hashicorp/packer · error

decode envelope signature: %w

Error message

decode envelope signature: %w

What it means

DecodeEnvelopeSignature base64-decodes the Sig field of an envelope signature. Packer wraps the base64 error with this message when signature.Sig is not valid standard base64, indicating a malformed signature component in the DSSE envelope.

Source

Thrown at internal/attestation/dsse.go:63

		envelope.Signatures[0].Cert = string(signature.CertPEM)
	}

	return envelope
}

func DecodeEnvelopePayload(envelope Envelope) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(envelope.Payload)
	if err != nil {
		return nil, fmt.Errorf("decode envelope payload: %w", err)
	}

	return decoded, nil
}

func DecodeEnvelopeSignature(signature EnvelopeSignature) ([]byte, error) {
	decoded, err := base64.StdEncoding.DecodeString(signature.Sig)
	if err != nil {
		return nil, fmt.Errorf("decode envelope signature: %w", err)
	}

	return decoded, nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Regenerate the envelope/bundle from the signing tool so Sig is freshly produced standard base64
2. Confirm the signature is base64 (not hex or base64url) and re-encode with base64.StdEncoding if needed
3. Check that the bundle matches the envelope — ensureBundleMatchesEnvelope hits this too, so mismatched/transplanted signatures can carry bad data
4. Validate the whole JSON envelope structure and field integrity before verification

func validSigBase64(s string) bool {
	_, err := base64.StdEncoding.DecodeString(s)
	return err == nil && s != ""
}
// before verification, for each signature:
// if !validSigBase64(sig.Sig) { return errors.New("signature is not valid standard base64") }

func hasDecodableSignature(sig EnvelopeSignature) bool {
	_, err := base64.StdEncoding.DecodeString(sig.Sig)
	return err == nil
}

sigBytes, err := DecodeEnvelopeSignature(sig)
if err != nil {
	// signature component corrupt: regenerate bundle/envelope from signer
	return fmt.Errorf("rejecting malformed envelope signature: %w", err)
}

When it happens

Trigger: Calling DecodeEnvelopeSignature with an EnvelopeSignature whose Sig string is invalid standard base64 (bad characters, missing padding, empty); called by VerifyEnvelope and ensureBundleMatchesEnvelope during verification and bundle-consistency checks.

Common situations: A Sigstore bundle or envelope was hand-assembled or edited, the signature was extracted incorrectly (e.g. raw bytes pasted as hex or base64url), or the bundle/envelope pairing is corrupt so signatures don't decode.

Related errors

• decode envelope payload: %w
• signing_mode %q does not support Sigstore bundle emission
• signature verification failed
• verify attestation envelope %q: %w
• read verifier %q: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/86552723e40eb1ce. Report an issue: GitHub.