hashicorp/packer · error

attestation envelope has no signatures

Error message

attestation envelope has no signatures

What it means

The attestation envelope contains zero signatures, so there is no signature to match against the bundle's signature. Thrown as an input-validation failure: a DSSE envelope without signatures cannot be verified at all.

Source

Thrown at internal/attestation/verify.go:365

}

func ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {
	bundleEnvelope, err := bundle.Envelope()
	if err != nil {
		return fmt.Errorf("extract DSSE envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")
	}

	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("attestation envelope has no signatures")
	}

	bundleSignature := bundleEnvelope.Signature()
	for i, envelopeSignature := range envelope.Signatures {
		signature, err := DecodeEnvelopeSignature(envelopeSignature)
		if err != nil {
			return fmt.Errorf("decode attestation envelope signature %d: %w", i, err)
		}

		if bytes.Equal(bundleSignature, signature) {
			return nil
		}
	}

	return fmt.Errorf("sigstore bundle signature does not match any attestation signature")
}

func verifyArtifactSubject(subjects []internalprovenance.Subject, artifactPath string) error {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Regenerate or re-export the signed attestation so it includes at least one entry in its signatures array
2. Validate the attestation JSON before verification (signatures array non-empty, payload/payloadType present)
3. Check the deserialization code/flags that load the envelope to ensure signatures are not dropped

if len(envelope.Signatures) == 0 {
    return fmt.Errorf("attestation has no signatures; refusing verification")
}

func hasSignatures(env Envelope) bool {
    return len(env.Signatures) > 0
}

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "no signatures") {
        // re-export the signed envelope; check the pipeline step that signs
    }
}

When it happens

Trigger: ensureBundleMatchesEnvelope receives an Envelope whose Signatures slice is empty — e.g. an attestation file produced or deserialized without its signatures array.

Common situations: Attestation file truncated or hand-assembled; a pipeline step stripped signatures; JSON deserialization dropped the signatures due to a schema/field-name mismatch; user passed a raw statement (not a signed envelope) as the attestation.

Related errors

• attestation %q has unexpected payloadType %q (want %q)
• signing_mode %q does not support Sigstore bundle emission
• decode envelope payload: %w
• decode envelope signature: %w
• signature verification failed

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/451287597e6ea737. Report an issue: GitHub.