hashicorp/packer · error

signing_mode %q does not support Sigstore bundle emission

Error message

signing_mode %q does not support Sigstore bundle emission

What it means

BuildBundleForSigner produces a Sigstore bundle (DSSE envelope + Rekor data) but only when the signer implements the internal bundleSigner interface (SignBundle method). Packer throws this error when the signer's configured signing_mode produces a signer that does not support Sigstore bundle emission, so a bundle was requested but cannot be created for that mode.

Source

Thrown at internal/attestation/bundle.go:18

// Copyright IBM Corp. 2024, 2025
// SPDX-License-Identifier: BUSL-1.1

package attestation

import (
	"context"
	"fmt"
)

type bundleSigner interface {
	SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)
}

func BuildBundleForSigner(ctx context.Context, signer Signer, cfg BackendConfig, payloadType string, payload []byte) (Envelope, []byte, error) {
	bundler, ok := signer.(bundleSigner)
	if !ok {
		return Envelope{}, nil, fmt.Errorf("signing_mode %q does not support Sigstore bundle emission", cfg.Mode)
	}

	return bundler.SignBundle(ctx, payloadType, payload, cfg)
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Switch the signing_mode configuration to a mode whose signer supports bundles (e.g. the keyless/Sigstore mode)
2. If you must keep the current mode, stop requesting bundle emission and use the plain signature output instead
3. Upgrade the signer implementation/plugin to a version that implements SignBundle for your mode
4. Inspect cfg.Mode in the error to confirm which mode was used, and align the pipeline's bundle expectations with that mode

Example fix

// before
cfg := BackendConfig{Mode: "plain-key"}
env, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)
// after
cfg := BackendConfig{Mode: "keyless"} // mode backed by a bundleSigner implementation
env, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)

_, isBundler := signer.(interface {
	SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)
})
if !isBundler {
	// request a plain signature path or reconfigure signing_mode before calling
}

func supportsBundleEmission(signer Signer) bool {
	_, ok := signer.(interface {
		SignBundle(ctx context.Context, payloadType string, payload []byte, cfg BackendConfig) (Envelope, []byte, error)
	})
	return ok
}

env, bundle, err := BuildBundleForSigner(ctx, signer, cfg, payloadType, payload)
if err != nil {
	if strings.Contains(err.Error(), "does not support Sigstore bundle emission") {
		// fall back to non-bundle signature path or surface a config error
		return fallbackPlainSignature(ctx, signer, payloadType, payload)
	}
	return err
}

When it happens

Trigger: Calling BuildBundleForSigner with a signer whose concrete type lacks SignBundle — i.e. a signing mode that only emits plain signatures; cfg.Mode names the mode in the message. Exercised by TestBuildBundleForKeylessSigner and TestKeylessBundleAndRekorIntegration, which use the keyless signer that does support bundles.

Common situations: Configuring a non-keyless signing mode (e.g. a plain key-based mode) while the pipeline also requests Sigstore bundles/Rekor integration; version drift where an older signer implementation predates bundle support.

Related errors

• decode envelope payload: %w
• decode envelope signature: %w
• sign payload with keyless signer: %w
• extract envelope from Sigstore bundle: %w
• sigstore bundle does not contain a DSSE envelope

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/b8020a9eb8b9edba. Report an issue: GitHub.