hashicorp/packer · error

verifier overrides are not supported for keyless attestation

Error message

verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead

What it means

verifierForEnvelope refuses a VerifierRef override when the envelope is keyless — either signing_mode is keyless or the envelope's signatures carry an X.509 certificate. Keyless attestations are signed with short-lived Fulcio certificates, so a static PEM verifier cannot validate them; callers must use keyless_identity and keyless_oidc_issuer (with Sigstore trust material) instead.

Source

Thrown at internal/attestation/verify.go:153

	}

	if entries, err := bundle.TlogEntries(); err == nil && len(entries) > 0 {
		return true
	}

	if timestamps, err := bundle.Timestamps(); err == nil && len(timestamps) > 0 {
		return true
	}

	return false
}

func verifierForEnvelope(ctx context.Context, cfg BackendConfig, envelope Envelope) (Verifier, error) {
	mode := normalizeVerificationMode(cfg, envelope)

	if cfg.VerifierRef != "" {
		if mode == SigningModeKeyless || envelopeHasCertificate(envelope) {
			return nil, fmt.Errorf("verifier overrides are not supported for keyless attestations; verify with keyless_identity and keyless_oidc_issuer instead")
		}
		return LoadPEMVerifier(cfg.VerifierRef)
	}

	switch mode {
	case SigningModeKey:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires verifier or key", SigningModeKey)
		}
		return LoadPEMVerifier(cfg.SignerRef)
	case SigningModeKMS:
		if cfg.SignerRef == "" {
			return nil, fmt.Errorf("attestation verification for signing_mode %q requires key or verifier", SigningModeKMS)
		}
		signer, err := NewSigner(ctx, cfg)
		if err != nil {
			return nil, err
		}

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Remove VerifierRef and set KeylessIdentity plus KeylessOIDCIssuer on the config
2. Let the Sigstore bundle sidecar (<file>.sigstore.json) be discovered, or set policy.SigstoreBundlePath explicitly
3. Re-sign with a static key if PEM-based verification is required
4. Set signing_mode=key only when the envelope truly lacks certificates

Example fix

// before
cfg := attestation.BackendConfig{VerifierRef: "key.pub"}

// after
cfg := attestation.BackendConfig{
  Mode:             attestation.SigningModeKeyless,
  KeylessIdentity:  "https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main",
  KeylessOIDCIssuer: "https://token.actions.githubusercontent.com",
}

var probe struct{ Signatures []struct{ Cert string `json:"cert"` } `json:"signatures"` }
_ = json.Unmarshal(contents, &probe)
for _, s := range probe.Signatures {
    if s.Cert != "" && cfg.VerifierRef != "" {
        return errors.New"certificate-bearing (keyless) envelope cannot use VerifierRef")
    }
}

func isKeylessEnvelope(e attestation.Envelope) bool {
    for _, s := range e.Signatures { if strings.TrimSpace(s.Cert) != "" { return true } }
    return false
}

if err := attestation.VerifyAttestationFile(ctx, path, cfg, policy); err != nil {
    if strings.Contains(err.Error(), "verifier overrides are not supported for keyless") {
        return fmt.Errorf"switch to keyless_identity/keyless_oidc_issuer verification: %w", err)
    }
    return err
}

When it happens

Trigger: Calling VerifyAttestationFile with BackendConfig.VerifierRef set on an envelope whose signatures include a cert field, or with Mode=SigningModeKeyless while VerifierRef is also set; combining a --verifier flag with a keyless-signed attestation.

Common situations: Reusing a key-based verification config for artifacts signed via keyless/Fulcio (e.g. GitHub Actions OIDC); copying a template stanza from a key-based pipeline into a keyless one; setting verifier globally in config and forgetting it applies to keyless files too.

Related errors

• signing_mode %q does not support Sigstore bundle emission
• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w
• summarize Fulcio certificate: %w
• attestation verification for signing_mode %q requires verifi

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/4d1e5862ed4bee6f. Report an issue: GitHub.