{"record":{"id":"fe2978778a9241a2","repo":"hashicorp/packer","slug":"attestation-verification-for-signing-mode-q-requi","errorCode":null,"errorMessage":"attestation verification for signing_mode %q requires verifier or key","messagePattern":"attestation verification for signing_mode %q requires verifier or key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/attestation/verify.go","lineNumber":161,"sourceCode":"\t}\n\n\treturn false\n}\n\nfunc verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {\n\tmode := normalizeVerificationMode(cfg, envelope)\n\n\tif cfg.VerifierRef != \"\" {\n\t\tif mode == SigningModeKeyless || envelopeHasCertificate(envelope) {\n\t\t\treturn nil, fmt.Errorf(\"verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead\")\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.VerifierRef)\n\t}\n\n\tswitch mode {\n\tcase SigningModeKey:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires verifier or key\", SigningModeKey)\n\t\t}\n\t\treturn LoadPEMVerifier(cfg.SignerRef)\n\tcase SigningModeKMS:\n\t\tif cfg.SignerRef == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"attestation verification for signing_mode %q requires key or verifier\", SigningModeKMS)\n\t\t}\n\t\tsigner, err := NewSigner(ctx, cfg)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn signer.Verifier(ctx, cfg)\n\tcase SigningModeKeyless:\n\t\treturn newKeylessVerifierForEnvelope(cfg, envelope)\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unable to determine attestation signing mode; set signing_mode or verifier explicitly\")\n\t}\n}\n","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/hashicorp/packer/blob/eb36e3c3e48a036f3e8cc94087636ee72e1303c9/internal/attestation/verify.go#L143-L179","documentation":"When signing_mode is \"key\", verification loads a PEM verifier from the configured key reference; this error fires when neither verifier nor key (SignerRef) is set. The library has no public key to check the signature against, so it fails fast with an actionable message naming the missing config.","triggerScenarios":"VerifyAttestationFile with BackendConfig{Mode: SigningModeKey} but both SignerRef and VerifierRef empty; templates migrated to key mode without carrying over the key reference; the key field dropped during refactoring.","commonSituations":"Config file with signing_mode=key but the key_url/key_path field removed; CLI invocation passing the mode flag without the key flag; environment-specific config where the key variable resolves to an empty string.","solutions":["Set cfg.SignerRef (or the corresponding template key reference) to the PEM public key path","Alternatively set cfg.VerifierRef to a verifier file","Remove the explicit signing_mode so the library infers it from the config/envelope","Check that env/config interpolation for the key is not producing an empty value"],"exampleFix":"// before\ncfg := attestation.BackendConfig{Mode: attestation.SigningModeKey}\n\n// after\ncfg := attestation.BackendConfig{Mode: attestation.SigningModeKey, SignerRef: \"keys/signer.pub\"}","handlingStrategy":"validation","validationCode":"if cfg.Mode == attestation.SigningModeKey && cfg.SignerRef == \"\" && cfg.VerifierRef == \"\" {\n    return errors.New\"signing_mode=key requires a verifier or key reference\")\n}","typeGuard":null,"tryCatchPattern":"if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {\n    if strings.Contains(err.Error(), \"requires verifier or key\") {\n        return fmt.Errorf\"add the PEM key/verifier reference for key-mode verification: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate BackendConfig completeness before invoking verification","Fail fast in config loading when mode is set but its required reference is empty","Avoid empty-string config values from unset env vars by defaulting or erroring early","Keep mode and its reference fields set together in templates"],"tags":["attestation","config","missing-config"],"backgroundTag":"missing-required-config","analyzedSha":"eb36e3c3e48a036f3e8cc94087636ee72e1303c9","analyzedAt":"2026-09-05T13:20:43.127Z","contentChangedAt":"2026-09-05T13:20:43.127Z","schemaVersion":2},"datasetVersion":"2026-09-12T17:17:11.597Z"}