{"record":{"id":"fe0e721c3ada51f5","repo":"hashicorp/packer","slug":"load-verifier-q-w","errorCode":null,"errorMessage":"load verifier %q: %w","messagePattern":"load verifier %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/sign_key.go","lineNumber":112,"sourceCode":"\t\treturn nil\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported public key type %T\", v.publicKey)\n\t}\n}\n\nfunc (v *pemVerifier) KeyID() string {\n\treturn v.keyID\n}\n\nfunc LoadPEMVerifier(path string) (Verifier, error) {\n\tcontents, err := os.ReadFile(path)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"read verifier %q: %w\", path, err)\n\t}\n\n\tpublicKey, rawVerifier, err := loadPEMPublicKey(contents)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"load verifier %q: %w\", path, err)\n\t}\n\n\treturn &pemVerifier{\n\t\tpublicKey: publicKey,\n\t\tkeyID:     sha256Hex(rawVerifier),\n\t}, nil\n}\n\nfunc LoadPEMVerifierBytes(contents []byte) (*pemVerifier, error) {\n\tpublicKey, rawVerifier, err := loadPEMPublicKey(contents)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &pemVerifier{\n\t\tpublicKey: publicKey,\n\t\tkeyID:     sha256Hex(rawVerifier),\n\t}, nil","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/sign_key.go#L94-L130","documentation":"LoadPEMVerifier read the file successfully but loadPEMPublicKey could not interpret its contents as a supported PEM verifier (public key, certificate, or private key). The inner error is wrapped with %w, so errors.As/Unwrap reveals whether it was 'no PEM block found' or 'unsupported PEM verifier data'. The file content, not access, is the problem.","triggerScenarios":"Calling LoadPEMVerifier(path) on a file that contains no PEM at all (raw DER, text, empty), a corrupted/truncated PEM block, or a PEM block whose DER payload is not a PKIX public key, X.509 certificate, or parseable private key.","commonSituations":"Pointing the verifier at a CSR, a CRL, a PKCS#12 blob, or a signature file instead of a public key/cert; base64 output pasted without the BEGIN/END lines; file corrupted by a bad copy-paste or partial download; passing a private key encrypted with an unsupported format.","solutions":["Open the file and confirm it starts with '-----BEGIN PUBLIC KEY-----', '-----BEGIN CERTIFICATE-----', or a private-key block.","Regenerate or re-export the public key, e.g. 'openssl rsa -in key.pem -pubout > verifier.pem'.","Check the wrapped cause: errors.Is/As for 'no PEM block found' vs 'unsupported PEM verifier data' to decide between formatting and key-type fixes.","Use LoadPEMVerifierBytes in tests to validate the exact byte content before deploying the file."],"exampleFix":"// before\nv, err := attestation.LoadPEMVerifier(\"request.csr\") // unsupported PEM verifier data\n// after\nv, err := attestation.LoadPEMVerifier(\"verifier-public.pem\") // BEGIN PUBLIC KEY / CERTIFICATE","handlingStrategy":"validation","validationCode":"raw, err := os.ReadFile(path)\nif err != nil {\n\treturn err\n}\nblock, _ := pem.Decode(raw)\nif block == nil {\n\treturn fmt.Errorf(\"%s: not PEM armored\", path)\n}\nswitch block.Type {\ncase \"PUBLIC KEY\", \"CERTIFICATE\", \"RSA PUBLIC KEY\", \"EC PUBLIC KEY\", \"PRIVATE KEY\", \"RSA PRIVATE KEY\", \"EC PRIVATE KEY\":\n\t// acceptable verifier inputs\ndefault:\n\treturn fmt.Errorf(\"%s: unsupported PEM block type %q\", path, block.Type)\n}","typeGuard":null,"tryCatchPattern":"v, err := attestation.LoadPEMVerifier(path)\nif err != nil {\n\tvar inner error = err\n\tfor errors.Unwrap(inner) != nil {\n\t\tinner = errors.Unwrap(inner)\n\t}\n\tswitch {\n\tcase strings.Contains(inner.Error(), \"no PEM block found\"):\n\t\treturn fmt.Errorf(\"%s is not PEM armored; export the key with openssl -pubout\", path)\n\tcase strings.Contains(inner.Error(), \"unsupported PEM verifier data\"):\n\t\treturn fmt.Errorf(\"%s is not a public key, certificate, or supported private key\", path)\n\t}\n\treturn err\n}","preventionTips":["Distribute only 'BEGIN PUBLIC KEY' or 'BEGIN CERTIFICATE' files as verifiers.","Never hand-edit PEM files; regenerate with openssl when in doubt.","Add a startup self-check that loads all configured verifiers and fails fast.","Use LoadPEMVerifierBytes in unit tests with known-good PEM fixtures."],"tags":["go","pem","x509","attestation"],"backgroundTag":"pem-decode-failed","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}