hashicorp/packer · error

sigstore bundle does not contain a DSSE envelope

Error message

sigstore bundle does not contain a DSSE envelope

What it means

The bundle parsed but its RawEnvelope() returned nil, i.e. no DSSE envelope content is present inside the bundle. Thrown because signature matching against the attestation is impossible without the envelope's payload and signatures.

Source

Thrown at internal/attestation/verify.go:357

	}

	policyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))
	if _, err := verifier.Verify(bundle, policyBuilder); err != nil {
		return fmt.Errorf("verify Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	return nil
}

func ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {
	bundleEnvelope, err := bundle.Envelope()
	if err != nil {
		return fmt.Errorf("extract DSSE envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")
	}

	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("attestation envelope has no signatures")
	}

	bundleSignature := bundleEnvelope.Signature()
	for i, envelopeSignature := range envelope.Signatures {
		signature, err := DecodeEnvelopeSignature(envelopeSignature)
		if err != nil {
			return fmt.Errorf("decode attestation envelope signature %d: %w", i, err)
		}

		if bytes.Equal(bundleSignature, signature) {

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Use a bundle produced by attesting the DSSE envelope (must contain a dsseEnvelope object in its JSON)
2. Regenerate the bundle from the original signing pipeline rather than hand-editing
3. Validate the bundle JSON before passing it (jq '.dsseEnvelope' bundle.json)

var probe struct {
    DSSEEnvelope *json.RawMessage `json:"dsseEnvelope"`
}
b, _ := os.ReadFile(bundlePath)
if err := json.Unmarshal(b, &probe); err != nil || probe.DSSEEnvelope == nil {
    return fmt.Errorf("bundle %q lacks an embedded DSSE envelope", bundlePath)
}

func hasDSSEEnvelope(bundle *sigstorebundle.Bundle) bool {
    env, err := bundle.Envelope()
    return err == nil && env.RawEnvelope() != nil
}

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "does not contain a DSSE envelope") {
        // swap in a bundle produced by the attest flow
    }
}

When it happens

Trigger: bundle.Envelope() succeeds but the underlying raw envelope object is nil — a bundle variant without an embedded DSSE envelope (message-signature-only bundle) reaches ensureBundleMatchesEnvelope.

Common situations: Wrong bundle type supplied (binary signature instead of attestation); an older tool produced a bundle shape the parser reads as envelope-less; hand-edited bundle JSON stripped the envelope.

Related errors

• extract envelope from Sigstore bundle: %w
• sigstore bundle does not contain a DSSE envelope
• extract DSSE envelope from Sigstore bundle: %w
• signing_mode %q does not support Sigstore bundle emission
• build Sigstore bundle: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/976dc5ff6dc99e04. Report an issue: GitHub.