signing_mode %q requires keyless_identity and keyless_oidc_i

Error message

signing_mode %q requires keyless_identity and keyless_oidc_issuer

What it means

Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is "keyless", but keyless signing needs both `keyless_identity` (the SAN identity, e.g. an email) and `keyless_oidc_issuer` (the issuer URL) to later verify the attestation; one or both are blank.

Source

Thrown at post-processor/provenance/post-processor.go:418

	case internalattestation.SigningModeKMS:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		if !isRecognizedKMSSigner(signerRef) {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKeyless:
		if p.config.Verifier != "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q does not support verifier overrides; keyless attestations are verified against keyless_identity and keyless_oidc_issuer", mode)
		}
		if strings.TrimSpace(p.config.KeylessIdentity) == "" || strings.TrimSpace(p.config.KeylessOIDCIssuer) == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires keyless_identity and keyless_oidc_issuer", mode)
		}
		return internalattestation.BackendConfig{
			Mode:              mode,
			Env:               p.currentEnv(),
			FulcioURL:         p.config.FulcioURL,
			RekorURL:          p.config.RekorURL,
			UploadTlog:        p.config.UploadTlog,
			TrustedRootPath:   p.config.TrustedRootPath,
			KeylessIdentity:   p.config.KeylessIdentity,
			KeylessOIDCIssuer: p.config.KeylessOIDCIssuer,
		}, nil
	default:
		return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q is not implemented", mode)
	}
}

func isRecognizedKMSSigner(value string) bool {
	for _, prefix := range []string{"awskms://", "gcpkms://", "azurekms://", "hashivault://"} {

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set both keyless_identity and keyless_oidc_issuer, e.g. identity from your OIDC token and its issuer URL
Trim accidental whitespace-only values in those fields

Example fix

// before
"signing_mode": "keyless"
// after
"signing_mode": "keyless",
"keyless_identity": "https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main",
"keyless_oidc_issuer": "https://token.actions.githubusercontent.com"

Defensive patterns

Strategy: validation

Validate before calling

func checkKeylessFields(mode, identity, issuer string) error {
	if mode == "keyless" && (strings.TrimSpace(identity) == "" || strings.TrimSpace(issuer) == "") {
		return fmt.Errorf("keyless requires keyless_identity and keyless_oidc_issuer")
	}
	return nil
}

Try / catch

if err := p.Configure(raws); err != nil {
	if strings.Contains(err.Error(), "keyless_identity and keyless_oidc_issuer") {
		return fmt.Errorf("fill keyless identity fields: %w", err)
	}
	return err
}

Prevention

Set both keyless_identity and keyless_oidc_issuer whenever signing_mode = "keyless".
Check interpolated HCL variables resolve to non-empty values.
Use the well-known GitHub OIDC issuer URL for Actions-based provenance.

When it happens

Trigger: SigningModeKeyless where strings.TrimSpace(KeylessIdentity) == "" or strings.TrimSpace(KeylessOIDCIssuer) == ""; raised in signingBackendConfig.

Common situations: signing_mode = "keyless" set for CI provenance but the identity/issuer fields left blank; whitespace-only values from HCL variables interpolating to empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/765f9a149741bbbb. Report an issue: GitHub.