What causes "signing_mode %q requires signer or key" in hashicorp/packer?

Set signer (or key) to a KMS/Vault URI such as awskms://key-id, gcpkms://..., azurekms://..., or hashivault://...

signing_mode %q requires signer or key

Error message

signing_mode %q requires signer or key

What it means

Config validation error from the provenance post-processor's signingBackendConfig: signing_mode is "kms" but neither `signer` nor `key` provides a KMS key reference, so there is nothing to sign the attestation with.

Source

Thrown at post-processor/provenance/post-processor.go:392

	mode := p.config.SigningMode
	if mode == "" {
		mode = internalattestation.SigningModeNone
	}

	signerRef := p.config.Signer
	if p.config.Key != "" {
		if signerRef != "" && signerRef != p.config.Key {
			return internalattestation.BackendConfig{}, fmt.Errorf("signer and key must match when both are set")
		}
		signerRef = p.config.Key
	}

	switch mode {
	case internalattestation.SigningModeNone:
		return internalattestation.BackendConfig{Mode: mode}, nil
	case internalattestation.SigningModeKey:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,
			Env:         p.currentEnv(),
		}, nil
	case internalattestation.SigningModeKMS:
		if signerRef == "" {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires signer or key", mode)
		}
		if !isRecognizedKMSSigner(signerRef) {
			return internalattestation.BackendConfig{}, fmt.Errorf("signing_mode %q requires a recognized KMS or Vault URI: awskms://, gcpkms://, azurekms://, or hashivault://", mode)
		}
		return internalattestation.BackendConfig{
			Mode:        mode,
			SignerRef:   signerRef,
			VerifierRef: p.config.Verifier,

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set signer (or key) to a KMS/Vault URI such as awskms://key-id, gcpkms://..., azurekms://..., or hashivault://...
Switch signing_mode to "file" with a local PEM key if KMS isn't available

Example fix

// before
"signing_mode": "key"
// after
"signing_mode": "key",
"signer": "file:///keys/release.pem"

Defensive patterns

Strategy: validation

Validate before calling

func checkKeyMode(mode, signer, key string) error {
	if mode == "key" && signer == "" && key == "" {
		return fmt.Errorf("signing_mode %q requires signer or key", mode)
	}
	return nil
}

Try / catch

if err := p.Configure(raws); err != nil {
	if strings.Contains(err.Error(), "requires signer or key") {
		return fmt.Errorf("add signer/key to config: %w", err)
	}
	return err
}

Prevention

Pair every signing_mode with its required fields in a config checklist.
Use packer validate in CI before builds.
Don't strip signer/key fields when changing modes.

When it happens

Trigger: p.config.SigningMode == internalattestation.SigningModeKey and both p.config.Signer and p.config.Key are empty; raised in Configure or writeAttestation.

Common situations: Template sets signing_mode = "key" but forgot the key file path; key field removed during refactoring; typo making the mode parse as "key" while the signer lives in an unrelated variable.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/fb342caad5194d94. Report an issue: GitHub.