{"record":{"id":"e5f80bab175ae3a0","repo":"hashicorp/packer","slug":"marshal-sigstore-bundle-w","errorCode":null,"errorMessage":"marshal Sigstore bundle: %w","messagePattern":"marshal Sigstore bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_keyless.go","lineNumber":193,"sourceCode":"\n\tbundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"decode Sigstore bundle: %w\", err)\n\t}\n\n\tbundleEnvelope, err := bundleWrapper.Envelope()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"extract envelope from Sigstore bundle: %w\", err)\n\t}\n\n\trawEnvelope := bundleEnvelope.RawEnvelope()\n\tif rawEnvelope == nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"sigstore bundle does not contain a DSSE envelope\")\n\t}\n\n\tbundleJSON, err := bundleWrapper.MarshalJSON()\n\tif err != nil {\n\t\treturn Envelope{}, nil, fmt.Errorf(\"marshal Sigstore bundle: %w\", err)\n\t}\n\n\tenvelope := Envelope{\n\t\tPayloadType: rawEnvelope.PayloadType,\n\t\tPayload:     rawEnvelope.Payload,\n\t\tSignatures: []EnvelopeSignature{{\n\t\t\tKeyID: s.keyID,\n\t\t\tSig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),\n\t\t\tCert:  string(s.certPEM),\n\t\t}},\n\t}\n\n\treturn envelope, bundleJSON, nil\n}\n\nfunc (s *keylessSigner) Verifier(ctx context.Context, cfg BackendConfig) (Verifier, error) {\n\treturn newKeylessVerifier(cfg, s.cert)\n}","sourceCodeStart":175,"sourceCodeEnd":211,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_keyless.go#L175-L211","documentation":"Finally SignBundle serializes the wrapper bundle to JSON via bundleWrapper.MarshalJSON() so the raw Sigstore bundle bytes can be returned alongside the Envelope; any marshaling failure is wrapped as 'marshal Sigstore bundle'. The bundle was already decoded successfully, so this almost certainly indicates a protobuf/JSON marshaling bug or an inconsistent bundle (e.g. unmarshalable field) from an upstream library version.","triggerScenarios":"SignBundle calls bundleWrapper.MarshalJSON() at internal/attestation/sign_keyless.go:191-193; fails only if the valid bundle contains a field that cannot be marshaled (upstream bug/version mismatch).","commonSituations":"sigstore-go regression in MarshalJSON; bundle containing a message-signature variant without JSON representation; dependency skew between protobuf and sigstore-go versions.","solutions":["Upgrade sigstore-go (and google.golang.org/protobuf) to consistent latest versions and retry","Retry the signing flow; if deterministic, file against sigstore-go with the wrapped inner error","As a workaround for consumers needing only the Envelope, tolerate bundleJSON failure if your pipeline does not consume the raw bundle"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"envelope, bundleJSON, err := signer.SignBundle(ctx, ptype, payload, cfg)\nif err != nil && strings.Contains(err.Error(), \"marshal Sigstore bundle\") {\n\t// envelope may still be usable upstream; report and continue if raw bundle not needed\n\tlog.Printf(\"bundle JSON marshal failed: %v\", err)\n}","preventionTips":["Keep sigstore-go and protobuf module versions consistent","Retry signing; escalate deterministic failures upstream","Only consume bundleJSON when your pipeline needs the raw bundle"],"tags":["go","sigstore","bundle","serialization"],"backgroundTag":"bundle-serialization-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}