What causes "sign payload: %w" in hashicorp/packer?

Inspect the wrapped cause (%w chain) with errors.Unwrap or errors.As/Is to identify the underlying crypto.Signer failure (device error, bad opts, permission denied).

hashicorp/packer · error

sign payload: %w

Error message

sign payload: %w

What it means

pemSigner.Sign pre-encodes the payload (PreAuthEncode), hashes it with SHA-256 (except Ed25519, which signs the raw PAE bytes), then delegates to the loaded crypto.Signer's Sign method. Any failure returned by that underlying crypto.Signer.Sign call is wrapped as "sign payload: %w". This error means the private-key material itself refused or failed the signing operation, not that the payload was invalid — the original crypto error is preserved in the wrap chain for diagnosis.

Source

Thrown at internal/attestation/sign_key.go:64

}

func (s *pemSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {
	pae := PreAuthEncode(payloadType, payload)

	var message []byte
	var opts crypto.SignerOpts
	if _, ok := s.signer.Public().(ed25519.PublicKey); ok {
		message = pae
		opts = crypto.Hash(0)
	} else {
		digest := sha256.Sum256(pae)
		message = digest[:]
		opts = crypto.SHA256
	}

	signature, err := s.signer.Sign(rand.Reader, message, opts)
	if err != nil {
		return Signature{}, fmt.Errorf("sign payload: %w", err)
	}

	return Signature{
		KeyID: s.verifier.KeyID(),
		Sig:   signature,
	}, nil
}

func (s *pemSigner) Verifier(context.Context, BackendConfig) (Verifier, error) {
	return s.verifier, nil
}

func (v *pemVerifier) Verify(_ context.Context, payloadType string, payload, signature []byte) error {
	pae := PreAuthEncode(payloadType, payload)

	switch publicKey := v.publicKey.(type) {
	case *rsa.PublicKey:
		digest := sha256.Sum256(pae)

View on GitHub (pinned to eb36e3c3e4)

Solutions

Inspect the wrapped cause (%w chain) with errors.Unwrap or errors.As/Is to identify the underlying crypto.Signer failure (device error, bad opts, permission denied).
If using a hardware-backed key (HSM/TPM/smartcard), verify the device is present, unlocked, and the key handle is still valid, then re-attempt the signing operation.
Confirm the private key loaded via loadPEMSigner is a software key (RSA/ECDSA/Ed25519) compatible with the hash mode Sign selects (SHA-256 digest for RSA/ECDSA, raw PAE with crypto.Hash(0) for Ed25519).
Check file permissions and OS keychain access for the signer key if a platform crypto.Signer was substituted.

Example fix

sig, err := signer.Sign(ctx, payloadType, payload)
if err != nil {
	var opErr *net.OpError
	if errors.As(err, &opErr) {
		// transient hardware/token error: reconnect and retry
	}
	return fmt.Errorf("attestation signing failed: %w", err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-check: ensure the loaded signer can produce a public key and is a supported type
pub := signerSigner.Public()
switch pub.(type) {
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
	// supported
default:
	return fmt.Errorf("signer public key type %T not supported for attestation", pub)
}

Try / catch

sig, err := signer.Sign(ctx, payloadType, payload)
if err != nil {
	return Signature{}, fmt.Errorf("attestation sign payload: %w", err)
	// inspect errors.Unwrap(err) for the crypto.Signer cause;
	// retry only for transient device/token errors
}

Prevention

Prefer software PEM keys (PKCS#8 RSA/ECDSA or Ed25519) over hardware-backed signers unless the HSM lifecycle is managed.
Health-check hardware tokens (HSM/TPM) before starting signing operations and reconnect on failure.
Log the wrapped cause via %w/errors.Unwrap instead of swallowing it so root causes are diagnosable.
Construct the Signer once at startup and reuse it; a failed constructor surfaces key problems before traffic.

When it happens

Trigger: Invoking pemSigner.Sign(ctx, payloadType, payload) where the underlying crypto.Signer.Sign(rand.Reader, message, opts) returns an error — e.g. a hardware/PKCS#11-backed key is unavailable, the key handle was invalidated, or the signer implementation rejects the requested hash option.

Common situations: Signing with an HSM/smartcard/TPM-backed private key when the device is unplugged, locked, or the session expired; a custom crypto.Signer implementation returning errors for unsupported opts; OS-level key access permission failures; extremely large payloads triggering upstream limits in custom signers.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/55afd1ba3910cf0b. Report an issue: GitHub.