hashicorp/packer · error

generate ephemeral keypair: %w

Error message

generate ephemeral keypair: %w

What it means

This error wraps a failure from sigstoregosign.NewEphemeralKeypair, which generates the short-lived ECDSA keypair used for keyless signing before requesting a Fulcio certificate. The library throws it when local key generation fails, typically because the system's crypto/rand entropy source is unavailable or the underlying crypto operation fails. This is rare and indicates a host-level crypto environment problem rather than a configuration issue.

Source

Thrown at internal/attestation/sign_keyless.go:107

	cert     *x509.Certificate
	verifier Verifier
	keyID    string
}

func newKeylessSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {
	fulcioURL := strings.TrimSpace(cfg.FulcioURL)
	if fulcioURL == "" {
		fulcioURL = defaultFulcioURL
	}

	idToken, err := resolveAmbientIDToken(ctx, cfg.Env)
	if err != nil {
		return nil, err
	}

	keypair, err := newKeylessEphemeralKeypair()
	if err != nil {
		return nil, fmt.Errorf("generate ephemeral keypair: %w", err)
	}

	fulcio := newKeylessFulcio(fulcioURL)
	certDER, err := fulcio.GetCertificate(ctx, keypair, &sigstoregosign.CertificateProviderOptions{IDToken: idToken})
	if err != nil {
		return nil, fmt.Errorf("request Fulcio certificate: %w", err)
	}

	certificate, err := x509.ParseCertificate(certDER)
	if err != nil {
		return nil, fmt.Errorf("parse Fulcio certificate: %w", err)
	}

	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
	verifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("create keyless verifier: %w", err)
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check that the host's entropy source is available (test with `head -c 16 /dev/urandom` or a small Go program calling crypto/rand).
2. Fix container/sandbox security policies (seccomp/apparmor) to allow getrandom(2) or access to /dev/urandom.
3. Retry the run; transient RNG failures are rare but possible.
4. If persistent, check the Go runtime version for known crypto/rand issues and upgrade.

signer, err := newKeylessSigner(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "generate ephemeral keypair") {
    // verify host entropy source, then retry once
}

When it happens

Trigger: newKeylessSigner (internal/attestation/sign_keyless.go:105-108) calls newKeylessEphemeralKeypair during keyless signing setup; error surfaces when crypto/rand reads fail or the elliptic key generation errors in the sigstore-go SDK.

Common situations: Running in a sandbox/container with a blocked or unseeded /dev/urandom; restricted seccomp policies blocking getrandom; heavily constrained environments where the RNG device is unavailable.

Related errors

• sign payload: %w
• ECDSA verification failed
• Ed25519 verification failed
• signer %q does not implement crypto.Signer
• unsupported private key in signer %q

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/a34f37de0c7be58d. Report an issue: GitHub.