hashicorp/packer · error

load Sigstore bundle %q: %w

Error message

load Sigstore bundle %q: %w

What it means

This error wraps any failure from loadSigstoreBundle() while reading and parsing the Sigstore bundle file passed via policy.SigstoreBundlePath (the -bundle flag). It is thrown because bundle-based Rekor/timestamp verification is impossible without a parseable bundle. The wrapped inner error tells whether it was an I/O failure (missing/unreadable file) or a format/parsing failure.

Source

Thrown at internal/attestation/verify.go:300

		return fmt.Errorf("bundle-based Rekor or timestamp verification requires -bundle")
	}

	if normalizeVerificationMode(cfg, envelope) != SigningModeKeyless && !envelopeHasCertificate(envelope) {
		return fmt.Errorf("bundle-based Rekor or timestamp verification currently requires a keyless attestation")
	}

	if strings.TrimSpace(cfg.KeylessIdentity) == "" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return fmt.Errorf("bundle-based Rekor or timestamp verification requires keyless_identity and keyless_oidc_issuer")
	}

	trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
	if err != nil {
		return fmt.Errorf("load keyless trusted root: %w", err)
	}

	bundle, err := loadSigstoreBundle(policy.SigstoreBundlePath)
	if err != nil {
		return fmt.Errorf("load Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	if err := ensureBundleMatchesEnvelope(bundle, envelope); err != nil {
		return err
	}

	verifierOptions := []sigstoreverify.VerifierOption{}
	if policy.RequireTransparencyLog {
		verifierOptions = append(verifierOptions, sigstoreverify.WithTransparencyLog(1))
	}
	if policy.RequireObserverTimestamp {
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}
	if len(verifierOptions) == 0 {
		// A trusted time source is required to validate the short-lived Fulcio
		// certificate as of signing time; default to observer timestamps when the
		// caller has not explicitly required Rekor or timestamp evidence.
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify the file exists and is readable at the exact path (ls -l, try cat) and use an absolute path
2. Regenerate or re-download the bundle from the publisher/Rekor and confirm it is a valid Sigstore bundle (JSON with messageSignature/dsseEnvelope)
3. Check you are passing the bundle file, not the attestation or artifact file, to -bundle

Example fix

// before
packer verify -bundle ./attestation.json attestation.intoto.jsonl
// after
packer verify -bundle $(pwd)/release.intoto.sigstore attestation.intoto.jsonl

info, err := os.Stat(bundlePath)
if err != nil || info.IsDir() {
    return fmt.Errorf("bundle %q unavailable: %w", bundlePath, err)
}
b, err := os.ReadFile(bundlePath)
if err == nil && !json.Valid(b) {
    return fmt.Errorf("bundle %q is not valid JSON", bundlePath)
}

if err := verify(...); err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) && strings.Contains(err.Error(), "load Sigstore bundle") {
        // prompt for correct -bundle path
    }
}

When it happens

Trigger: verifySigstoreBundleEvidenceImpl is called with a non-empty SigstoreBundlePath, but loadSigstoreBundle fails: the file does not exist, is unreadable (permissions), is empty, or is not a valid Sigstore bundle (bad JSON/protobuf, wrong media type).

Common situations: Typo in the -bundle path; running from a different working directory with a relative path; downloading an incomplete or truncated bundle; passing an attestation or signature file instead of a .sigstore bundle; bundle produced by a newer sigstore-go format than the parser supports.

Related errors

• build Sigstore bundle: %w
• decode Sigstore bundle: %w
• extract envelope from Sigstore bundle: %w
• sigstore bundle does not contain a DSSE envelope
• marshal Sigstore bundle: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/81207ab022004577. Report an issue: GitHub.