hashicorp/packer · error

create Sigstore bundle verifier: %w

Error message

create Sigstore bundle verifier: %w

What it means

newSigstoreBundleVerifier() failed to construct the sigstore-go bundle verifier from the loaded trusted root material and verifier options. This is thrown because certificate-chain/timestamp verification cannot proceed without a verifier. The inner error usually points to invalid trusted material (Fulcio/Rekor/TUF roots) or incompatible options.

Source

Thrown at internal/attestation/verify.go:323

	}

	verifierOptions := []sigstoreverify.VerifierOption{}
	if policy.RequireTransparencyLog {
		verifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))
	}
	if policy.RequireObserverTimestamp {
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}
	if len(verifierOptions) == 0 {
		// A trusted time source is required to validate the short-lived Fulcio
		// certificate as of signing time; default to observer timestamps when the
		// caller has not explicitly required Rekor or timestamp evidence.
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}

	verifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)
	if err != nil {
		return fmt.Errorf("create Sigstore bundle verifier: %w", err)
	}

	artifactPolicy := sigstoreverify.WithoutArtifactUnsafe()
	if policy.ArtifactPath != "" {
		artifact, err := os.Open(policy.ArtifactPath)
		if err != nil {
			return fmt.Errorf("open artifact %q for bundle verification: %w", policy.ArtifactPath, err)
		}
		defer func() { _ = artifact.Close() }()
		artifactPolicy = sigstoreverify.WithArtifact(artifact)
	}

	identity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, "", cfg.KeylessIdentity, "")
	if err != nil {
		return fmt.Errorf("build keyless identity policy: %w", err)
	}

	policyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Refresh the Sigstore trusted root (update TUF roots / re-fetch Fulcio and Rekor certificates) and retry
2. Inspect the wrapped inner error to identify whether the Fulcio root, Rekor key, or timestamp authority material is invalid
3. Upgrade/downgrade the sigstore-go dependency to a compatible version and rebuild

Example fix

// before
verifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)
// after (diagnose trusted material first)
if trustedMaterial == nil || len(trustedMaterial.FulcioCertificates()) == 0 {
    return fmt.Errorf("no Fulcio trusted material loaded; refresh trusted root")
}
verifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)

if trustedMaterial == nil {
    return fmt.Errorf("trusted material not loaded")
}

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "create Sigstore bundle verifier") {
        // refresh trusted root / TUF cache, then retry once
    }
}

When it happens

Trigger: Called after loadKeylessTrustedMaterial succeeds but sigstore.NewVerifier/option application fails: malformed trusted root, empty trusted material, or conflicting verifier options (WithTransparencyLog/WithObserverTimestamps).

Common situations: Corrupted or outdated embedded/TUF-fetched trusted root; offline environment where trusted material could not be fully populated; a sigstore library version change altering verifier construction requirements.

Related errors

• load keyless trusted root: %w
• signing_mode %q does not support Sigstore bundle emission
• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w
• summarize Fulcio certificate: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/387d914717fb3ff5. Report an issue: GitHub.