hashicorp/packer · error

extract envelope from Sigstore bundle: %w

Error message

extract envelope from Sigstore bundle: %w

What it means

The decoded Sigstore bundle should carry the DSSE envelope used for signing; bundleWrapper.Envelope() extracts it and this error wraps any failure. Since the bundle was just built from DSSEData content, failure means sigstore-go could not interpret the bundle's message signature as a DSSE envelope — effectively always an upstream/library or stub inconsistency, not a caller issue.

Source

Thrown at internal/attestation/sign_keyless.go:183

		}

		options.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}
		options.TrustedRoot = trustedMaterial
	}

	protobufBundle, err := newKeylessBundle(content, s.keypair, options)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("build Sigstore bundle: %w", err)
	}

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("extract envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return Envelope{}, nil, fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	bundleJSON, err := bundleWrapper.MarshalJSON()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("marshal Sigstore bundle: %w", err)
	}

	envelope := Envelope{
		PayloadType: rawEnvelope.PayloadType,
		Payload:     rawEnvelope.Payload,
		Signatures: []EnvelopeSignature{{
			KeyID: s.keyID,
			Sig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the sigstore-go version and that DSSEData-based bundle construction is supported; upgrade if needed
2. If a test stub replaces newKeylessBundle, make it produce a bundle containing a DSSE envelope
3. Retry the normal signing path without stubs to confirm the failure is not data-dependent

Example fix

// before (test stub)
newKeylessBundle = func(...) (*pb.Bundle, error) { return &pb.Bundle{}, nil } // no DSSE
// after
newKeylessBundle = sigstoregosign.Bundle // use real constructor in integration path

// ensure DSSE content is used (the library path does this); in tests, assert the stub
if newKeylessBundle != (func(...) (*pb.Bundle, error))(sigstoregosign.Bundle) {
	// custom constructor must produce a DSSE bundle
}

envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "extract envelope from Sigstore bundle") {
	return fmt.Errorf("bundle lacks DSSE envelope; rebuild with real Bundle constructor: %w", err)
}

When it happens

Trigger: SignBundle calls bundleWrapper.Envelope() at internal/attestation/sign_keyless.go:181-183 after NewBundle succeeds; fails when the bundle does not expose a DSSE envelope (e.g. bundle built without DSSE content, unexpected bundle variant, or sigstore-go API mismatch).

Common situations: A stubbed/mocked newKeylessBundle in tests producing a non-DSSE bundle; sigstore-go version where Envelope() semantics changed; manually constructed protobuf bundle missing the DSSE message signature.

Related errors

• sigstore bundle does not contain a DSSE envelope
• signing_mode %q does not support Sigstore bundle emission
• decode Sigstore bundle: %w
• marshal Sigstore bundle: %w
• extract DSSE envelope from Sigstore bundle: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/7a045274ad3b9502. Report an issue: GitHub.