hashicorp/packer · error

load verifier %q: %w

Error message

load verifier %q: %w

What it means

LoadPEMVerifier read the file successfully but loadPEMPublicKey could not interpret its contents as a supported PEM verifier (public key, certificate, or private key). The inner error is wrapped with %w, so errors.As/Unwrap reveals whether it was 'no PEM block found' or 'unsupported PEM verifier data'. The file content, not access, is the problem.

Source

Thrown at internal/attestation/sign_key.go:112

		return nil
	default:
		return fmt.Errorf("unsupported public key type %T", v.publicKey)
	}
}

func (v *pemVerifier) KeyID() string {
	return v.keyID
}

func LoadPEMVerifier(path string) (Verifier, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return nil, fmt.Errorf("read verifier %q: %w", path, err)
	}

	publicKey, rawVerifier, err := loadPEMPublicKey(contents)
	if err != nil {
		return nil, fmt.Errorf("load verifier %q: %w", path, err)
	}

	return &pemVerifier{
		publicKey: publicKey,
		keyID:     sha256Hex(rawVerifier),
	}, nil
}

func LoadPEMVerifierBytes(contents []byte) (*pemVerifier, error) {
	publicKey, rawVerifier, err := loadPEMPublicKey(contents)
	if err != nil {
		return nil, err
	}

	return &pemVerifier{
		publicKey: publicKey,
		keyID:     sha256Hex(rawVerifier),
	}, nil

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Open the file and confirm it starts with '-----BEGIN PUBLIC KEY-----', '-----BEGIN CERTIFICATE-----', or a private-key block.
2. Regenerate or re-export the public key, e.g. 'openssl rsa -in key.pem -pubout > verifier.pem'.
3. Check the wrapped cause: errors.Is/As for 'no PEM block found' vs 'unsupported PEM verifier data' to decide between formatting and key-type fixes.
4. Use LoadPEMVerifierBytes in tests to validate the exact byte content before deploying the file.

Example fix

// before
v, err := attestation.LoadPEMVerifier("request.csr") // unsupported PEM verifier data
// after
v, err := attestation.LoadPEMVerifier("verifier-public.pem") // BEGIN PUBLIC KEY / CERTIFICATE

raw, err := os.ReadFile(path)
if err != nil {
	return err
}
block, _ := pem.Decode(raw)
if block == nil {
	return fmt.Errorf("%s: not PEM armored", path)
}
switch block.Type {
case "PUBLIC KEY", "CERTIFICATE", "RSA PUBLIC KEY", "EC PUBLIC KEY", "PRIVATE KEY", "RSA PRIVATE KEY", "EC PRIVATE KEY":
	// acceptable verifier inputs
default:
	return fmt.Errorf("%s: unsupported PEM block type %q", path, block.Type)
}

v, err := attestation.LoadPEMVerifier(path)
if err != nil {
	var inner error = err
	for errors.Unwrap(inner) != nil {
		inner = errors.Unwrap(inner)
	}
	switch {
	case strings.Contains(inner.Error(), "no PEM block found"):
		return fmt.Errorf("%s is not PEM armored; export the key with openssl -pubout", path)
	case strings.Contains(inner.Error(), "unsupported PEM verifier data"):
		return fmt.Errorf("%s is not a public key, certificate, or supported private key", path)
	}
	return err
}

When it happens

Trigger: Calling LoadPEMVerifier(path) on a file that contains no PEM at all (raw DER, text, empty), a corrupted/truncated PEM block, or a PEM block whose DER payload is not a PKIX public key, X.509 certificate, or parseable private key.

Common situations: Pointing the verifier at a CSR, a CRL, a PKCS#12 blob, or a signature file instead of a public key/cert; base64 output pasted without the BEGIN/END lines; file corrupted by a bad copy-paste or partial download; passing a private key encrypted with an unsupported format.

Related errors

• decode keyless certificate: no PEM block found
• parse keyless certificate: %w
• read verifier %q: %w
• no PEM block found
• unsupported PEM verifier data

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/fe0e721c3ada51f5. Report an issue: GitHub.