hashicorp/packer · error

sign attestation with Sigstore bundle: %w

Error message

sign attestation with Sigstore bundle: %w

What it means

In keyless signing mode, writeAttestation builds a Sigstore bundle via buildSigstoreBundleForSigner, which performs an OIDC/Fulcio flow. Any failure in that flow (no OIDC token, network to Fulcio/Rekor, cert fetch) is wrapped as `sign attestation with Sigstore bundle: %w`.

Source

Thrown at post-processor/provenance/post-processor.go:317

	}

	signer, verifier, err := p.signingResources(ctx, backendConfig)
	if err != nil {
		return err
	}

	payload, err := internalattestation.MarshalPayload(statement)
	if err != nil {
		return fmt.Errorf("marshal canonical attestation payload: %w", err)
	}

	bundlePath := sigstoreBundleOutputPath(outputPath)
	bundleJSON := []byte(nil)
	var envelope internalattestation.Envelope
	if backendConfig.Mode == internalattestation.SigningModeKeyless {
		envelope, bundleJSON, err = buildSigstoreBundleForSigner(ctx, signer, backendConfig, internalattestation.InTotoPayloadType, payload)
		if err != nil {
			return fmt.Errorf("sign attestation with Sigstore bundle: %w", err)
		}
	} else {
		signature, signErr := signer.Sign(ctx, internalattestation.InTotoPayloadType, payload)
		if signErr != nil {
			return fmt.Errorf("sign attestation: %w", signErr)
		}
		envelope = internalattestation.NewEnvelope(internalattestation.InTotoPayloadType, payload, signature)
	}

	if err := internalattestation.VerifyEnvelope(ctx, envelope, verifier); err != nil {
		return fmt.Errorf("verify signed attestation: %w", err)
	}

	output, err := json.MarshalIndent(envelope, "", "  ")
	if err != nil {
		return fmt.Errorf("marshal signed envelope: %w", err)
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Provide an OIDC token (e.g. set `SIGSTORE_ID_TOKEN` or the configured token env var) for keyless signing.
2. Verify network egress to Fulcio/Rekor endpoints; set custom URLs if using a private instance.
3. Read the wrapped error to distinguish OIDC auth vs network failures.
4. Switch `signing_mode` to a key-based mode if keyless isn't feasible in your environment.

Example fix

// before (CI without OIDC)
signing_mode = "keyless"
// after
signing_mode = "key"
key_path = "./cosign.key"

// check prerequisites for keyless signing before Configure
if cfg.SigningMode == "keyless" {
    if os.Getenv("SIGSTORE_ID_TOKEN") == "" && !interactiveOIDCAvailable() {
        return errors.New("keyless signing needs an OIDC token")
    }
    if err := checkReachable("https://fulcio.sigstore.dev"); err != nil {
        return fmt.Errorf("fulcio unreachable: %w", err)
    }
}

err := pp.PostProcess(ctx, ui, artifact)
for i := 0; i < 3 && err != nil && isTransientSigstore(err); i++ {
    time.Sleep(backoff(i))
    err = pp.PostProcess(ctx, ui, artifact)
}

When it happens

Trigger: SigningModeKeyless configured but no OIDC identity token available/env var unset, unreachable Fulcio/Rekor endpoints, expired OIDC token, or custom Rekor/Fulcio URLs misconfigured.

Common situations: CI runners without network egress to sigstore endpoints; missing `SIGSTORE_ID_TOKEN` in headless environments; corporate proxies blocking rekor.sigstore.dev.

Related errors

• verify signed attestation: %w
• signing_mode %q does not support Sigstore bundle emission
• request Fulcio certificate: %w
• sign payload with keyless signer: %w
• load keyless trusted root: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/fc336ca44e2e1dc3. Report an issue: GitHub.