hashicorp/packer · error

bundle-based Rekor or timestamp verification currently requi

Error message

bundle-based Rekor or timestamp verification currently requires a keyless attestation

What it means

Bundle-based verification of Fulcio-issued, short-lived certificates requires keyless (certificate-based) signatures; a plain key signature has no certificate or OIDC identity to validate against the bundle's trust material. This error means the envelope is not keyless and carries no certificate, yet bundle-based Rekor/timestamp verification was requested.

Source

Thrown at internal/attestation/verify.go:286

				return nil, fmt.Errorf("attestation does not contain expected source URI %q", policy.SourceURI)
			}
		}
	}

	return &statement, nil
}

func requiresSigstoreBundle(policy VerificationPolicy) bool {
	return policy.RequireTransparencyLog || policy.RequireObserverTimestamp
}

func verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {
	if strings.TrimSpace(policy.SigstoreBundlePath) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires -bundle")
	}

	if normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {
		return fmt.Errorf("bundle-based Rekor or timestamp verification currently requires a keyless attestation")
	}

	if strings.TrimSpace(cfg.KeylessIdentity) == "" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer")
	}

	trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
	if err != nil {
		return fmt.Errorf("load keyless trusted root: %w", err)
	}

	bundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)
	if err != nil {
		return fmt.Errorf("load Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	if err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {
		return err

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Re-sign the artifact in keyless mode (Fulcio certificate + OIDC) so the envelope carries a certificate.
2. If key signing is intentional, drop the bundle-based Rekor/timestamp requirements and verify against the trusted public key instead.
3. Set cfg mode to keyless only when the envelope actually contains a certificate; otherwise verify with key-based options.

Example fix

// before
cfg.SignerRef = "hashivault://transit/keys/release" // key-based signing, bundle verification requested
// after
cfg.KeylessIdentity = "user@example.com"; cfg.KeylessOIDCIssuer = "https://token.actions.githubusercontent.com" // keyless signing + bundle

if strings.TrimSpace(policy.SigstoreBundlePath) != "" {
	hasCert := false
	for _, sig := range envelope.Signatures {
		if strings.TrimSpace(sig.Cert) != "" { hasCert = true }
	}
	if cfg.Mode == "key" || (!hasCert && cfg.Mode == "") {
		return fmt.Errorf("bundle verification needs a keyless (certificate-bearing) attestation")
	}
}

func envelopeIsKeyless(envelope Envelope) bool {
	for _, sig := range envelope.Signatures {
		if strings.TrimSpace(sig.Cert) != "" { return true }
	}
	return false
}

err := VerifyAttestation(...)
if err != nil && strings.Contains(err.Error(), "requires a keyless attestation") {
	// verify with key-based options instead, or re-sign keylessly
}

When it happens

Trigger: verifySigstoreBundleEvidenceImpl called with an envelope signed in key mode (no cert fields in any signature) and BackendConfig mode not keyless, while a bundle path is provided.

Common situations: Artifacts signed with a long-lived key or KMS signer but verified with keyless bundle requirements; mixed signing pipelines where some artifacts are key-signed; mode explicitly set to "key" while expecting Rekor bundle verification.

Related errors

• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w
• summarize Fulcio certificate: %w
• verifier overrides are not supported for keyless attestation
• bundle-based Rekor or timestamp verification requires keyles

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/0dcf1491c1fde621. Report an issue: GitHub.