What causes "decode envelope payload: %w" in hashicorp/packer?

Regenerate the attestation envelope from the trusted producer instead of repairing the payload by hand

decode envelope payload

Error message

decode envelope payload: %w

What it means

DecodeEnvelopePayload base64-decodes the payload field of a DSSE envelope. Packer wraps the base64 error with this message when envelope.Payload is not valid standard base64, meaning the envelope is malformed or truncated rather than merely unverifiable.

Solutions

Regenerate the attestation envelope from the trusted producer instead of repairing the payload by hand
Check the payload encoding: this decoder requires standard base64 (StdEncoding), not base64url — re-encode with StdEncoding if a different alphabet was used
Verify the file wasn't truncated or modified in transit (checksum it against the source)
Inspect the payload string for stray whitespace, quotes, or padding errors before decoding

Defensive patterns

Strategy: validation

Validate before calling

func validBase64(s string) bool {
	_, err := base64.StdEncoding.DecodeString(s)
	return err == nil && s != ""
}
// before verification:
// if !validBase64(envelope.Payload) { return errors.New("envelope payload is not valid standard base64") }

Type guard

func hasDecodablePayload(env Envelope) bool {
	_, err := base64.StdEncoding.DecodeString(env.Payload)
	return err == nil
}

Try / catch

payload, err := DecodeEnvelopePayload(envelope)
if err != nil {
	// treat as corrupted attestation: re-fetch or regenerate the file
	return fmt.Errorf("attestation envelope corrupted, regenerate it: %w", err)
}

Prevention

Never hand-edit attestation files; always generate them via the signing tool
Verify checksums of attestation files after download/transfer
Ensure payloads are standard base64, not base64url or raw bytes
Validate envelope JSON schema before passing to verification

When it happens

Trigger: Calling DecodeEnvelopePayload with an Envelope whose Payload string contains invalid standard-base64 characters, wrong padding, or is empty/corrupted; called by VerifyEnvelope and VerifyAttestationFile during attestation verification.

Common situations: An attestation file was hand-edited, truncated by a failed download, produced by a tool that uses base64url or raw (non-base64) payloads, or copied with whitespace/line-wrapping introduced.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/db1e079b1ab79593. Report an issue: GitHub.

Appendix: source

Thrown at internal/attestation/dsse.go:54

		PayloadType: payloadType,
		Payload:     base64.StdEncoding.EncodeToString(payload),
		Signatures: []EnvelopeSignature{{
			KeyID: signature.KeyID,
			Sig:   base64.StdEncoding.EncodeToString(signature.Sig),
		}},
	}

	if len(signature.CertPEM) > 0 {
		envelope.Signatures[0].Cert = string(signature.CertPEM)
	}

	return envelope
}

func DecodeEnvelopePayload(envelope Envelope) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(envelope.Payload)
	if err != nil {
		return nil, fmt.Errorf("decode envelope payload: %w", err)
	}

	return decoded, nil
}

func DecodeEnvelopeSignature(signature EnvelopeSignature) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(signature.Sig)
	if err != nil {
		return nil, fmt.Errorf("decode envelope signature: %w", err)
	}

	return decoded, nil
}

View on GitHub (pinned to eb36e3c3e4)