hashicorp/packer · error

marshal Sigstore bundle: %w

Error message

marshal Sigstore bundle: %w

What it means

Finally SignBundle serializes the wrapper bundle to JSON via bundleWrapper.MarshalJSON() so the raw Sigstore bundle bytes can be returned alongside the Envelope; any marshaling failure is wrapped as 'marshal Sigstore bundle'. The bundle was already decoded successfully, so this almost certainly indicates a protobuf/JSON marshaling bug or an inconsistent bundle (e.g. unmarshalable field) from an upstream library version.

Source

Thrown at internal/attestation/sign_keyless.go:193

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("extract envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return Envelope{}, nil, fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	bundleJSON, err := bundleWrapper.MarshalJSON()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("marshal Sigstore bundle: %w", err)
	}

	envelope := Envelope{
		PayloadType: rawEnvelope.PayloadType,
		Payload:     rawEnvelope.Payload,
		Signatures: []EnvelopeSignature{{
			KeyID: s.keyID,
			Sig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),
			Cert:  string(s.certPEM),
		}},
	}

	return envelope, bundleJSON, nil
}

func (s *keylessSigner) Verifier(ctx context.Context, cfg BackendConfig) (Verifier, error) {
	return newKeylessVerifier(cfg, s.cert)
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Upgrade sigstore-go (and google.golang.org/protobuf) to consistent latest versions and retry
2. Retry the signing flow; if deterministic, file against sigstore-go with the wrapped inner error
3. As a workaround for consumers needing only the Envelope, tolerate bundleJSON failure if your pipeline does not consume the raw bundle

envelope, bundleJSON, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "marshal Sigstore bundle") {
	// envelope may still be usable upstream; report and continue if raw bundle not needed
	log.Printf("bundle JSON marshal failed: %v", err)
}

When it happens

Trigger: SignBundle calls bundleWrapper.MarshalJSON() at internal/attestation/sign_keyless.go:191-193; fails only if the valid bundle contains a field that cannot be marshaled (upstream bug/version mismatch).

Common situations: sigstore-go regression in MarshalJSON; bundle containing a message-signature variant without JSON representation; dependency skew between protobuf and sigstore-go versions.

Related errors

• decode Sigstore bundle: %w
• extract envelope from Sigstore bundle: %w
• sigstore bundle does not contain a DSSE envelope
• signing_mode %q does not support Sigstore bundle emission
• create keyless verifier: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/e5f80bab175ae3a0. Report an issue: GitHub.