cli/cli · error

failed to get envelope from bundle: %v

Error message

failed to get envelope from bundle: %v

What it means

Thrown by getAttestationDetail in `gh attestation inspect` when attr.Bundle.Envelope() fails, i.e. the DSSE envelope cannot be decoded from the attestation bundle. The bundle's base64 payload or envelope structure does not match the expected sigstore bundle format.

Source

Thrown at pkg/cmd/attestation/inspect/bundle.go:80

		if !found {
			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
		}
	} else {
		after, found = strings.CutPrefix(repoURL,
			fmt.Sprintf("https://%s.ghe.com/", tenant))
		if !found {
			return "", "", fmt.Errorf("failed to get org and repo from %s", repoURL)
		}
	}

	parts := strings.Split(after, "/")
	return parts[0], parts[1], nil
}

func getAttestationDetail(tenant string, attr api.Attestation) (AttestationDetail, error) {
	envelope, err := attr.Bundle.Envelope()
	if err != nil {
		return AttestationDetail{}, fmt.Errorf("failed to get envelope from bundle: %v", err)
	}

	statement, err := envelope.EnvelopeContent().Statement()
	if err != nil {
		return AttestationDetail{}, fmt.Errorf("failed to get statement from envelope: %v", err)
	}

	var predicate Predicate
	predicateJson, err := json.Marshal(statement.Predicate)
	if err != nil {
		return AttestationDetail{}, fmt.Errorf("failed to marshal predicate: %v", err)
	}

	err = json.Unmarshal(predicateJson, &predicate)
	if err != nil {
		return AttestationDetail{}, fmt.Errorf("failed to unmarshal predicate: %v", err)
	}

View on GitHub (pinned to 0eeec0b92e)

Solutions

1. Re-fetch the attestation from the API rather than using a possibly corrupted local bundle
2. Confirm the file is a valid sigstore bundle (check bundle.mediaType)
3. Upgrade gh to a version supporting the bundle format used by the artifact

if b.MediaVersion == 0 || b.VerificationMaterial == nil {
	return errors.New("bundle missing verification material; not a valid sigstore bundle")
}

func hasDecodableEnvelope(b *sigstore.Bundle) bool {
	_, err := b.Envelope()
	return err == nil
}

env, err := attr.Bundle.Envelope()
if err != nil {
	return fmt.Errorf("decode DSSE envelope (bundle may be corrupt): %w", err)
}

When it happens

Trigger: Bundle.Envelope() errors on malformed base64, missing 'DSSE' payload fields, or an unsupported mediaType inside the bundle's verification material.

Common situations: Inspecting a hand-crafted or truncated .jsonl bundle file, a bundle produced by a newer sigstore format the CLI does not understand, or file corruption during download.

Related errors

• failed to get statement from envelope: %v
• failed to fetch signature content: %w
• failed to fetch envelope statement: %w
• bundle content could not be parsed: %w
• ErrUnrecognisedBundleExtension

AI-assisted analysis of cli/cli@0eeec0b92e (2026-08-15). Data as JSON: /api/errors/33a0d8497b24c2a4. Report an issue: GitHub.