hashicorp/packer · error

load sigstore verifier: %w

Error message

load sigstore verifier: %w

What it means

Initialization error from newSigstoreVerifierFromPublicKey: sigstore's LoadDefaultVerifier rejected the supplied public key — usually because the key type or algorithm is not supported by the default verifier (e.g. an ed25519 or unusual curve from the KMS backend).

Source

Thrown at internal/attestation/sign_kms.go:110

// built with "kms_cherrypick" and did not opt that provider in.
func kmsProviderBuildHint(ref string) string {
	scheme := ref
	if idx := strings.Index(ref, "://"); idx >= 0 {
		scheme = ref[:idx]
	}

	tag, ok := kmsProviderBuildTags[scheme]
	if !ok {
		return ""
	}

	return fmt.Sprintf("; the %s KMS provider is not compiled into this build (rebuild without \"kms_cherrypick\", or with -tags 'kms_cherrypick %s')", scheme, tag)
}

func newSigstoreVerifierFromPublicKey(publicKey crypto.PublicKey) (Verifier, error) {
	verifier, err := sigstoresignature.LoadDefaultVerifier(publicKey)
	if err != nil {
		return nil, fmt.Errorf("load sigstore verifier: %w", err)
	}

	publicKeyPEM, err := marshalPublicKeyPEM(publicKey)
	if err != nil {
		return nil, err
	}

	return &sigstoreVerifier{
		verifier: verifier,
		keyID:    sha256Hex(publicKeyPEM),
	}, nil
}

type sigstoreVerifier struct {
	verifier sigstoresignature.Verifier
	keyID    string
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Use a signing key with an algorithm supported by sigstore (RSA, ECDSA P-256/384)
2. Point the `verifier` config at a PEM public key file compatible with sigstore instead of deriving it from the KMS key

When it happens

Trigger: Thrown at internal/attestation/sign_kms.go:110 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/b5eb4d0bdec92d1f. Report an issue: GitHub.