hashicorp/packer · error

sigstore bundle does not contain a DSSE envelope

Error message

sigstore bundle does not contain a DSSE envelope

What it means

After extracting the bundle envelope, SignBundle reads RawEnvelope() to recover the payload type/payload bytes; a nil result means the bundle parsed but contains no raw DSSE envelope structure. Because the bundle was created locally from DSSEData, this defensive check should only fire with library inconsistency or a stub returning an empty envelope.

Source

Thrown at internal/attestation/sign_keyless.go:188

	protobufBundle, err := newKeylessBundle(content, s.keypair, options)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("build Sigstore bundle: %w", err)
	}

	bundleWrapper, err := sigstorebundle.NewBundle(protobufBundle)
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("decode Sigstore bundle: %w", err)
	}

	bundleEnvelope, err := bundleWrapper.Envelope()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("extract envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return Envelope{}, nil, fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	bundleJSON, err := bundleWrapper.MarshalJSON()
	if err != nil {
		return Envelope{}, nil, fmt.Errorf("marshal Sigstore bundle: %w", err)
	}

	envelope := Envelope{
		PayloadType: rawEnvelope.PayloadType,
		Payload:     rawEnvelope.Payload,
		Signatures: []EnvelopeSignature{{
			KeyID: s.keyID,
			Sig:   base64.StdEncoding.EncodeToString(bundleEnvelope.Signature()),
			Cert:  string(s.certPEM),
		}},
	}

	return envelope, bundleJSON, nil

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Use the real sigstoregosign.Bundle constructor path (no stubs) and retry
2. Upgrade/pin sigstore-go to a version whose Envelope()/RawEnvelope() behavior matches the code's expectations
3. Check for empty payload/payloadType inputs that could yield a degenerate envelope; pass non-empty content

Example fix

// before
envelope, bundleJSON, err := signer.SignBundle(ctx, "", nil, cfg) // empty payload
// after
envelope, bundleJSON, err := signer.SignBundle(ctx, "application/vnd.in-toto+json", inTotoBytes, cfg)

if len(payload) == 0 || strings.TrimSpace(payloadType) == "" {
	return fmt.Errorf("refusing to sign empty payload or payload type")
}

envelope, bundle, err := signer.SignBundle(ctx, ptype, payload, cfg)
if err != nil && strings.Contains(err.Error(), "does not contain a DSSE envelope") {
	return fmt.Errorf("degenerate bundle produced; check payload inputs and library version: %w", err)
}

When it happens

Trigger: SignBundle reaches bundleEnvelope.RawEnvelope() == nil at internal/attestation/sign_keyless.go:186-189 — bundle exists but its raw DSSE envelope is nil (empty/malformed envelope from stubbed construction or sigstore-go returning an empty protobuf envelope).

Common situations: Test doubles returning empty sigstore-go envelopes; sigstore-go upgrade changing RawEnvelope behavior; hand-assembled protobuf bundles lacking the DSSE envelope message.

Related errors

• extract envelope from Sigstore bundle: %w
• signing_mode %q does not support Sigstore bundle emission
• decode Sigstore bundle: %w
• marshal Sigstore bundle: %w
• extract DSSE envelope from Sigstore bundle: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/669b0c6541063131. Report an issue: GitHub.