hashicorp/packer · error

load verifier

Error message

load verifier %q: %w

What it means

LoadPEMVerifier read the file successfully but loadPEMPublicKey could not interpret its contents as a supported PEM verifier (public key, certificate, or private key). The inner error is wrapped with %w, so errors.As/Unwrap reveals whether it was 'no PEM block found' or 'unsupported PEM verifier data'. The file content, not access, is the problem.

Solutions

1. Open the file and confirm it starts with '-----BEGIN PUBLIC KEY-----', '-----BEGIN CERTIFICATE-----', or a private-key block.
2. Regenerate or re-export the public key, e.g. 'openssl rsa -in key.pem -pubout > verifier.pem'.
3. Check the wrapped cause: errors.Is/As for 'no PEM block found' vs 'unsupported PEM verifier data' to decide between formatting and key-type fixes.
4. Use LoadPEMVerifierBytes in tests to validate the exact byte content before deploying the file.

Example fix

// before
v, err := attestation.LoadPEMVerifier("request.csr") // unsupported PEM verifier data
// after
v, err := attestation.LoadPEMVerifier("verifier-public.pem") // BEGIN PUBLIC KEY / CERTIFICATE

raw, err := os.ReadFile(path)
if err != nil {
	return err
}
block, _ := pem.Decode(raw)
if block == nil {
	return fmt.Errorf("%s: not PEM armored", path)
}
switch block.Type {
case "PUBLIC KEY", "CERTIFICATE", "RSA PUBLIC KEY", "EC PUBLIC KEY", "PRIVATE KEY", "RSA PRIVATE KEY", "EC PRIVATE KEY":
	// acceptable verifier inputs
default:
	return fmt.Errorf("%s: unsupported PEM block type %q", path, block.Type)
}

v, err := attestation.LoadPEMVerifier(path)
if err != nil {
	var inner error = err
	for errors.Unwrap(inner) != nil {
		inner = errors.Unwrap(inner)
	}
	switch {
	case strings.Contains(inner.Error(), "no PEM block found"):
		return fmt.Errorf("%s is not PEM armored; export the key with openssl -pubout", path)
	case strings.Contains(inner.Error(), "unsupported PEM verifier data"):
		return fmt.Errorf("%s is not a public key, certificate, or supported private key", path)
	}
	return err
}

When it happens

Trigger: Calling LoadPEMVerifier(path) on a file that contains no PEM at all (raw DER, text, empty), a corrupted/truncated PEM block, or a PEM block whose DER payload is not a PKIX public key, X.509 certificate, or parseable private key.

Common situations: Pointing the verifier at a CSR, a CRL, a PKCS#12 blob, or a signature file instead of a public key/cert; base64 output pasted without the BEGIN/END lines; file corrupted by a bad copy-paste or partial download; passing a private key encrypted with an unsupported format.

Related errors

• decode keyless certificate: no PEM block found
• parse keyless certificate
• no PEM block found
• read verifier
• unsupported PEM verifier data

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/fe0e721c3ada51f5. Report an issue: GitHub.

Appendix: source

Thrown at internal/attestation/sign_key.go:112

		return nil
	default:
		return fmt.Errorf("unsupported public key type %T", v.publicKey)
	}
}

func (v *pemVerifier) KeyID() string {
	return v.keyID
}

func LoadPEMVerifier(path string) (Verifier, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read verifier %q: %w", path, err)
	}

	publicKey, rawVerifier, err := loadPEMPublicKey(contents)
	if err != nil {
		return nil, fmt.Errorf("load verifier %q: %w", path, err)
	}

	return &pemVerifier{
		publicKey: publicKey,
		keyID:     sha256Hex(rawVerifier),
	}, nil
}

func LoadPEMVerifierBytes(contents []byte) (*pemVerifier, error) {
	publicKey, rawVerifier, err := loadPEMPublicKey(contents)
	if err != nil {
		return nil, err
	}

	return &pemVerifier{
		publicKey: publicKey,
		keyID:     sha256Hex(rawVerifier),
	}, nil

View on GitHub (pinned to eb36e3c3e4)