{"record":{"id":"fb342caad5194d94","repo":"hashicorp/packer","slug":"signing-mode-q-requires-signer-or-key-fb342c","errorCode":null,"errorMessage":"signing_mode %q requires signer or key","messagePattern":"signing_mode %q requires signer or key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":392,"sourceCode":"\tmode := p.config.SigningMode\n\tif mode == \"\" {\n\t\tmode = internalattestation.SigningModeNone\n\t}\n\n\tsignerRef := p.config.Signer\n\tif p.config.Key != \"\" {\n\t\tif signerRef != \"\" && signerRef != p.config.Key {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signer and key must match when both are set\")\n\t\t}\n\t\tsignerRef = p.config.Key\n\t}\n\n\tswitch mode {\n\tcase internalattestation.SigningModeNone:\n\t\treturn internalattestation.BackendConfig{Mode: mode}, nil\n\tcase internalattestation.SigningModeKey:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,\n\t\t\tEnv:         p.currentEnv(),\n\t\t}, nil\n\tcase internalattestation.SigningModeKMS:\n\t\tif signerRef == \"\" {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t\t}\n\t\tif !isRecognizedKMSSigner(signerRef) {\n\t\t\treturn internalattestation.BackendConfig{}, fmt.Errorf(\"signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://\", mode)\n\t\t}\n\t\treturn internalattestation.BackendConfig{\n\t\t\tMode:        mode,\n\t\t\tSignerRef:   signerRef,\n\t\t\tVerifierRef: p.config.Verifier,","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L374-L410","documentation":"Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is \"kms\" but neither `signer` nor `key` provides a KMS key reference, so there is nothing to sign the attestation with.","triggerScenarios":"p.config.SigningMode == internalattestation.SigningModeKey and both p.config.Signer and p.config.Key are empty; raised in Configure or writeAttestation.","commonSituations":"Template sets signing_mode = \"key\" but forgot the key file path; key field removed during refactoring; typo making the mode parse as \"key\" while the signer lives in an unrelated variable.","solutions":["Set signer (or key) to a KMS/Vault URI such as awskms://key-id, gcpkms://..., azurekms://..., or hashivault://...","Switch signing_mode to \"file\" with a local PEM key if KMS isn't available"],"exampleFix":"// before\n\"signing_mode\": \"key\"\n// after\n\"signing_mode\": \"key\",\n\"signer\": \"file:///keys/release.pem\"","handlingStrategy":"validation","validationCode":"func checkKeyMode(mode, signer, key string) error {\n\tif mode == \"key\" && signer == \"\" && key == \"\" {\n\t\treturn fmt.Errorf(\"signing_mode %q requires signer or key\", mode)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"if err := p.Configure(raws); err != nil {\n\tif strings.Contains(err.Error(), \"requires signer or key\") {\n\t\treturn fmt.Errorf(\"add signer/key to config: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Pair every signing_mode with its required fields in a config checklist.","Use packer validate in CI before builds.","Don't strip signer/key fields when changing modes."],"tags":["configuration","validation","signing"],"backgroundTag":"missing-required-config-field","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}