attestation verification for signing_mode %q requires verifi

Error message

attestation verification for signing_mode %q requires verifier or key

What it means

When signing_mode is "key", verification loads a PEM verifier from the configured key reference; this error fires when neither verifier nor key (SignerRef) is set. The library has no public key to check the signature against, so it fails fast with an actionable message naming the missing config.

Source

Thrown at internal/attestation/verify.go:161

	}

	return false
}

func verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {
	mode := normalizeVerificationMode(cfg, envelope)

	if cfg.VerifierRef != "" {
		if mode == SigningModeKeyless || envelopeHasCertificate(envelope) {
			return nil, fmt.Errorf("verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead")
		}
		return LoadPEMVerifier(cfg.VerifierRef)
	}

	switch mode {
	case SigningModeKey:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires verifier or key", SigningModeKey)
		}
		return LoadPEMVerifier(cfg.SignerRef)
	case SigningModeKMS:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires key or verifier", SigningModeKMS)
		}
		signer, err := NewSigner(ctx, cfg)
		if err != nil {
			return nil, err
		}
		return signer.Verifier(ctx, cfg)
	case SigningModeKeyless:
		return newKeylessVerifierForEnvelope(cfg, envelope)
	default:
		return nil, fmt.Errorf("unable to determine attestation signing mode; set signing_mode or verifier explicitly")
	}
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set cfg.SignerRef (or the corresponding template key reference) to the PEM public key path
Alternatively set cfg.VerifierRef to a verifier file
Remove the explicit signing_mode so the library infers it from the config/envelope
Check that env/config interpolation for the key is not producing an empty value

Example fix

// before
cfg := attestation.BackendConfig{Mode: attestation.SigningModeKey}

// after
cfg := attestation.BackendConfig{Mode: attestation.SigningModeKey, SignerRef: "keys/signer.pub"}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.Mode == attestation.SigningModeKey && cfg.SignerRef == "" && cfg.VerifierRef == "" {
    return errors.New"signing_mode=key requires a verifier or key reference")
}

Try / catch

if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {
    if strings.Contains(err.Error(), "requires verifier or key") {
        return fmt.Errorf"add the PEM key/verifier reference for key-mode verification: %w", err)
    }
    return err
}

Prevention

Validate BackendConfig completeness before invoking verification
Fail fast in config loading when mode is set but its required reference is empty
Avoid empty-string config values from unset env vars by defaulting or erroring early
Keep mode and its reference fields set together in templates

When it happens

Trigger: VerifyAttestationFile with BackendConfig{Mode: SigningModeKey} but both SignerRef and VerifierRef empty; templates migrated to key mode without carrying over the key reference; the key field dropped during refactoring.

Common situations: Config file with signing_mode=key but the key_url/key_path field removed; CLI invocation passing the mode flag without the key flag; environment-specific config where the key variable resolves to an empty string.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/fe2978778a9241a2. Report an issue: GitHub.