hashicorp/packer · error

load keyless trusted root: %w

Error message

load keyless trusted root: %w

What it means

When cfg.UploadTlog is true, SignBundle needs Sigstore trusted root material (Fulcio CA certs, CT logs, tlog keys) to build the Rekor bundle. loadKeylessTrustedMaterial either fetches the public Sigstore root from the network (sigstoreroot.FetchTrustedRoot) or loads it from cfg.TrustedRootPath; any failure there is wrapped as 'load keyless trusted root'. This is typically a network/offline problem or a missing/invalid trusted-root JSON file.

Source

Thrown at internal/attestation/sign_keyless.go:164

	}, nil
}

func (s *keylessSigner) SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error) {
	content := &sigstoregosign.DSSEData{Data: payload, PayloadType: payloadType}
	options := sigstoregosign.BundleOptions{
		CertificateProvider: staticCertificateProvider{certDER: append([]byte(nil), s.cert.Raw...)},
		Context:             ctx,
	}

	if cfg.UploadTlog {
		rekorURL := strings.TrimSpace(cfg.RekorURL)
		if rekorURL == "" {
			rekorURL = defaultRekorURL
		}

		trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
		if err != nil {
			return Envelope{}, nil, fmt.Errorf("load keyless trusted root: %w", err)
		}

		options.TransparencyLogs = []sigstoregosign.Transparency{newKeylessRekor(rekorURL)}
		options.TrustedRoot = trustedMaterial
	}

	protobufBundle, err := newKeylessBundle(content, s.keypair, options)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("build Sigstore bundle: %w", err)
	}

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. If offline, set cfg.TrustedRootPath (trusted_root_path) to a locally cached trusted-root JSON (obtain via sigstore-go or cosign's trusted-root output) instead of relying on FetchTrustedRoot
2. If online, verify network egress to sigstore.dev TUF/CDN endpoints and any HTTPS proxy CA configuration
3. Validate the file at cfg.TrustedRootPath exists, is readable, and is a valid Sigstore trusted root (JSON with trustedRoot field)
4. If transparency-log upload is not required, set cfg.UploadTlog=false to skip trusted-root loading entirely

Example fix

// before
cfg := BackendConfig{UploadTlog: true} // no TrustedRootPath: needs network
// after
cfg := BackendConfig{UploadTlog: true, TrustedRootPath: "/etc/sigstore/trusted_root.json"}

path := strings.TrimSpace(cfg.TrustedRootPath)
if path == "" {
	// ensure network egress to sigstore TUF endpoints or pre-fetch a local copy
	if err := tryFetchTrustedRoot(context.Background()); err != nil {
		return fmt.Errorf("cannot fetch Sigstore trusted root; set trusted_root_path: %w", err)
	}
} else if _, err := os.Stat(path); err != nil {
	return fmt.Errorf("trusted root file missing: %w", err)
}

envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "load keyless trusted root") {
	cfg.TrustedRootPath = "/etc/sigstore/trusted_root.json" // local fallback
	envelope, bundle, err = signer.SignBundle(ctx, ptype, payload, cfg)
}

When it happens

Trigger: SignBundle called with cfg.UploadTlog=true and either (a) cfg.TrustedRootPath empty and FetchTrustedRoot fails (network unreachable, sigstore.org down, proxy blocks https://tuf-rekor-cdn.sigstore.dev or fulcio/rekor TUF metadata), or (b) TrustedRootPath set and the file does not exist or is not valid trusted-root JSON (internal/attestation/sign_keyless.go:162-164).

Common situations: CI job without internet egress trying to upload to Rekor; corporate proxy/SSL interception breaking TUF fetch; mistyped or stale trusted_root_path pointing at an old/renamed trusted root bundle; air-gapped environment lacking a vendored trusted root.

Related errors

• build Sigstore bundle: %w
• bundle-based Rekor or timestamp verification requires -bundl
• sign attestation with Sigstore bundle: %w
• error retrieving iteration from HCP Packer registry: %s
• signing_mode %q does not support Sigstore bundle emission

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/43bfbea3067bbf2a. Report an issue: GitHub.