hashicorp/packer · error

signing_mode %q does not support verifier overrides; keyless

Error message

signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer

What it means

In keyless signing mode, verification identity comes from keyless_identity and keyless_oidc_issuer, so a custom `verifier` reference is not allowed. Setting both is contradictory and rejected at config time.

Source

Thrown at post-processor/provenance/post-processor.go:415

			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKMS:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		if !isRecognizedKMSSigner(signerRef) {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKeyless:
		if p.config.Verifier != "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer", mode)
		}
		if strings.TrimSpace(p.config.KeylessIdentity) == "" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires keyless_identity and keyless_oidc_issuer", mode)
		}
		return internalattestation.BackendConfig{
			Mode:              mode,
			Env:               p.currentEnv(),
			FulcioURL:         p.config.FulcioURL,
			RekorURL:          p.config.RekorURL,
			UploadTlog:        p.config.UploadTlog,
			TrustedRootPath:   p.config.TrustedRootPath,
			KeylessIdentity:   p.config.KeylessIdentity,
			KeylessOIDCIssuer: p.config.KeylessOIDCIssuer,
		}, nil
	default:
		return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q is not implemented", mode)
	}
}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Remove the `verifier` field from the config.
2. Rely on keyless_identity + keyless_oidc_issuer for verification.
3. Switch to signing_mode "key" or "kms" if a fixed verifier key is actually required.

Example fix

// before
"signing_mode": "keyless",
"verifier": "file:///keys/pub.pem",
"keyless_identity": "ci@example.com"
// after
"signing_mode": "keyless",
"keyless_identity": "ci@example.com",
"keyless_oidc_issuer": "https://token.actions.githubusercontent.com"

func checkKeylessOverride(mode, verifier string) error {
	if mode == "keyless" && verifier != "" {
		return fmt.Errorf("keyless mode ignores verifier; remove it")
	}
	return nil
}

if err := p.Configure(raws); err != nil {
	if strings.Contains(err.Error(), "does not support verifier overrides") {
		return fmt.Errorf("drop verifier for keyless mode: %w", err)
	}
	return err
}

When it happens

Trigger: SigningModeKeyless with p.config.Verifier non-empty; raised by signingBackendConfig during Configure or writeAttestation.

Common situations: Template reuses a `verifier` field from key/kms mode while switching to keyless; user tries to pin a public key for keyless verification, which is unsupported.

Related errors

• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w
• summarize Fulcio certificate: %w
• build keyless identity policy: %w
• signing_mode %q requires keyless_identity and keyless_oidc_i

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/651f0fd062a832d8. Report an issue: GitHub.