hashicorp/packer · error

decode Sigstore bundle: %w

Error message

decode Sigstore bundle: %w

What it means

After sigstoregosign.Bundle produces a protobuf bundle, it is wrapped via sigstorebundle.NewBundle to get the typed bundle API; failure here means the generated protobuf bundle could not be validated/decoded into the sigstore-go bundle type. Given the bundle was just constructed locally, this indicates a library-version mismatch or malformed bundle content (e.g. missing verification material) rather than user configuration.

Source

Thrown at internal/attestation/sign_keyless.go:178

		}

		trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
		if err != nil {
			return Envelope{}, nil, fmt.Errorf("load keyless trusted root: %w", err)
		}

		options.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}
		options.TrustedRoot = trustedMaterial
	}

	protobufBundle, err := newKeylessBundle(content, s.keypair, options)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("build Sigstore bundle: %w", err)
	}

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("extract envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return Envelope{}, nil, fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	bundleJSON, err := bundleWrapper.MarshalJSON()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("marshal Sigstore bundle: %w", err)
	}

	envelope := Envelope{

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Run go mod tidy / go mod verify to ensure a single consistent sigstore-go version in the build
2. Upgrade sigstore-go to the latest patch release and retry
3. Retry the operation to rule out nondeterministic construction issues
4. If in a test with a stubbed newKeylessBundle, make the stub return a fully valid protobuf bundle

Example fix

// before
require github.com/sigstore/sigstore-go v0.x.0 // stale, mismatched helpers
// after
go get github.com/sigstore/sigstore-go@latest && go mod tidy

// keep a single consistent sigstore-go version
out, err := exec.Command("go", "mod", "verify").CombinedOutput()
if err != nil || strings.Contains(string(out), "FAILED") {
	return fmt.Errorf("module verification failed: %s", out)
}

envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "decode Sigstore bundle") {
	return fmt.Errorf("library inconsistency producing invalid bundle; upgrade sigstore-go: %w", err)
}

When it happens

Trigger: SignBundle calls sigstorebundle.NewBundle(protobufBundle) at internal/attestation/sign_keyless.go:176-178 immediately after successful bundle construction; fails if the protobuf bundle is invalid per sigstore-go's decoder (rare; typically only with mismatched sigstore-go package versions or an upstream bug).

Common situations: Mixed sigstore-go module versions (vendor/replace or go.mod mismatch between protoutil/sign packages); a mocked newKeylessBundle in tests returning an incomplete bundle; upstream sigstore-go regression.

Related errors

• extract envelope from Sigstore bundle: %w
• sigstore bundle does not contain a DSSE envelope
• marshal Sigstore bundle: %w
• signing_mode %q does not support Sigstore bundle emission
• create keyless verifier: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9d1c91709defee77. Report an issue: GitHub.