hashicorp/packer · error

initialize KMS signer %q: %w

Error message

initialize KMS signer %q: %w

What it means

This is the generic failure path of newKMSSigner when sigstore's kms.Get fails to construct the SignerVerifier for the configured key and the error is NOT a ProviderNotFoundError. It wraps whatever the KMS provider returned (auth failure, nonexistent key, bad URI format, network error, unsupported key algorithm) with the offending key resource ID for context. It is thrown because the signer cannot be built without a working provider handle.

Source

Thrown at internal/attestation/sign_kms.go:43

type kmsSigner struct {
	signerVerifier sigstorekms.SignerVerifier
	verifier       Verifier
	keyID          string
}

func newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {
	if cfg.SignerRef == "" {
		return nil, fmt.Errorf("signing_mode %q requires signer or key", SigningModeKMS)
	}

	signerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)
	if err != nil {
		var notFound *sigstorekms.ProviderNotFoundError
		if errors.As(err, &notFound) {
			return nil, fmt.Errorf("initialize KMS signer %q: %w%s", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))
		}
		return nil, fmt.Errorf("initialize KMS signer %q: %w", cfg.SignerRef, err)
	}

	publicKey, err := signerVerifier.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("load KMS public key %q: %w", cfg.SignerRef, err)
	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("create KMS verifier %q: %w", cfg.SignerRef, err)
	}

	return &kmsSigner{
		signerVerifier: signerVerifier,
		verifier:       verifier,
		keyID:          verifier.KeyID(),
	}, nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped cause in the error message; it names the underlying provider failure (auth, not-found, network, invalid URI).
2. Validate the key resource ID format for your provider (e.g. arn:aws:kms:region:acct:key/... or awskms://alias/name) and confirm the key exists in the KMS console/CLI.
3. Verify credentials are available and authorized: cloud credentials env/instance role, Vault token, or workload identity, plus sign/get-public-key permissions on the key.
4. Test connectivity to the KMS endpoint from the failing environment (proxy/firewall/region settings).
5. If the message ends with a 'provider is not compiled into this build' hint, it is actually the ProviderNotFound case — rebuild with the appropriate build tag.

Example fix

# before
signer = "awskms:///alias/my-key"   # malformed URI -> provider init fails
# after
signer = "awskms://alias/my-key"    # and ensure IAM policy grants kms:Sign

// pre-flight: resolve credentials and key existence before initializing
switch {
case strings.HasPrefix(ref, "awskms://"):
	_, err := kmsClient.DescribeKey(&kms.DescribeKeyInput{KeyId: aws.String(keyIDFromRef(ref))})
case strings.HasPrefix(ref, "hashivault://"):
	_, err := vaultClient.Logical().Read("transit/keys/" + keyNameFromRef(ref))
}
if err != nil { return fmt.Errorf("KMS key %q unavailable before signing: %w", ref, err) }

signer, err := attestation.NewSigner(ctx, cfg)
if err != nil && strings.Contains(err.Error(), "initialize KMS signer") {
	// inspect wrapped cause: auth? not-found? network?
	// retry transient errors, fix credentials/URI for permanent ones
	var retryable bool = isTransient(err) // e.g. net.Error, 5xx
	if retryable { return retryInit(ctx, cfg) }
	return fmt.Errorf("check KMS key URI and credentials: %w", err)
}

When it happens

Trigger: Calling signing_mode "kms" where sigstorekms.Get(ctx, cfg.SignerRef, crypto.SHA256) returns a non-ProviderNotFound error: invalid/malformed key resource ID, credentials missing or denied, key does not exist in the KMS, network/API failure reaching the KMS service.

Common situations: Typo in the key ARN/alias or Vault path; IAM role or workload identity lacks kms:Sign/GetPublicKey permissions; missing cloud credentials in the environment (AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS, Azure login, Vault token); wrong scheme prefix so the URI doesn't match any provider format; key deleted/rotated away between config write and run.

Related errors

• initialize KMS signer %q: %w%s
• build keyless identity policy: %w
• signing_mode %q requires keyless_identity and keyless_oidc_i
• load KMS public key %q: %w
• InvalidClientConfig

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/904bdeb04f7277c7. Report an issue: GitHub.