hashicorp/packer · error

build Sigstore bundle: %w

Error message

build Sigstore bundle: %w

What it means

newKeylessBundle (sigstoregosign.Bundle) assembles the Sigstore protobuf bundle: DSSE content signed by the ephemeral keypair, the Fulcio certificate, and (when UploadTlog is set) a Rekor transparency-log entry. Any failure inside bundle construction (signing, tlog upload, marshaling protobuf) is wrapped as 'build Sigstore bundle'. With UploadTlog=true this commonly surfaces Rekor upload failures.

Source

Thrown at internal/attestation/sign_keyless.go:173

	if cfg.UploadTlog {
		rekorURL := strings.TrimSpace(cfg.RekorURL)
		if rekorURL == "" {
			rekorURL = defaultRekorURL
		}

		trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
		if err != nil {
			return Envelope{}, nil, fmt.Errorf("load keyless trusted root: %w", err)
		}

		options.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}
		options.TrustedRoot = trustedMaterial
	}

	protobufBundle, err := newKeylessBundle(content, s.keypair, options)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("build Sigstore bundle: %w", err)
	}

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("extract envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return Envelope{}, nil, fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	bundleJSON, err := bundleWrapper.MarshalJSON()

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Retry SignBundle — Rekor uploads are transient-sensitive and idempotent for identical artifacts
2. If cfg.RekorURL is set, confirm the Rekor instance is reachable and compatible with the trusted root
3. If a transparency-log entry is not required, set cfg.UploadTlog=false so no Rekor interaction occurs
4. Check network egress/TLS to the Rekor endpoint and inspect the wrapped inner error for HTTP status details

Example fix

// before
cfg := BackendConfig{UploadTlog: true, RekorURL: "https://rekor.internal.example.com"} // wrong instance
// after
cfg := BackendConfig{UploadTlog: true} // uses default https://rekor.sigstore.dev

if cfg.UploadTlog {
	rekorURL := cfg.RekorURL
	if rekorURL == "" { rekorURL = "https://rekor.sigstore.dev" }
	resp, err := http.Get(rekorURL + "/api/v1/log")
	if err != nil || resp.StatusCode != 200 {
		return fmt.Errorf("Rekor %s unreachable before signing", rekorURL)
	}
	resp.Body.Close()
}

envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "build Sigstore bundle") {
	// transient Rekor/network issue: retry with backoff
	time.Sleep(2 * time.Second)
	envelope, bundle, err = signer.SignBundle(ctx, ptype, payload, cfg)
}

When it happens

Trigger: SignBundle calls newKeylessBundle(content, s.keypair, options) at internal/attestation/sign_keyless.go:171-173; fails when DSSE signing fails, or when options.TransparencyLogs is set and the Rekor entry upload is rejected/fails (bad cert, Rekor outage, idempotency/conflict), or invalid BundleOptions.

Common situations: Rekor (https://rekor.sigstore.dev) outage or rate limiting during CI; custom cfg.RekorURL pointing at a wrong/unreachable Rekor instance; trusted root not matching the Rekor instance; transient network errors during tlog upload.

Related errors

• load keyless trusted root: %w
• build keyless identity policy: %w
• verify keyless certificate identity: %w
• request Fulcio certificate: %w
• create keyless verifier: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9536b25f7ef19c7b. Report an issue: GitHub.