hashicorp/packer · error

signing_mode %q requires signer or key

Error message

signing_mode %q requires signer or key

What it means

newKMSSigner builds a KMS-backed attestation signer, but a KMS signing mode is meaningless without a key reference: cfg.SignerRef (from the 'signer' or 'key' config) identifies which cloud KMS key resource to use. This error is thrown as a fast, explicit config validation failure when SignerRef is empty, before any KMS provider is contacted. It exists to give a clear, actionable message instead of a cryptic provider error about an empty key resource ID.

Source

Thrown at internal/attestation/sign_kms.go:34

)

var newKMSSignerVerifier = func(ctx context.Context, keyResourceID string) (sigstorekms.SignerVerifier, error) {
	return sigstorekms.Get(ctx, keyResourceID, crypto.SHA256)
}

func init() {
	RegisterSigner(SigningModeKMS, newKMSSigner)
}

type kmsSigner struct {
	signerVerifier sigstorekms.SignerVerifier
	verifier       Verifier
	keyID          string
}

func newKMSSigner(ctx context.Context, cfg BackendConfig) (Signer, error) {
	if cfg.SignerRef == "" {
		return nil, fmt.Errorf("signing_mode %q requires signer or key", SigningModeKMS)
	}

	signerVerifier, err := newKMSSignerVerifier(ctx, cfg.SignerRef)
	if err != nil {
		var notFound *sigstorekms.ProviderNotFoundError
		if errors.As(err, &notFound) {
			return nil, fmt.Errorf("initialize KMS signer %q: %w%s", cfg.SignerRef, err, kmsProviderBuildHint(cfg.SignerRef))
		}
		return nil, fmt.Errorf("initialize KMS signer %q: %w", cfg.SignerRef, err)
	}

	publicKey, err := signerVerifier.PublicKey()
	if err != nil {
		return nil, fmt.Errorf("load KMS public key %q: %w", cfg.SignerRef, err)
	}

	verifier, err := newSigstoreVerifierFromPublicKey(publicKey)
	if err != nil {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Set the KMS key reference in the config, e.g. signer = "awskms://alias/my-signing-key" or the equivalent 'key' field value.
2. Double-check field spelling in your config so the value actually populates SignerRef.
3. If you do not have a KMS key, use a different signing mode (e.g. a local 'key' file signer) instead of signing_mode "kms".

Example fix

# before
[attestation.signing]
signing_mode = "kms"
# after
[attestation.signing]
signing_mode = "kms"
signer = "awskms://alias/my-signing-key"

if strings.EqualFold(cfg.SigningMode, "kms") && cfg.SignerRef == "" {
	return errors.New(`signing_mode "kms" needs a signer/key, e.g. signer = "awskms://alias/my-key"`)
}

When it happens

Trigger: Configuring signing_mode = "kms" (SigningModeKMS) in the attestation backend without setting either the 'signer' or 'key' field, so BackendConfig.SignerRef is the empty string when newKMSSigner is invoked.

Common situations: Copy-pasting a config template and deleting the key line; switching from file-based key signing to KMS and forgetting to add the key reference; generating config programmatically and the key field defaulting to empty; typo in the field name so the intended value never lands in SignerRef.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• The `bucket_name` must be specified
• `channel` is currently a required field.
• the `bucket_name` must be specified
• the `channel_name` must be specified
• the `url` must be specified

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/58c3cff92b8f7191. Report an issue: GitHub.