hashicorp/packer · error

envelope has no signatures

Error message

envelope has no signatures

What it means

Verification error from VerifyEnvelope: the DSSE envelope being checked contains zero signatures, so there is nothing to verify. Usually means the envelope was constructed without signing or was truncated/corrupted.

Source

Thrown at internal/attestation/signer.go:74

	factory, ok := signerFactories[cfg.Mode]
	if !ok {
		return nil, fmt.Errorf("signing_mode %q is not implemented", cfg.Mode)
	}

	return factory(ctx, cfg)
}

func NewVerifier(ctx context.Context, cfg BackendConfig, signer Signer) (Verifier, error) {
	if cfg.VerifierRef != "" {
		return LoadPEMVerifier(cfg.VerifierRef)
	}

	return signer.Verifier(ctx, cfg)
}

func VerifyEnvelope(ctx context.Context, envelope Envelope, verifier Verifier) error {
	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("envelope has no signatures")
	}

	payload, err := DecodeEnvelopePayload(envelope)
	if err != nil {
		return err
	}

	for _, signature := range envelope.Signatures {
		decodedSignature, decodeErr := DecodeEnvelopeSignature(signature)
		if decodeErr != nil {
			return decodeErr
		}

		if verifyErr := verifier.Verify(ctx, envelope.PayloadType, payload, decodedSignature); verifyErr == nil {
			return nil
		}
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Regenerate the attestation with signing enabled so the envelope carries at least one signature
2. Verify you are pointing at the complete, unmodified attestation file

When it happens

Trigger: Thrown at internal/attestation/signer.go:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/45b112763b2d35f1. Report an issue: GitHub.