hashicorp/packer · error

decode attestation envelope signature %d: %w

Error message

decode attestation envelope signature %d: %w

What it means

DecodeEnvelopeSignature failed for signature at index i of the attestation envelope, so that signature cannot be compared with the bundle's signature. Thrown to identify exactly which envelope signature entry is malformed, wrapping the decoding error.

Source

Thrown at internal/attestation/verify.go:372

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")
	}

	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("attestation envelope has no signatures")
	}

	bundleSignature := bundleEnvelope.Signature()
	for i, envelopeSignature := range envelope.Signatures {
		signature, err := DecodeEnvelopeSignature(envelopeSignature)
		if err != nil {
			return fmt.Errorf("decode attestation envelope signature %d: %w", i, err)
		}

		if bytes.Equal(bundleSignature, signature) {
			return nil
		}
	}

	return fmt.Errorf("sigstore bundle signature does not match any attestation signature")
}

func verifyArtifactSubject(subjects []internalprovenance.Subject, artifactPath string) error {
	digest, err := sha256File(artifactPath)
	if err != nil {
		return fmt.Errorf("hash artifact %q: %w", artifactPath, err)
	}

	artifactName := filepath.Base(artifactPath)
	for _, subject := range subjects {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Inspect envelope.Signatures[i] and fix its encoding (valid base64, non-empty sig) or regenerate the attestation with the signing tool
2. Align signing and verification tool versions so signature encoding matches what DecodeEnvelopeSignature expects
3. Decode the signature yourself (base64.StdEncoding.DecodeString) to see the precise failure before re-running

for i, s := range envelope.Signatures {
    if _, err := DecodeEnvelopeSignature(s); err != nil {
        return fmt.Errorf("signature %d invalid before verification: %w", i, err)
    }
}

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "decode attestation envelope signature") {
        // inspect the indexed signature entry and fix encoding or regenerate
    }
}

When it happens

Trigger: ensureBundleMatchesEnvelope iterates envelope.Signatures and DecodeEnvelopeSignature rejects entry i — e.g. invalid base64 sig, empty keyid/sig fields, or unsupported signature encoding.

Common situations: Attestation produced by a tool writing signatures in a different encoding; corrupted/truncated signatures array; manually edited envelope; mixed tool versions where DecodeEnvelopeSignature expects a stricter format.

Related errors

• decode envelope payload: %w
• decode envelope signature: %w
• signature verification failed
• verify attestation envelope %q: %w
• signing_mode %q does not support Sigstore bundle emission

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/8bdcd5cd29113377. Report an issue: GitHub.