{"record":{"id":"dc7653824c7ebf14","repo":"hashicorp/packer","slug":"attestation-verification-for-signing-mode-q-requi-dc7653","errorCode":null,"errorMessage":"attestation verification for signing_mode %q requires key or verifier","messagePattern":"attestation verification for signing_mode %q requires key or verifier","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":166,"sourceCode":"func verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {\n\tmode := normalizeVerificationMode(cfg, envelope)\n\n\tif cfg.VerifierRef != \"\" {\n\t\tif mode == SigningModeKeyless || envelopeHasCertificate(envelope) {\n\t\t\treturn nil, fmt.Errorf(\"verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead\")\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.VerifierRef)\n\t}\n\n\tswitch mode {\n\tcase SigningModeKey:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires verifier or key\", SigningModeKey)\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.SignerRef)\n\tcase SigningModeKMS:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires key or verifier\", SigningModeKMS)\n\t\t}\n\t\tsigner, err := NewSigner(ctx, cfg)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn signer.Verifier(ctx, cfg)\n\tcase SigningModeKeyless:\n\t\treturn newKeylessVerifierForEnvelope(cfg, envelope)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unable to determine attestation signing mode; set signing_mode or verifier explicitly\")\n\t}\n}\n\nfunc normalizeVerificationMode(cfg BackendConfig, envelope Envelope) string {\n\tif cfg.Mode != \"\" {\n\t\treturn cfg.Mode\n\t}\n","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L148-L184","documentation":"When signing_mode is \"kms\", verification derives a verifier from the KMS key named by SignerRef; this error fires when SignerRef is empty. The library needs the KMS key URI (awskms://, gcpkms://, azurekms://, hashivault://) to construct a remote verifier, so it fails fast.","triggerScenarios":"VerifyAttestationFile with BackendConfig{Mode: SigningModeKMS} but SignerRef empty; a KMS URI string that lost its scheme prefix so it is no longer recognized and mode was set manually; config where the key variable interpolates to empty.","commonSituations":"Forgetting to pass --kms-key on the CLI while setting --signing-mode=kms; region/project removed from the key URI by an inline edit; CI secrets not populated so the key reference is blank.","solutions":["Set cfg.SignerRef to the full KMS key URI used for signing (e.g. awskms://key-id)","Alternatively provide cfg.VerifierRef with a PEM verifier to skip KMS","Ensure the URI retains its recognized scheme prefix (awskms://, gcpkms://, azurekms://, hashivault://)","Confirm config interpolation actually yields the key value at runtime"],"exampleFix":"// before\ncfg := attestation.BackendConfig{Mode: attestation.SigningModeKMS}\n\n// after\ncfg := attestation.BackendConfig{Mode: attestation.SigningModeKMS, SignerRef: \"awskms://alias/packer-signing\"}","handlingStrategy":"validation","validationCode":"if cfg.Mode == attestation.SigningModeKMS && !strings.HasPrefix(cfg.SignerRef, \"awskms://\") && !strings.HasPrefix(cfg.SignerRef, \"gcpkms://\") && !strings.HasPrefix(cfg.SignerRef, \"azurekms://\") && !strings.HasPrefix(cfg.SignerRef, \"hashivault://\") {\n    return errors.New\"KMS mode needs a recognized kms:// key URI\")\n}","typeGuard":null,"tryCatchPattern":"if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"requires key or verifier\") {\n        return fmt.Errorf\"set SignerRef to the KMS key URI used for signing: %w\", err)\n    }\n    return err\n}","preventionTips":["Store the full KMS URI (including scheme/region/alias) alongside signing config","Validate the URI prefix at config load time","Ensure CI secrets providing the key reference are actually populated","Fall back to a PEM VerifierRef when KMS access is unavailable at verify time"],"tags":["attestation","kms","config","missing-config"],"backgroundTag":"missing-required-config","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}