hashicorp/packer · error

marshal signed envelope

Error message

marshal signed envelope: %w

What it means

Once verification succeeds, the signed envelope is serialized with json.MarshalIndent before writing. A marshal failure is wrapped as `marshal signed envelope: %w`. The Envelope struct is a fixed internal type, so this indicates an internal inconsistency rather than user error.

Solutions

1. Check the wrapped json error text for the offending type.
2. Verify the custom signer implementation returns a well-formed internalattestation.Signature if one is configured.
3. Update the provenance plugin/sigstore deps to matched versions.
4. File a bug with the full wrapped error if using stock configuration.

if err := pp.PostProcess(ctx, ui, artifact); err != nil {
    if strings.Contains(err.Error(), "marshal signed envelope") {
        // internal inconsistency: report bug, keep prior attestation artifacts
    }
}

When it happens

Trigger: writeAttestation's envelope ends up containing a value json.MarshalIndent can't encode — practically only via internal type changes or corrupted signature/payload data from a signer.

Common situations: Rare; usually only seen after library upgrades or when a custom signer returns a malformed signature structure.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• marshal artifact identity
• marshal attestation payload
• decode SBOM payload
• Unable to marshal JSON
• artifact is nil

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/90e8bc945bf088b3. Report an issue: GitHub.

Appendix: source

Thrown at post-processor/provenance/post-processor.go:333

		envelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)
		if err != nil {
			return fmt.Errorf("sign attestation with Sigstore bundle: %w", err)
		}
	} else {
		signature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)
		if signErr != nil {
			return fmt.Errorf("sign attestation: %w", signErr)
		}
		envelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)
	}

	if err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {
		return fmt.Errorf("verify signed attestation: %w", err)
	}

	output, err := json.MarshalIndent(envelope, "", "  ")
	if err != nil {
		return fmt.Errorf("marshal signed envelope: %w", err)
	}

	if err := atomicWriteFile(outputPath, output, 0664); err != nil {
		return fmt.Errorf("write attestation %q: %w", outputPath, err)
	}

	if len(bundleJSON) > 0 {
		if err := atomicWriteFile(bundlePath, bundleJSON, 0664); err != nil {
			return fmt.Errorf("write Sigstore bundle %q: %w", bundlePath, err)
		}
		ui.Say(fmt.Sprintf("Wrote Sigstore bundle to %s", bundlePath))
	}

	ui.Say(fmt.Sprintf("Wrote attestation to %s", outputPath))
	return nil
}

func (p *PostProcessor) signingResources(ctx context.Context, backendConfig internalattestation.BackendConfig) (internalattestation.Signer, internalattestation.Verifier, error) {

View on GitHub (pinned to eb36e3c3e4)