{"record":{"id":"fc336ca44e2e1dc3","repo":"hashicorp/packer","slug":"sign-attestation-with-sigstore-bundle-w","errorCode":null,"errorMessage":"sign attestation with Sigstore bundle: %w","messagePattern":"sign attestation with Sigstore bundle: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"post-processor/provenance/post-processor.go","lineNumber":317,"sourceCode":"\t}\n\n\tsigner, verifier, err := p.signingResources(ctx, backendConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tpayload, err := internalattestation.MarshalPayload(statement)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal canonical attestation payload: %w\", err)\n\t}\n\n\tbundlePath := sigstoreBundleOutputPath(outputPath)\n\tbundleJSON := []byte(nil)\n\tvar envelope internalattestation.Envelope\n\tif backendConfig.Mode == internalattestation.SigningModeKeyless {\n\t\tenvelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation with Sigstore bundle: %w\", err)\n\t\t}\n\t} else {\n\t\tsignature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)\n\t\tif signErr != nil {\n\t\t\treturn fmt.Errorf(\"sign attestation: %w\", signErr)\n\t\t}\n\t\tenvelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)\n\t}\n\n\tif err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {\n\t\treturn fmt.Errorf(\"verify signed attestation: %w\", err)\n\t}\n\n\toutput, err := json.MarshalIndent(envelope, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"marshal signed envelope: %w\", err)\n\t}\n","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/post-processor/provenance/post-processor.go#L299-L335","documentation":"In keyless signing mode, writeAttestation builds a Sigstore bundle via buildSigstoreBundleForSigner, which performs an OIDC/Fulcio flow. Any failure in that flow (no OIDC token, network to Fulcio/Rekor, cert fetch) is wrapped as `sign attestation with Sigstore bundle: %w`.","triggerScenarios":"SigningModeKeyless configured but no OIDC identity token available/env var unset, unreachable Fulcio/Rekor endpoints, expired OIDC token, or custom Rekor/Fulcio URLs misconfigured.","commonSituations":"CI runners without network egress to sigstore endpoints; missing `SIGSTORE_ID_TOKEN` in headless environments; corporate proxies blocking rekor.sigstore.dev.","solutions":["Provide an OIDC token (e.g. set `SIGSTORE_ID_TOKEN` or the configured token env var) for keyless signing.","Verify network egress to Fulcio/Rekor endpoints; set custom URLs if using a private instance.","Read the wrapped error to distinguish OIDC auth vs network failures.","Switch `signing_mode` to a key-based mode if keyless isn't feasible in your environment."],"exampleFix":"// before (CI without OIDC)\nsigning_mode = \"keyless\"\n// after\nsigning_mode = \"key\"\nkey_path = \"./cosign.key\"","handlingStrategy":"retry","validationCode":"// check prerequisites for keyless signing before Configure\nif cfg.SigningMode == \"keyless\" {\n    if os.Getenv(\"SIGSTORE_ID_TOKEN\") == \"\" && !interactiveOIDCAvailable() {\n        return errors.New(\"keyless signing needs an OIDC token\")\n    }\n    if err := checkReachable(\"https://fulcio.sigstore.dev\"); err != nil {\n        return fmt.Errorf(\"fulcio unreachable: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"err := pp.PostProcess(ctx, ui, artifact)\nfor i := 0; i < 3 && err != nil && isTransientSigstore(err); i++ {\n    time.Sleep(backoff(i))\n    err = pp.PostProcess(ctx, ui, artifact)\n}","preventionTips":["Set SIGSTORE_ID_TOKEN (or OIDC env) in headless CI.","Allow network egress to fulcio/rekor endpoints or configure private instance URLs.","Refresh OIDC tokens before long builds.","Use key-based signing when keyless infrastructure is unavailable."],"tags":["sigstore","signing","oidc","network","provenance"],"backgroundTag":"sigstore-signing-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}