hashicorp/packer · error

initialize KMS signer

Error message

initialize KMS signer %q: %w%s

What it means

After validating SignerRef, newKMSSigner calls sigstore's kms.Get (via newKMSSignerVerifier) to construct a SignerVerifier for the given key resource ID. This variant of the error is returned when that call fails AND errors.As matched a *sigstorekms.ProviderNotFoundError — meaning the key URI's scheme (awskms, gcpkms, azurekms, hashivault) has no provider registered, typically because the binary was built with the 'kms_cherrypick' build tag and that provider was not opted in. The error appends kmsProviderBuildHint, which names the build tag needed to compile the provider in.

Solutions

  1. Rebuild the binary without the "kms_cherrypick" tag so all KMS providers are compiled in.
  2. Rebuild with the specific provider tag: go build -tags 'kms_cherrypick kms_aws' (map: awskms→kms_aws, gcpkms→kms_gcp, azurekms→kms_azure, hashivault→kms_hashivault — the hint appended to the error tells you which).
  3. Verify which binary is actually on PATH in the failing environment; an old slim build may be deployed.
  4. Or switch the configured key to a provider that is compiled into your current build.

Example fix

// before
go build -tags kms_cherrypick -o bin/tool .
// after
go build -tags 'kms_cherrypick kms_aws' -o bin/tool .
Defensive patterns

Strategy: type-guard

Validate before calling

scheme := ref[:strings.Index(ref, "://")]
switch scheme {
case "awskms", "gcpkms", "azurekms", "hashivault":
	// ensure the binary was built with the matching kms_* tag (or without kms_cherrypick)
}

Type guard

var pnfe *sigstorekms.ProviderNotFoundError
if errors.As(err, &pnfe) {
	// provider missing from build: rebuild with -tags kms_cherrypick kms_<provider>
}

Try / catch

signer, err := attestation.NewSigner(ctx, cfg)
if err != nil {
	var pnfe *sigstorekms.ProviderNotFoundError
	if errors.As(err, &pnfe) {
		return fmt.Errorf("KMS provider not in this build; rebuild without kms_cherrypick or with matching kms_* tag: %w", err)
	}
	return err
}

Prevention

When it happens

Trigger: Calling signing_mode "kms" with a recognized scheme URI (e.g. awskms://alias/key, hashivault://...) while the running binary lacks that KMS provider — usually a build with `-tags 'kms_cherrypick'` that omitted e.g. kms_aws, so sigstorekms.Get returns ProviderNotFoundError.

Common situations: Using a slim/custom build of the tool with kms_cherrypick to reduce binary size, then deploying it where a different cloud's KMS key is configured; CI builds one binary for multiple clouds; upgrading and switching key providers (e.g. AWS to Vault) without rebuilding with the right tags.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/eef39bbc5209ee8e. Report an issue: GitHub.

Appendix: source

Thrown at internal/attestation/sign_kms.go:41

	RegisterSigner(SigningModeKMS, newKMSSigner)
}

type kmsSigner struct {
	signerVerifier sigstorekms.SignerVerifier
	verifier       Verifier
	keyID          string
}

func newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {
	if cfg.SignerRef == "" {
		return nil, fmt.Errorf("signing_mode %q requires signer or key", SigningModeKMS)
	}

	signerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)
	if err != nil {
		var notFound *sigstorekms.ProviderNotFoundError
		if errors.As(err, &notFound) {
			return nil, fmt.Errorf("initialize KMS signer %q: %w%s", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))
		}
		return nil, fmt.Errorf("initialize KMS signer %q: %w", cfg.SignerRef, err)
	}

	publicKey, err := signerVerifier.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("load KMS public key %q: %w", cfg.SignerRef, err)
	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("create KMS verifier %q: %w", cfg.SignerRef, err)
	}

	return &kmsSigner{
		signerVerifier: signerVerifier,
		verifier:       verifier,
		keyID:          verifier.KeyID(),

View on GitHub (pinned to eb36e3c3e4)