{"record":{"id":"eef39bbc5209ee8e","repo":"hashicorp/packer","slug":"initialize-kms-signer-q-w-s","errorCode":null,"errorMessage":"initialize KMS signer %q: %w%s","messagePattern":"initialize KMS signer %q: %w(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_kms.go","lineNumber":41,"sourceCode":"\tRegisterSigner(SigningModeKMS, newKMSSigner)\n}\n\ntype kmsSigner struct {\n\tsignerVerifier sigstorekms.SignerVerifier\n\tverifier       Verifier\n\tkeyID          string\n}\n\nfunc newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {\n\tif cfg.SignerRef == \"\" {\n\t\treturn nil, fmt.Errorf(\"signing_mode %q requires signer or key\", SigningModeKMS)\n\t}\n\n\tsignerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)\n\tif err != nil {\n\t\tvar notFound *sigstorekms.ProviderNotFoundError\n\t\tif errors.As(err, &notFound) {\n\t\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w%s\", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))\n\t\t}\n\t\treturn nil, fmt.Errorf(\"initialize KMS signer %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tpublicKey, err := signerVerifier.PublicKey()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load KMS public key %q: %w\", cfg.SignerRef, err)\n\t}\n\n\tverifier, err := newSigstoreVerifierFromPublicKey(publicKey)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create KMS verifier %q: %w\", cfg.SignerRef, err)\n\t}\n\n\treturn &kmsSigner{\n\t\tsignerVerifier: signerVerifier,\n\t\tverifier:       verifier,\n\t\tkeyID:          verifier.KeyID(),","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_kms.go#L23-L59","documentation":"After validating SignerRef, newKMSSigner calls sigstore's kms.Get (via newKMSSignerVerifier) to construct a SignerVerifier for the given key resource ID. This variant of the error is returned when that call fails AND errors.As matched a *sigstorekms.ProviderNotFoundError — meaning the key URI's scheme (awskms, gcpkms, azurekms, hashivault) has no provider registered, typically because the binary was built with the 'kms_cherrypick' build tag and that provider was not opted in. The error appends kmsProviderBuildHint, which names the build tag needed to compile the provider in.","triggerScenarios":"Calling signing_mode \"kms\" with a recognized scheme URI (e.g. awskms://alias/key, hashivault://...) while the running binary lacks that KMS provider — usually a build with `-tags 'kms_cherrypick'` that omitted e.g. kms_aws, so sigstorekms.Get returns ProviderNotFoundError.","commonSituations":"Using a slim/custom build of the tool with kms_cherrypick to reduce binary size, then deploying it where a different cloud's KMS key is configured; CI builds one binary for multiple clouds; upgrading and switching key providers (e.g. AWS to Vault) without rebuilding with the right tags.","solutions":["Rebuild the binary without the \"kms_cherrypick\" tag so all KMS providers are compiled in.","Rebuild with the specific provider tag: go build -tags 'kms_cherrypick kms_aws' (map: awskms→kms_aws, gcpkms→kms_gcp, azurekms→kms_azure, hashivault→kms_hashivault — the hint appended to the error tells you which).","Verify which binary is actually on PATH in the failing environment; an old slim build may be deployed.","Or switch the configured key to a provider that is compiled into your current build."],"exampleFix":"// before\ngo build -tags kms_cherrypick -o bin/tool .\n// after\ngo build -tags 'kms_cherrypick kms_aws' -o bin/tool .","handlingStrategy":"type-guard","validationCode":"scheme := ref[:strings.Index(ref, \"://\")]\nswitch scheme {\ncase \"awskms\", \"gcpkms\", \"azurekms\", \"hashivault\":\n\t// ensure the binary was built with the matching kms_* tag (or without kms_cherrypick)\n}\n","typeGuard":"var pnfe *sigstorekms.ProviderNotFoundError\nif errors.As(err, &pnfe) {\n\t// provider missing from build: rebuild with -tags kms_cherrypick kms_<provider>\n}","tryCatchPattern":"signer, err := attestation.NewSigner(ctx, cfg)\nif err != nil {\n\tvar pnfe *sigstorekms.ProviderNotFoundError\n\tif errors.As(err, &pnfe) {\n\t\treturn fmt.Errorf(\"KMS provider not in this build; rebuild without kms_cherrypick or with matching kms_* tag: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Build release binaries with all needed kms_* tags or without kms_cherrypick.","Pin the build tag matrix in CI to the set of clouds you deploy to.","Record the build tags in version/build info and verify at startup.","Before switching key providers, confirm the target provider is compiled into the deployed binary."],"tags":["kms","build-tags","sigstore","configuration"],"backgroundTag":"kms-provider-not-compiled-in","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}