hashicorp/packer · error

extract DSSE envelope from Sigstore bundle: %w

Error message

extract DSSE envelope from Sigstore bundle: %w

What it means

bundle.Envelope() failed, meaning the bundle could not yield its DSSE envelope. The library throws this because bundle-vs-attestation matching (and DSSE verification) requires the envelope inside the bundle. Most bundles store either a message signature or a DSSE envelope; this fails when the stored media type is not a DSSE envelope or the embedded envelope is malformed.

Source

Thrown at internal/attestation/verify.go:352

	}

	identity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, "", cfg.KeylessIdentity, "")
	if err != nil {
		return fmt.Errorf("build keyless identity policy: %w", err)
	}

	policyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))
	if _, err := verifier.Verify(bundle, policyBuilder); err != nil {
		return fmt.Errorf("verify Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	return nil
}

func ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {
	bundleEnvelope, err := bundle.Envelope()
	if err != nil {
		return fmt.Errorf("extract DSSE envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")
	}

	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("attestation envelope has no signatures")
	}

	bundleSignature := bundleEnvelope.Signature()
	for i, envelopeSignature := range envelope.Signatures {
		signature, err := DecodeEnvelopeSignature(envelopeSignature)

View on GitHub (pinned to eb36e3c3e4)

Solutions

  1. Generate the bundle from the DSSE attestation (cosign attest --bundle / sigstore attestation flow) so it contains a dsseEnvelope, not a messageSignature
  2. Inspect the bundle JSON: it must have a dsseEnvelope field; if it only has messageSignature, it is the wrong bundle type
  3. Re-download the bundle in case of truncation/corruption

Example fix

// before (binary signature bundle)
packer verify -bundle blob.signature.bundle attestation.intoto.jsonl
// after (DSSE attestation bundle)
packer verify -bundle attestation.intoto.dsse.bundle attestation.intoto.jsonl
Defensive patterns

Strategy: validation

Validate before calling

var probe struct {
    DSSEEnvelope json.RawMessage `json:"dsseEnvelope"`
}
b, _ := os.ReadFile(bundlePath)
if err := json.Unmarshal(b, &probe); err != nil || len(probe.DSSEEnvelope) == 0 {
    return fmt.Errorf("bundle %q has no dsseEnvelope", bundlePath)
}

Try / catch

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "extract DSSE envelope from Sigstore bundle") {
        // wrong bundle type; regenerate as a DSSE attestation bundle
    }
}

Prevention

When it happens

Trigger: ensureBundleMatchesEnvelope is called on a bundle whose media type is a plain message signature (e.g. messageSignature bundle) rather than dsseEnvelope, or whose embedded envelope bytes do not parse as a DSSE envelope.

Common situations: Passing a binary-artifact signature bundle (cosign sign-blob style) where a DSSE attestation bundle is expected; bundle truncated/corrupted so the envelope is unreadable; version mismatch in bundle format.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/9d9eb9b978ddac35. Report an issue: GitHub.