sigstore bundle payload does not match attestation

Error message

sigstore bundle payload does not match attestation

What it means

The bundle's DSSE payloadType or payload differs from the attestation envelope being verified, so the bundle does not attest this attestation. Thrown to fail fast before cryptographic verification, since verifying a bundle for different content would be meaningless.

Source

Thrown at internal/attestation/verify.go:361

		return fmt.Errorf("verify Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	return nil
}

func ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {
	bundleEnvelope, err := bundle.Envelope()
	if err != nil {
		return fmt.Errorf("extract DSSE envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")
	}

	if len(envelope.Signatures) == 0 {
		return fmt.Errorf("attestation envelope has no signatures")
	}

	bundleSignature := bundleEnvelope.Signature()
	for i, envelopeSignature := range envelope.Signatures {
		signature, err := DecodeEnvelopeSignature(envelopeSignature)
		if err != nil {
			return fmt.Errorf("decode attestation envelope signature %d: %w", i, err)
		}

		if bytes.Equal(bundleSignature, signature) {
			return nil
		}
	}

View on GitHub (pinned to eb36e3c3e4)

Solutions

Regenerate the bundle together with the attestation in the same signing run and keep them paired (same release artifact set)
Check that you are passing the bundle that corresponds to this exact attestation file (compare payloads manually if needed)
Pin/align predicate schema versions between signing and verification tooling

Defensive patterns

Strategy: validation

Validate before calling

b, _ := os.ReadFile(bundlePath)
var probe struct {
    DSSEEnvelope struct {
        PayloadType string `json:"payloadType"`
        Payload     string `json:"payload"`
    } `json:"dsseEnvelope"`
}
_ = json.Unmarshal(b, &probe)
a, _ := os.ReadFile(attestationPath)
var env struct {
    PayloadType string `json:"payloadType"`
    Payload     string `json:"payload"`
}
_ = json.Unmarshal(a, &env)
if probe.DSSEEnvelope.PayloadType != env.PayloadType || probe.DSSEEnvelope.Payload != env.Payload {
    return fmt.Errorf("bundle and attestation payloads differ")
}

Try / catch

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "payload does not match attestation") {
        // re-pair bundle with the matching attestation from the same build
    }
}

Prevention

Emit bundle and attestation together in one signing step and store them adjacently
Version-control or content-address the (attestation, bundle) pair per release
Avoid regenerating attestations while reusing old bundles

When it happens

Trigger: ensureBundleMatchesEnvelope compares rawEnvelope.PayloadType/Payload against envelope.PayloadType/Payload and any field differs — e.g. bundle signed for a different attestation version, predicate, or subject set.

Common situations: Mixing bundles and attestations from different builds or releases; attestation regenerated (new payload) while reusing an old bundle; predicate schema upgrade changing serialized payload; wrong file pairing in CI artifacts.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/2670b866dd13bba9. Report an issue: GitHub.