w\", err)\n\t}\n\n\treturn decoded, nil\n}\n","sourceCodeStart":36,"sourceCodeEnd":68,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/dsse.go#L36-L68","documentation":"DecodeEnvelopePayload base64-decodes the payload field of a DSSE envelope. Packer wraps the base64 error with this message when envelope.Payload is not valid standard base64, meaning the envelope is malformed or truncated rather than merely unverifiable.","triggerScenarios":"Calling DecodeEnvelopePayload with an Envelope whose Payload string contains invalid standard-base64 characters, wrong padding, or is empty/corrupted; called by VerifyEnvelope and VerifyAttestationFile during attestation verification.","commonSituations":"An attestation file was hand-edited, truncated by a failed download, produced by a tool that uses base64url or raw (non-base64) payloads, or copied with whitespace/line-wrapping introduced.","solutions":["Regenerate the attestation envelope from the trusted producer instead of repairing the payload by hand","Check the payload encoding: this decoder requires standard base64 (StdEncoding), not base64url — re-encode with StdEncoding if a different alphabet was used","Verify the file wasn't truncated or modified in transit (checksum it against the source)","Inspect the payload string for stray whitespace, quotes, or padding errors before decoding"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func validBase64(s string) bool {\n\t_, err := base64.StdEncoding.DecodeString(s)\n\treturn err == nil && s != \"\"\n}\n// before verification:\n// if !validBase64(envelope.Payload) { return errors.New(\"envelope payload is not valid standard base64\") }","typeGuard":"func hasDecodablePayload(env Envelope) bool {\n\t_, err := base64.StdEncoding.DecodeString(env.Payload)\n\treturn err == nil\n}","tryCatchPattern":"payload, err := DecodeEnvelopePayload(envelope)\nif err != nil {\n\t// treat as corrupted attestation: re-fetch or regenerate the file\n\treturn fmt.Errorf(\"attestation envelope corrupted, regenerate it: %w\", err)\n}","preventionTips":["Never hand-edit attestation files; always generate them via the signing tool","Verify checksums of attestation files after download/transfer","Ensure payloads are standard base64, not base64url or raw bytes","Validate envelope JSON schema before passing to verification"],"tags":["attestation","dsse","base64","decoding","go"],"backgroundTag":"base64-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}