hashicorp/packer · error

load keyless trusted root: %w

Error message

load keyless trusted root: %w

What it means

Keyless bundle verification first loads trusted root material (Fulcio CA certificates and Rekor keys/tuf roots) via loadKeylessTrustedMaterial. This error wraps any failure of that loading step — unreadable custom root files, invalid PEM, or failures building the sigstore trust material from embedded/embedded TUF data.

Source

Thrown at internal/attestation/verify.go:295

	return policy.RequireTransparencyLog || policy.RequireObserverTimestamp
}

func verifySigstoreBundleEvidenceImpl(envelope Envelope, cfg BackendConfig, policy VerificationPolicy) error {
	if strings.TrimSpace(policy.SigstoreBundlePath) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires -bundle")
	}

	if normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {
		return fmt.Errorf("bundle-based Rekor or timestamp verification currently requires a keyless attestation")
	}

	if strings.TrimSpace(cfg.KeylessIdentity) == "" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer")
	}

	trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
	if err != nil {
		return fmt.Errorf("load keyless trusted root: %w", err)
	}

	bundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)
	if err != nil {
		return fmt.Errorf("load Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	if err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {
		return err
	}

	verifierOptions := []sigstoreverify.VerifierOption{}
	if policy.RequireTransparencyLog {
		verifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))
	}
	if policy.RequireObserverTimestamp {
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped error for the root cause (missing file, bad PEM, TUF failure) and fix that underlying problem.
2. Verify any custom root/certificate paths in BackendConfig point to readable, valid PEM Fulcio/CTFE/Rekor keys.
3. Refresh embedded TUF root material or supply an explicit trusted root appropriate for your Sigstore deployment.
4. Check filesystem permissions and that the process can read the trust files.

Example fix

// before
cfg.TrustedRootPath = "/etc/sigstore/root.pem" // file missing
// after
cfg.TrustedRootPath = "./keys/sigstore_root.pem" // valid, readable PEM root

if cfg.TrustedRootPath != "" {
	if _, err := os.ReadFile(cfg.TrustedRootPath); err != nil {
		return fmt.Errorf("trusted root unreadable before verification: %w", err)
	}
}

err := VerifyAttestation(...)
if err != nil && strings.HasPrefix(err.Error(), "load keyless trusted root:") {
	// inspect wrapped cause: refresh root files, fix PEM, or check permissions
	return fmt.Errorf("sigstore trust setup failed: %w", err)
}

When it happens

Trigger: verifySigstoreBundleEvidenceImpl with keyless config where the custom root/key paths (or default embedded trust material) cannot be read or parsed — e.g. missing root CA file, wrong PEM type, corrupted TUF metadata.

Common situations: Pointing cfg at a custom Sigstore root that was exported incorrectly; air-gapped environments without the embedded TUF targets; expired or rotated trust roots; file permission problems on the root certificate path.

Related errors

• create Sigstore bundle verifier: %w
• signing_mode %q does not support Sigstore bundle emission
• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w
• summarize Fulcio certificate: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/c882dcd28f7babe4. Report an issue: GitHub.