hashicorp/packer · error

signing_mode %q is not implemented

Error message

signing_mode %q is not implemented

What it means

Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is not one of the implemented modes handled by the switch (none/file/kms/keyless), i.e. a typo'd or future mode string.

Source

Thrown at post-processor/provenance/post-processor.go:431

	case internalattestation.SigningModeKeyless:
		if p.config.Verifier != "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer", mode)
		}
		if strings.TrimSpace(p.config.KeylessIdentity) == "" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires keyless_identity and keyless_oidc_issuer", mode)
		}
		return internalattestation.BackendConfig{
			Mode:              mode,
			Env:               p.currentEnv(),
			FulcioURL:         p.config.FulcioURL,
			RekorURL:          p.config.RekorURL,
			UploadTlog:        p.config.UploadTlog,
			TrustedRootPath:   p.config.TrustedRootPath,
			KeylessIdentity:   p.config.KeylessIdentity,
			KeylessOIDCIssuer: p.config.KeylessOIDCIssuer,
		}, nil
	default:
		return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q is not implemented", mode)
	}
}

func isRecognizedKMSSigner(value string) bool {
	for _, prefix := range []string{"awskms://", "gcpkms://", "azurekms://", "hashivault://"} {
		if strings.HasPrefix(value, prefix) {
			return true
		}
	}

	return false
}

func (p *PostProcessor) resolveSBOM(ctx context.Context, source packersdk.Artifact, paths outputPaths) (internalsbom.Format, []byte, error) {
	// The SBOM is always regenerated so it reflects the artifact being attested.
	// Reusing a pre-existing SBOM file could attest stale contents if the
	// artifact changed between runs.
	format, err := internalsbom.ParseFormatFromArgs(p.config.SBOMFormat)

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Set signing_mode to one of: "" (none), "file", "kms", or "keyless"
2. Check for typos in the signing_mode attribute

Example fix

// before
"signing_mode": "kms-awskms"
// after
"signing_mode": "kms",
"signer": "awskms://alias/packer-signing"

var validModes = map[string]bool{"none": true, "key": true, "kms": true, "keyless": true}
func checkSigningMode(m string) error {
	if !validModes[m] {
		return fmt.Errorf("invalid signing_mode %q; use none|key|kms|keyless", m)
	}
	return nil
}

if err := p.Configure(raws); err != nil {
	if strings.Contains(err.Error(), "is not implemented") {
		return fmt.Errorf("use none|key|kms|keyless: %w", err)
	}
	return err
}

When it happens

Trigger: The mode value parsed from signing_mode does not match none/key/kms/keyless cases in signingBackendConfig; raised during Configure or writeAttestation.

Common situations: Typo in signing_mode (e.g. "keys", "kms-awskms"); an internal mode enum value added upstream but not handled here; invalid value slipping past earlier template validation.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• signing_mode %q requires signer
• signer and key must match when both are set
• signing_mode %q requires signer or key
• signing_mode %q does not support Sigstore bundle emission
• sign payload: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/5f6d83177343f2a0. Report an issue: GitHub.