hashicorp/packer · error

decode envelope payload: %w

Error message

decode envelope payload: %w

What it means

DecodeEnvelopePayload base64-decodes the payload field of a DSSE envelope. Packer wraps the base64 error with this message when envelope.Payload is not valid standard base64, meaning the envelope is malformed or truncated rather than merely unverifiable.

Source

Thrown at internal/attestation/dsse.go:54

		PayloadType: payloadType,
		Payload:     base64.StdEncoding.EncodeToString(payload),
		Signatures: []EnvelopeSignature{{
			KeyID: signature.KeyID,
			Sig:   base64.StdEncoding.EncodeToString(signature.Sig),
		}},
	}

	if len(signature.CertPEM) > 0 {
		envelope.Signatures[0].Cert = string(signature.CertPEM)
	}

	return envelope
}

func DecodeEnvelopePayload(envelope Envelope) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(envelope.Payload)
	if err != nil {
		return nil, fmt.Errorf("decode envelope payload: %w", err)
	}

	return decoded, nil
}

func DecodeEnvelopeSignature(signature EnvelopeSignature) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(signature.Sig)
	if err != nil {
		return nil, fmt.Errorf("decode envelope signature: %w", err)
	}

	return decoded, nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Regenerate the attestation envelope from the trusted producer instead of repairing the payload by hand
2. Check the payload encoding: this decoder requires standard base64 (StdEncoding), not base64url — re-encode with StdEncoding if a different alphabet was used
3. Verify the file wasn't truncated or modified in transit (checksum it against the source)
4. Inspect the payload string for stray whitespace, quotes, or padding errors before decoding

func validBase64(s string) bool {
	_, err := base64.StdEncoding.DecodeString(s)
	return err == nil && s != ""
}
// before verification:
// if !validBase64(envelope.Payload) { return errors.New("envelope payload is not valid standard base64") }

func hasDecodablePayload(env Envelope) bool {
	_, err := base64.StdEncoding.DecodeString(env.Payload)
	return err == nil
}

payload, err := DecodeEnvelopePayload(envelope)
if err != nil {
	// treat as corrupted attestation: re-fetch or regenerate the file
	return fmt.Errorf("attestation envelope corrupted, regenerate it: %w", err)
}

When it happens

Trigger: Calling DecodeEnvelopePayload with an Envelope whose Payload string contains invalid standard-base64 characters, wrong padding, or is empty/corrupted; called by VerifyEnvelope and VerifyAttestationFile during attestation verification.

Common situations: An attestation file was hand-edited, truncated by a failed download, produced by a tool that uses base64url or raw (non-base64) payloads, or copied with whitespace/line-wrapping introduced.

Related errors

• decode envelope signature: %w
• signing_mode %q does not support Sigstore bundle emission
• read verifier %q: %w
• load verifier %q: %w
• no PEM block found

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/db1e079b1ab79593. Report an issue: GitHub.