unable to determine attestation signing mode; set signing_mo

Error message

unable to determine attestation signing mode; set signing_mode or verifier explicitly

What it means

verifierForEnvelope reaches the default branch when normalizeVerificationMode cannot determine a mode: cfg.Mode is empty, the envelope has no certificate, SignerRef is neither a recognized KMS URI nor set, and VerifierRef is empty. Verification cannot proceed without knowing what kind of verifier to build, so the library asks the caller to set signing_mode or verifier explicitly.

Source

Thrown at internal/attestation/verify.go:176

	switch mode {
	case SigningModeKey:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires verifier or key", SigningModeKey)
		}
		return LoadPEMVerifier(cfg.SignerRef)
	case SigningModeKMS:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires key or verifier", SigningModeKMS)
		}
		signer, err := NewSigner(ctx, cfg)
		if err != nil {
			return nil, err
		}
		return signer.Verifier(ctx, cfg)
	case SigningModeKeyless:
		return newKeylessVerifierForEnvelope(cfg, envelope)
	default:
		return nil, fmt.Errorf("unable to determine attestation signing mode; set signing_mode or verifier explicitly")
	}
}

func normalizeVerificationMode(cfg BackendConfig, envelope Envelope) string {
	if cfg.Mode != "" {
		return cfg.Mode
	}

	if envelopeHasCertificate(envelope) {
		return SigningModeKeyless
	}

	if isRecognizedKMSReference(cfg.SignerRef) {
		return SigningModeKMS
	}

	if cfg.SignerRef != "" || cfg.VerifierRef != "" {
		return SigningModeKey

View on GitHub (pinned to eb36e3c3e4)

Solutions

Set cfg.Mode explicitly (key, kms, or keyless) to match how the attestation was signed
Set cfg.VerifierRef to a PEM verifier, or cfg.SignerRef to a recognized key/KMS reference
If using a custom KMS URI scheme, set Mode=SigningModeKMS explicitly so the prefix check is bypassed
Check signing_mode spelling/interpolation — an unrecognized string lands in the default branch

Example fix

// before
cfg := attestation.BackendConfig{} // nothing set

// after
cfg := attestation.BackendConfig{Mode: attestation.SigningModeKey, SignerRef: "keys/signer.pub"}

Defensive patterns

Strategy: validation

Validate before calling

if cfg.Mode == "" && cfg.SignerRef == "" && cfg.VerifierRef == "" {
    return errors.New"no verification mode determinable: set signing_mode or verifier")
}

Try / catch

if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {
    if strings.Contains(err.Error(), "unable to determine attestation signing mode") {
        return fmt.Errorf"configure signing_mode (key|kms|keyless) or a verifier: %w", err)
    }
    return err
}

Prevention

Always set signing_mode explicitly in shared/reusable verification configs
If using a custom KMS scheme, set Mode=SigningModeKMS rather than relying on prefix detection
Reject empty BackendConfig at CLI/config-parse time
For keyless files rely on envelope certificate detection instead of clearing Mode

When it happens

Trigger: VerifyAttestationFile called with a completely empty (or near-empty) BackendConfig against a plain key-signed envelope lacking a cert; SignerRef set to an unrecognized URI scheme without an explicit Mode; config struct zero-valued in tests or partially decoded config.

Common situations: Users assume auto-detection works from the file alone; custom KMS plugins whose URI prefix is not in the recognized list; config not wired through so BackendConfig{} arrives empty; typos in signing_mode values that fall through the switch.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/813dc2c576f0f575. Report an issue: GitHub.