hashicorp/packer · error

sign attestation: %w

Error message

sign attestation: %w

What it means

In non-keyless mode, writeAttestation signs the payload with the configured signer via signer.Sign. Any signer failure (bad private key, unsupported key format, passphrase issues, crypto errors) is wrapped as `sign attestation: %w`.

Source

Thrown at post-processor/provenance/post-processor.go:322

	}

	payload, err := internalattestation.MarshalPayload(statement)
	if err != nil {
		return fmt.Errorf("marshal canonical attestation payload: %w", err)
	}

	bundlePath := sigstoreBundleOutputPath(outputPath)
	bundleJSON := []byte(nil)
	var envelope internalattestation.Envelope
	if backendConfig.Mode == internalattestation.SigningModeKeyless {
		envelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)
		if err != nil {
			return fmt.Errorf("sign attestation with Sigstore bundle: %w", err)
		}
	} else {
		signature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)
		if signErr != nil {
			return fmt.Errorf("sign attestation: %w", signErr)
		}
		envelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)
	}

	if err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {
		return fmt.Errorf("verify signed attestation: %w", err)
	}

	output, err := json.MarshalIndent(envelope, "", "  ")
	if err != nil {
		return fmt.Errorf("marshal signed envelope: %w", err)
	}

	if err := atomicWriteFile(outputPath, output, 0664); err != nil {
		return fmt.Errorf("write attestation %q: %w", outputPath, err)
	}

	if len(bundleJSON) > 0 {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Verify key_path points to a valid private key in the expected format (PEM).
2. Supply the key passphrase via the configured password mechanism if the key is encrypted.
3. Regenerate the key with cosign (`cosign generate-key-pair`) if the format is unsupported.
4. Read the wrapped crypto error for the precise key problem.

Example fix

// before
key_path = "./cosign.pub"
// after
key_path = "./cosign.key" // private key

// verify the key loads before running the build
keyData, err := os.ReadFile(cfg.KeyPath)
if err != nil { return err }
block, _ := pem.Decode(keyData)
if block == nil { return errors.New("key_path is not PEM-encoded") }

func looksLikePrivateKey(path string) bool {
    b, err := os.ReadFile(path)
    if err != nil { return false }
    block, _ := pem.Decode(b)
    return block != nil && strings.Contains(block.Type, "PRIVATE KEY")
}

if err := pp.PostProcess(ctx, ui, artifact); err != nil {
    if strings.Contains(err.Error(), "sign attestation:") && !strings.Contains(err.Error(), "Sigstore") {
        // re-check key_path, passphrase, and key algorithm
    }
}

When it happens

Trigger: signing_mode `key` with a malformed/encrypted key file, wrong key type for the signer, wrong passphrase, or key file unreadable at sign time.

Common situations: Pointing key_path at a public key instead of private; encrypted key without supplying the password; key generated with an algorithm the signer doesn't support (e.g. ed25519 vs RSA mismatch).

Related errors

• sign payload: %w
• signer %q does not implement crypto.Signer
• sign attestation with Sigstore bundle: %w
• verify signed attestation: %w
• signing_mode %q does not support Sigstore bundle emission

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/83ef2eb3b090fbb5. Report an issue: GitHub.