hashicorp/packer · error

attestation %q has unexpected payloadType %q (want %q)

Error message

attestation %q has unexpected payloadType %q (want %q)

What it means

VerifyAttestationFile rejects envelopes whose payloadType is not InTotoPayloadType (the in-toto/DSSE ITE-6 payload type). The library only understands in-toto statements, so any other DSSE payload type is refused before signature verification. The actual and expected payload types are echoed in the message.

Source

Thrown at internal/attestation/verify.go:53

var newSigstoreBundleVerifier = sigstoreverify.NewVerifier

var verifySigstoreBundleEvidence = func(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {
	return verifySigstoreBundleEvidenceImpl(envelope, cfg, policy)
}

func VerifyAttestationFile(ctx context.Context, path string, cfg BackendConfig, policy VerificationPolicy) (*internalprovenance.Statement, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read attestation %q: %w", path, err)
	}

	var envelope Envelope
	if err := json.Unmarshal(contents, &envelope); err != nil {
		return nil, fmt.Errorf("decode attestation envelope %q: %w", path, err)
	}

	if envelope.PayloadType != InTotoPayloadType {
		return nil, fmt.Errorf("attestation %q has unexpected payloadType %q (want %q)",
			path, envelope.PayloadType, InTotoPayloadType)
	}

	if err := verifyEnvelopeSignature(ctx, path, cfg, policy, envelope); err != nil {
		return nil, err
	}

	payload, err := DecodeEnvelopePayload(envelope)
	if err != nil {
		return nil, err
	}

	statement, err := verifyPolicy(payload, policy)
	if err != nil {
		return nil, err
	}

	return statement, nil

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the payloadType field in the envelope JSON matches the in-toto value (application/vnd.in-toto+json)
2. Re-generate the attestation so it embeds an in-toto statement payload
3. Use the appropriate verifier for other payload types instead of this one
4. Check that the file is this library's attestation output and not another tool's DSSE envelope

Example fix

// before: envelope produced with a custom type
// "payloadType": "application/vnd.example.custom"

// after: ensure signing emits the in-toto payload type
// "payloadType": "application/vnd.in-toto+json"

var probe struct{ PayloadType string `json:"payloadType"` }
if err := json.Unmarshal(contents, &probe); err != nil { return err }
if probe.PayloadType != "application/vnd.in-toto+json" {
    return fmt.Errorf"unsupported payloadType %q; need in-toto", probe.PayloadType)
}

func isInTotoEnvelope(e attestation.Envelope) bool {
    return e.PayloadType == attestation.InTotoPayloadType
}

if _, err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {
    if strings.Contains(err.Error(), "unexpected payloadType") {
        return fmt.Errorf"file is signed but not an in-toto attestation"%w", err)
    }
    return err
}

When it happens

Trigger: Verifying a DSSE envelope signed with a different payload type (e.g. a SLSA v0.2 layout, a custom payload, or a helm/scorecard attestation); producing an envelope with a hand-written payloadType string that does not match the constant; mixing outputs from other sigstore tools that use different payload types.

Common situations: Feeding a cosign-attested artifact of a non-in-toto type into this verifier; template/config wiring pointing at the wrong provenance file; upstream tool changed its payloadType after a version upgrade.

Related errors

• attestation envelope has no signatures
• signing_mode %q does not support Sigstore bundle emission
• decode envelope payload: %w
• decode envelope signature: %w
• signature verification failed

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/7fcbbad447636f8e. Report an issue: GitHub.