hashicorp/packer · error

signing_mode %q requires keyless_identity and keyless_oidc_i

Error message

signing_mode %q requires keyless_identity and keyless_oidc_issuer unless verifier is explicitly configured

What it means

newKeylessVerifier refuses to build a keyless verifier when the BackendConfig lacks a non-empty keyless_identity or keyless_oidc_issuer. Verifying keyless signatures requires pinning the expected OIDC identity (SAN in the Fulcio cert) and its issuer; without an explicitly configured verifier these are mandatory. This is a configuration validation error raised before any crypto work.

Source

Thrown at internal/attestation/sign_keyless.go:224

	return envelope, bundleJSON, nil
}

func (s *keylessSigner) Verifier(ctx context.Context, cfg BackendConfig) (Verifier, error) {
	return newKeylessVerifier(cfg, s.cert)
}

func newKeylessVerifierForEnvelope(cfg BackendConfig, envelope Envelope) (Verifier, error) {
	certificate, err := certificateFromEnvelope(envelope)
	if err != nil {
		return nil, err
	}

	return newKeylessVerifier(cfg, certificate)
}

func newKeylessVerifier(cfg BackendConfig, certificate *x509.Certificate) (Verifier, error) {
	if strings.TrimSpace(cfg.KeylessIdentity) == "" || strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return nil, fmt.Errorf("signing_mode %q requires keyless_identity and keyless_oidc_issuer unless verifier is explicitly configured", SigningModeKeyless)
	}

	trustedMaterial, err := loadKeylessTrustedMaterial(cfg)
	if err != nil {
		return nil, fmt.Errorf("load keyless trusted root: %w", err)
	}

	signatureVerifier, err := newSigstoreVerifierFromPublicKey(certificate.PublicKey)
	if err != nil {
		return nil, fmt.Errorf("create keyless verifier: %w", err)
	}

	return &keylessVerifier{
		certificate:       certificate,
		signatureVerifier: signatureVerifier,
		trustedMaterial:   trustedMaterial,
		identity:          cfg.KeylessIdentity,
		oidcIssuer:        cfg.KeylessOIDCIssuer,

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Set both cfg.KeylessIdentity (e.g. the workflow/CI identity like "https://github.com/org/repo/.github/workflows/x.yml@refs/heads/main") and cfg.KeylessOIDCIssuer (e.g. "https://token.actions.githubusercontent.com") in the BackendConfig used for verification
2. Carry over the signer's BackendConfig (identity/issuer) into the verification step instead of constructing a fresh empty one
3. If verification material is available in-process, use the signer-provided Verifier(ctx, cfg) or configure an explicit verifier rather than reconstructing from config
4. Trim-check the config values are not whitespace-only

Example fix

// before
cfg := BackendConfig{SigningMode: SigningModeKeyless}
v, err := signer.Verifier(ctx, cfg)
// after
cfg := BackendConfig{SigningMode: SigningModeKeyless,
	KeylessIdentity:   "https://github.com/org/repo/.github/workflows/release.yml@refs/heads/main",
	KeylessOIDCIssuer: "https://token.actions.githubusercontent.com"}
v, err := signer.Verifier(ctx, cfg)

func validateKeylessVerifyConfig(cfg BackendConfig) error {
	if strings.TrimSpace(cfg.KeylessIdentity) == "" {
		return fmt.Errorf("keyless_identity is required for keyless verification")
	}
	if strings.TrimSpace(cfg.KeylessOIDCIssuer) == "" {
		return fmt.Errorf("keyless_oidc_issuer is required for keyless verification")
	}
	return nil
}

if err := validateKeylessVerifyConfig(cfg); err != nil { return err }
v, err := signer.Verifier(ctx, cfg)
if err != nil { return fmt.Errorf("verifier setup failed: %w", err) }

When it happens

Trigger: Calling signer.Verifier(ctx, cfg) on a keylessSigner or newKeylessVerifierForEnvelope(cfg, envelope) with cfg.KeylessIdentity == "" or cfg.KeylessOIDCIssuer == "" after trimming whitespace (internal/attestation/sign_keyless.go:222-225).

Common situations: Verifying a keyless attestation in another environment/pipeline where only the envelope is available and no verifier config was carried over; forgetting to set keyless_identity/keyless_oidc_issuer in the verification backend config; whitespace-only config values.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• build keyless identity policy: %w
• initialize KMS signer %q: %w%s
• initialize KMS signer %q: %w
• sign attestation with Sigstore bundle: %w
• signing_mode %q does not support verifier overrides; keyless

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/d3a9ebb1eebf0b96. Report an issue: GitHub.