hashicorp/packer · error

create KMS verifier %q: %w

Error message

create KMS verifier %q: %w

What it means

Initialization error in the KMS signing backend (newKMSSigner): the public key retrieved from the KMS signer could not be turned into a sigstore verifier, meaning the key is usable for signing but not verifiable with the default verifier — often an unsupported key type or format.

Source

Thrown at internal/attestation/sign_kms.go:53

	}

	signerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)
	if err != nil {
		var notFound *sigstorekms.ProviderNotFoundError
		if errors.As(err, &notFound) {
			return nil, fmt.Errorf("initialize KMS signer %q: %w%s", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))
		}
		return nil, fmt.Errorf("initialize KMS signer %q: %w", cfg.SignerRef, err)
	}

	publicKey, err := signerVerifier.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("load KMS public key %q: %w", cfg.SignerRef, err)
	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("create KMS verifier %q: %w", cfg.SignerRef, err)
	}

	return &kmsSigner{
		signerVerifier: signerVerifier,
		verifier:       verifier,
		keyID:          verifier.KeyID(),
	}, nil
}

func (s *kmsSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {
	encoded := PreAuthEncode(payloadType, payload)
	signature, err := s.signerVerifier.SignMessage(bytes.NewReader(encoded))
	if err != nil {
		return Signature{}, fmt.Errorf("sign payload with KMS: %w", err)
	}

	return Signature{
		KeyID: s.keyID,

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the KMS key references an supported asymmetric signing algorithm (e.g. RSA/ECDSA)
2. Provide an explicit verifier with the `verifier` config pointing to a PEM public key that matches the KMS key

When it happens

Trigger: Thrown at internal/attestation/sign_kms.go:53 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/22b7e01877779c76. Report an issue: GitHub.