hashicorp/packer · error

open artifact %q for bundle verification: %w

Error message

open artifact %q for bundle verification: %w

What it means

os.Open failed on policy.ArtifactPath when the user supplied an artifact for bundle verification, so the artifact-digest check cannot be performed. This error is only thrown when ArtifactPath is non-empty. The wrapped error distinguishes not-found vs permission vs is-a-directory.

Source

Thrown at internal/attestation/verify.go:330

		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}
	if len(verifierOptions) == 0 {
		// A trusted time source is required to validate the short-lived Fulcio
		// certificate as of signing time; default to observer timestamps when the
		// caller has not explicitly required Rekor or timestamp evidence.
		verifierOptions = append(verifierOptions, sigstoreverify.WithObserverTimestamps(1))
	}

	verifier, err := newSigstoreBundleVerifier(trustedMaterial, verifierOptions...)
	if err != nil {
		return fmt.Errorf("create Sigstore bundle verifier: %w", err)
	}

	artifactPolicy := sigstoreverify.WithoutArtifactUnsafe()
	if policy.ArtifactPath != "" {
		artifact, err := os.Open(policy.ArtifactPath)
		if err != nil {
			return fmt.Errorf("open artifact %q for bundle verification: %w", policy.ArtifactPath, err)
		}
		defer func() { _ = artifact.Close() }()
		artifactPolicy = sigstoreverify.WithArtifact(artifact)
	}

	identity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, "", cfg.KeylessIdentity, "")
	if err != nil {
		return fmt.Errorf("build keyless identity policy: %w", err)
	}

	policyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))
	if _, err := verifier.Verify(bundle, policyBuilder); err != nil {
		return fmt.Errorf("verify Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	return nil
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check the artifact path exists and is a regular file (ls -l) and switch to an absolute path
2. Re-download or rebuild the artifact if it was moved or deleted
3. Verify permissions allow reading by the current user

Example fix

// before
packer verify -bundle rel.sigstore -artifact ./missing.bin attestation.intoto.jsonl
// after
packer verify -bundle rel.sigstore -artifact $(pwd)/dist/artifact.zip attestation.intoto.jsonl

info, err := os.Stat(artifactPath)
if err != nil {
    return fmt.Errorf("artifact %q unavailable: %w", artifactPath, err)
}
if info.IsDir() {
    return fmt.Errorf("artifact %q is a directory", artifactPath)
}
file, err := os.Open(artifactPath)
if err != nil { return err }
file.Close()

if err := verify(...); err != nil {
    var perr *fs.PathError
    if errors.As(err, &perr) && strings.Contains(err.Error(), "open artifact") {
        // fix -artifact path and retry
    }
}

When it happens

Trigger: verifySigstoreBundleEvidenceImpl called with policy.ArtifactPath set to a path that does not exist, is not readable, or is a directory.

Common situations: Typo or wrong relative path for the artifact; artifact deleted between build and verification; running the command from a different directory; pointing at a directory instead of the built file.

Related errors

• load Sigstore bundle %q: %w
• hash %q: %w
• signing_mode %q does not support Sigstore bundle emission
• read verifier %q: %w
• read signer %q: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/be5eca5dcb7835aa. Report an issue: GitHub.