hashicorp/packer · error

initialize KMS signer %q: %w%s

Error message

initialize KMS signer %q: %w%s

What it means

After validating SignerRef, newKMSSigner calls sigstore's kms.Get (via newKMSSignerVerifier) to construct a SignerVerifier for the given key resource ID. This variant of the error is returned when that call fails AND errors.As matched a *sigstorekms.ProviderNotFoundError — meaning the key URI's scheme (awskms, gcpkms, azurekms, hashivault) has no provider registered, typically because the binary was built with the 'kms_cherrypick' build tag and that provider was not opted in. The error appends kmsProviderBuildHint, which names the build tag needed to compile the provider in.

Source

Thrown at internal/attestation/sign_kms.go:41

	RegisterSigner(SigningModeKMS, newKMSSigner)
}

type kmsSigner struct {
	signerVerifier sigstorekms.SignerVerifier
	verifier       Verifier
	keyID          string
}

func newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {
	if cfg.SignerRef == "" {
		return nil, fmt.Errorf("signing_mode %q requires signer or key", SigningModeKMS)
	}

	signerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)
	if err != nil {
		var notFound *sigstorekms.ProviderNotFoundError
		if errors.As(err, &notFound) {
			return nil, fmt.Errorf("initialize KMS signer %q: %w%s", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))
		}
		return nil, fmt.Errorf("initialize KMS signer %q: %w", cfg.SignerRef, err)
	}

	publicKey, err := signerVerifier.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("load KMS public key %q: %w", cfg.SignerRef, err)
	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("create KMS verifier %q: %w", cfg.SignerRef, err)
	}

	return &kmsSigner{
		signerVerifier: signerVerifier,
		verifier:       verifier,
		keyID:          verifier.KeyID(),

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Rebuild the binary without the "kms_cherrypick" tag so all KMS providers are compiled in.
2. Rebuild with the specific provider tag: go build -tags 'kms_cherrypick kms_aws' (map: awskms→kms_aws, gcpkms→kms_gcp, azurekms→kms_azure, hashivault→kms_hashivault — the hint appended to the error tells you which).
3. Verify which binary is actually on PATH in the failing environment; an old slim build may be deployed.
4. Or switch the configured key to a provider that is compiled into your current build.

Example fix

// before
go build -tags kms_cherrypick -o bin/tool .
// after
go build -tags 'kms_cherrypick kms_aws' -o bin/tool .

scheme := ref[:strings.Index(ref, "://")]
switch scheme {
case "awskms", "gcpkms", "azurekms", "hashivault":
	// ensure the binary was built with the matching kms_* tag (or without kms_cherrypick)
}

var pnfe *sigstorekms.ProviderNotFoundError
if errors.As(err, &pnfe) {
	// provider missing from build: rebuild with -tags kms_cherrypick kms_<provider>
}

signer, err := attestation.NewSigner(ctx, cfg)
if err != nil {
	var pnfe *sigstorekms.ProviderNotFoundError
	if errors.As(err, &pnfe) {
		return fmt.Errorf("KMS provider not in this build; rebuild without kms_cherrypick or with matching kms_* tag: %w", err)
	}
	return err
}

When it happens

Trigger: Calling signing_mode "kms" with a recognized scheme URI (e.g. awskms://alias/key, hashivault://...) while the running binary lacks that KMS provider — usually a build with `-tags 'kms_cherrypick'` that omitted e.g. kms_aws, so sigstorekms.Get returns ProviderNotFoundError.

Common situations: Using a slim/custom build of the tool with kms_cherrypick to reduce binary size, then deploying it where a different cloud's KMS key is configured; CI builds one binary for multiple clouds; upgrading and switching key providers (e.g. AWS to Vault) without rebuilding with the right tags.

Related errors

• initialize KMS signer %q: %w
• build keyless identity policy: %w
• signing_mode %q requires keyless_identity and keyless_oidc_i
• load KMS public key %q: %w
• signing_mode %q requires a recognized KMS or Vault URI: awsk

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/eef39bbc5209ee8e. Report an issue: GitHub.