hashicorp/packer · error

marshal signed envelope: %w

Error message

marshal signed envelope: %w

What it means

Once verification succeeds, the signed envelope is serialized with json.MarshalIndent before writing. A marshal failure is wrapped as `marshal signed envelope: %w`. The Envelope struct is a fixed internal type, so this indicates an internal inconsistency rather than user error.

Source

Thrown at post-processor/provenance/post-processor.go:333

		envelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)
		if err != nil {
			return fmt.Errorf("sign attestation with Sigstore bundle: %w", err)
		}
	} else {
		signature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)
		if signErr != nil {
			return fmt.Errorf("sign attestation: %w", signErr)
		}
		envelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)
	}

	if err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {
		return fmt.Errorf("verify signed attestation: %w", err)
	}

	output, err := json.MarshalIndent(envelope, "", "  ")
	if err != nil {
		return fmt.Errorf("marshal signed envelope: %w", err)
	}

	if err := atomicWriteFile(outputPath, output, 0664); err != nil {
		return fmt.Errorf("write attestation %q: %w", outputPath, err)
	}

	if len(bundleJSON) > 0 {
		if err := atomicWriteFile(bundlePath, bundleJSON, 0664); err != nil {
			return fmt.Errorf("write Sigstore bundle %q: %w", bundlePath, err)
		}
		ui.Say(fmt.Sprintf("Wrote Sigstore bundle to %s", bundlePath))
	}

	ui.Say(fmt.Sprintf("Wrote attestation to %s", outputPath))
	return nil
}

func (p *PostProcessor) signingResources(ctx context.Context, backendConfig internalattestation.BackendConfig) (internalattestation.Signer, internalattestation.Verifier, error) {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check the wrapped json error text for the offending type.
2. Verify the custom signer implementation returns a well-formed internalattestation.Signature if one is configured.
3. Update the provenance plugin/sigstore deps to matched versions.
4. File a bug with the full wrapped error if using stock configuration.

if err := pp.PostProcess(ctx, ui, artifact); err != nil {
    if strings.Contains(err.Error(), "marshal signed envelope") {
        // internal inconsistency: report bug, keep prior attestation artifacts
    }
}

When it happens

Trigger: writeAttestation's envelope ends up containing a value json.MarshalIndent can't encode — practically only via internal type changes or corrupted signature/payload data from a signer.

Common situations: Rare; usually only seen after library upgrades or when a custom signer returns a malformed signature structure.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• marshal artifact identity: %w
• marshal attestation payload: %w
• Unable to marshal JSON %s
• decode SBOM payload: %w
• marshal Sigstore bundle: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/90e8bc945bf088b3. Report an issue: GitHub.