hashicorp/packer · error

bundle-based Rekor or timestamp verification requires -bundl

Error message

bundle-based Rekor or timestamp verification requires -bundle

What it means

verifySigstoreBundleEvidenceImpl verifies Rekor transparency-log or timestamp evidence from a Sigstore bundle, and policy.SigstoreBundlePath must contain the path to that bundle. This error means bundle-based verification was requested (e.g. RequireTransparencyLog or RequireObserverTimestamp) but no bundle path was supplied.

Source

Thrown at internal/attestation/verify.go:282

					break
				}
			}
			if !matched {
				return nil, fmt.Errorf("attestation does not contain expected source URI %q", policy.SourceURI)
			}
		}
	}

	return &statement, nil
}

func requiresSigstoreBundle(policy VerificationPolicy) bool {
	return policy.RequireTransparencyLog || policy.RequireObserverTimestamp
}

func verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {
	if strings.TrimSpace(policy.SigstoreBundlePath) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires -bundle")
	}

	if normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {
		return fmt.Errorf("bundle-based Rekor or timestamp verification currently requires a keyless attestation")
	}

	if strings.TrimSpace(cfg.KeylessIdentity) == "" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer")
	}

	trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
	if err != nil {
		return fmt.Errorf("load keyless trusted root: %w", err)
	}

	bundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)
	if err != nil {
		return fmt.Errorf("load Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Provide the Sigstore bundle path (the -bundle flag / policy.SigstoreBundlePath) produced at signing time.
2. If no bundle exists, either drop RequireTransparencyLog/RequireObserverTimestamp or re-sign the artifact with bundle generation enabled (e.g. cosign sign-blob --bundle).
3. For online verification without a bundle, use a verification mode that fetches Rekor evidence rather than the bundle-based path.

Example fix

// before
// packer verify ... -require-transparency-log
// after
// packer verify ... -require-transparency-log -bundle artifact.sigstore.json

if (policy.RequireTransparencyLog || policy.RequireObserverTimestamp) && strings.TrimSpace(policy.SigstoreBundlePath) == "" {
	return fmt.Errorf("-bundle is required when requiring Rekor/timestamp evidence")
}

err := VerifyAttestation(...)
if err != nil && strings.Contains(err.Error(), "requires -bundle") {
	// prompt user to supply the .sigstore.json bundle produced at signing time
}

When it happens

Trigger: Calling verification with policy.RequireTransparencyLog or RequireObserverTimestamp true while policy.SigstoreBundlePath is empty/whitespace.

Common situations: CLI invocation missing the -bundle flag while requiring Rekor evidence; offline verification workflows that assume the embedded envelope contains enough data; policy structs populated programmatically with only the requirement flags set.

Related errors

• load keyless trusted root: %w
• build Sigstore bundle: %w
• signing_mode %q does not support Sigstore bundle emission
• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/6447d8b62d1b011e. Report an issue: GitHub.