attestation verification for signing_mode %q requires key or

Error message

attestation verification for signing_mode %q requires key or verifier

What it means

When signing_mode is "kms", verification derives a verifier from the KMS key named by SignerRef; this error fires when SignerRef is empty. The library needs the KMS key URI (awskms://, gcpkms://, azurekms://, hashivault://) to construct a remote verifier, so it fails fast.

Source

Thrown at internal/attestation/verify.go:166

func verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {
	mode := normalizeVerificationMode(cfg, envelope)

	if cfg.VerifierRef != "" {
		if mode == SigningModeKeyless || envelopeHasCertificate(envelope) {
			return nil, fmt.Errorf("verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead")
		}
		return LoadPEMVerifier(cfg.VerifierRef)
	}

	switch mode {
	case SigningModeKey:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires verifier or key", SigningModeKey)
		}
		return LoadPEMVerifier(cfg.SignerRef)
	case SigningModeKMS:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires key or verifier", SigningModeKMS)
		}
		signer, err := NewSigner(ctx, cfg)
		if err != nil {
			return nil, err
		}
		return signer.Verifier(ctx, cfg)
	case SigningModeKeyless:
		return newKeylessVerifierForEnvelope(cfg, envelope)
	default:
		return nil, fmt.Errorf("unable to determine attestation signing mode; set signing_mode or verifier explicitly")
	}
}

func normalizeVerificationMode(cfg BackendConfig, envelope Envelope) string {
	if cfg.Mode != "" {
		return cfg.Mode
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set cfg.SignerRef to the full KMS key URI used for signing (e.g. awskms://key-id)
Alternatively provide cfg.VerifierRef with a PEM verifier to skip KMS
Ensure the URI retains its recognized scheme prefix (awskms://, gcpkms://, azurekms://, hashivault://)
Confirm config interpolation actually yields the key value at runtime

Example fix

// before
cfg := attestation.BackendConfig{Mode: attestation.SigningModeKMS}

// after
cfg := attestation.BackendConfig{Mode: attestation.SigningModeKMS, SignerRef: "awskms://alias/packer-signing"}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.Mode == attestation.SigningModeKMS && !strings.HasPrefix(cfg.SignerRef, "awskms://") && !strings.HasPrefix(cfg.SignerRef, "gcpkms://") && !strings.HasPrefix(cfg.SignerRef, "azurekms://") && !strings.HasPrefix(cfg.SignerRef, "hashivault://") {
    return errors.New"KMS mode needs a recognized kms:// key URI")
}

Try / catch

if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {
    if strings.Contains(err.Error(), "requires key or verifier") {
        return fmt.Errorf"set SignerRef to the KMS key URI used for signing: %w", err)
    }
    return err
}

Prevention

Store the full KMS URI (including scheme/region/alias) alongside signing config
Validate the URI prefix at config load time
Ensure CI secrets providing the key reference are actually populated
Fall back to a PEM VerifierRef when KMS access is unavailable at verify time

When it happens

Trigger: VerifyAttestationFile with BackendConfig{Mode: SigningModeKMS} but SignerRef empty; a KMS URI string that lost its scheme prefix so it is no longer recognized and mode was set manually; config where the key variable interpolates to empty.

Common situations: Forgetting to pass --kms-key on the CLI while setting --signing-mode=kms; region/project removed from the key URI by an inline edit; CI secrets not populated so the key reference is blank.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/dc7653824c7ebf14. Report an issue: GitHub.