hashicorp/packer · error

create keyless verifier: %w

Error message

create keyless verifier: %w

What it means

This error wraps failures while constructing the in-process signature verifier from the public key of a freshly obtained Fulcio keyless certificate during signer creation (newKeylessSigner). newSigstoreVerifierFromPublicKey builds a sigstore-go signature verifier from certificate.PublicKey; failure means the certificate's key could not be turned into a usable verifier (nil/unsupported key or underlying verifier construction error). It is almost always a symptom of an unexpected/unsupported Fulcio certificate key, not a user config error.

Source

Thrown at internal/attestation/sign_keyless.go:124

	if err != nil {
		return nil, fmt.Errorf("generate ephemeral keypair: %w", err)
	}

	fulcio := newKeylessFulcio(fulcioURL)
	certDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})
	if err != nil {
		return nil, fmt.Errorf("request Fulcio certificate: %w", err)
	}

	certificate, err := x509.ParseCertificate(certDER)
	if err != nil {
		return nil, fmt.Errorf("parse Fulcio certificate: %w", err)
	}

	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
	verifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("create keyless verifier: %w", err)
	}

	return &keylessSigner{
		keypair:  keypair,
		certPEM:  certPEM,
		cert:     certificate,
		verifier: verifier,
		keyID:    hex.EncodeToString(keypair.GetHint()),
	}, nil
}

func (s *keylessSigner) Sign(ctx context.Context, payloadType string, payload []byte) (Signature, error) {
	signature, _, err := s.keypair.SignData(ctx, PreAuthEncode(payloadType, payload))
	if err != nil {
		return Signature{}, fmt.Errorf("sign payload with keyless signer: %w", err)
	}

	return Signature{

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the Fulcio instance (default https://fulcio.sigstore.dev or cfg.FulcioURL) is genuine and issuing standard ECDSA P-256 certificates
2. Inspect certificate.PublicKey type; confirm sigstore-go supports the algorithm for your pinned sigstore-go version
3. Update or pin the sigstore-go dependency to a version that supports the key type being issued
4. Retry the operation — the ephemeral keypair is generated per-run, so a fresh run gets a new key and certificate

Example fix

// before (custom Fulcio issuing RSA certs)
fulcioURL := "https://fulcio.internal.example.com"
// after (use public Fulcio or one configured for ECDSA P-256)
fulcioURL := "" // falls back to defaultFulcioURL https://fulcio.sigstore.dev

cert, err := x509.ParseCertificate(certDER)
if err != nil { return err }
switch cert.PublicKey.(type) {
case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
	// supported by sigstore-go
default:
	return fmt.Errorf("unsupported Fulcio certificate key type %T", cert.PublicKey)
}

func hasSupportedKey(cert *x509.Certificate) bool {
	switch cert.PublicKey.(type) {
	case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
		return true
	}
	return false
}

When it happens

Trigger: Calling attestation signing with signing_mode="keyless" and the Fulcio certificate returned from the CA has a nil or unsupported public key (e.g. unexpected algorithm), so newSigstoreVerifierFromPublicKey fails at internal/attestation/sign_keyless.go:122-124.

Common situations: A Fulcio mirror or custom FulcioURL (cfg.FulcioURL) issues certificates with an ECDSA/RSA variant unsupported by sigstore-go; a mocked/broken Fulcio returns a malformed certificate; sigstore-go library version upgrade changes supported key algorithms.

Related errors

• sign payload with keyless signer: %w
• static certificate provider is missing a certificate
• signing_mode %q does not support Sigstore bundle emission
• build keyless identity policy: %w
• verify keyless certificate identity: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/495d193084182156. Report an issue: GitHub.