hashicorp/packer · error

sign payload with KMS: %w

Error message

sign payload with KMS: %w

What it means

Signing failure in kmsSigner.Sign: the pre-auth-encoded payload could not be signed by the KMS provider (SignMessage returned an error). Typically a KMS-side failure: key disabled, permissions denied, network/API error, or unsupported message size.

Source

Thrown at internal/attestation/sign_kms.go:67

	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {
		return nil, fmt.Errorf("create KMS verifier %q: %w", cfg.SignerRef, err)
	}

	return &kmsSigner{
		signerVerifier: signerVerifier,
		verifier:       verifier,
		keyID:          verifier.KeyID(),
	}, nil
}

func (s *kmsSigner) Sign(_ context.Context, payloadType string, payload []byte) (Signature, error) {
	encoded := PreAuthEncode(payloadType, payload)
	signature, err := s.signerVerifier.SignMessage(bytes.NewReader(encoded))
	if err != nil {
		return Signature{}, fmt.Errorf("sign payload with KMS: %w", err)
	}

	return Signature{
		KeyID: s.keyID,
		Sig:   signature,
	}, nil
}

func (s *kmsSigner) Verifier(context.Context, BackendConfig) (Verifier, error) {
	return s.verifier, nil
}

// kmsProviderBuildTags maps a KMS/Vault URI scheme to the build tag that
// compiles its provider into the binary. Providers are included by default;
// builds using the "kms_cherrypick" tag opt in to individual providers.
var kmsProviderBuildTags = map[string]string{
	"awskms":     "kms_aws",
	"gcpkms":     "kms_gcp",

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Check that the KMS key is enabled and the credentials used have kms:Sign permission
2. Verify network access and the key reference URI (awskms://, gcpkms://, azurekms://, hashivault://)
3. Retry the build — transient KMS API errors are common

When it happens

Trigger: Thrown at internal/attestation/sign_kms.go:67 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/1f794b1dc49cb591. Report an issue: GitHub.