hashicorp/packer · error

verify Sigstore bundle %q: %w

Error message

verify Sigstore bundle %q: %w

What it means

The sigstore-go verifier rejected the bundle against the policy: certificate chain, signature, transparency-log inclusion, or timestamp checks failed. This is the terminal verification failure for bundle-based evidence and wraps the underlying sigstore-go error, which names the failing check.

Source

Thrown at internal/attestation/verify.go:343

	artifactPolicy := sigstoreverify.WithoutArtifactUnsafe()
	if policy.ArtifactPath != "" {
		artifact, err := os.Open(policy.ArtifactPath)
		if err != nil {
			return fmt.Errorf("open artifact %q for bundle verification: %w", policy.ArtifactPath, err)
		}
		defer func() { _ = artifact.Close() }()
		artifactPolicy = sigstoreverify.WithArtifact(artifact)
	}

	identity, err := sigstoreverify.NewShortCertificateIdentity(cfg.KeylessOIDCIssuer, "", cfg.KeylessIdentity, "")
	if err != nil {
		return fmt.Errorf("build keyless identity policy: %w", err)
	}

	policyBuilder := sigstoreverify.NewPolicy(artifactPolicy, sigstoreverify.WithCertificateIdentity(identity))
	if _, err := verifier.Verify(bundle, policyBuilder); err != nil {
		return fmt.Errorf("verify Sigstore bundle %q: %w", policy.SigstoreBundlePath, err)
	}

	return nil
}

func ensureBundleMatchesEnvelope(bundle *sigstorebundle.Bundle, envelope Envelope) error {
	bundleEnvelope, err := bundle.Envelope()
	if err != nil {
		return fmt.Errorf("extract DSSE envelope from Sigstore bundle: %w", err)
	}

	rawEnvelope := bundleEnvelope.RawEnvelope()
	if rawEnvelope == nil {
		return fmt.Errorf("sigstore bundle does not contain a DSSE envelope")
	}

	if rawEnvelope.PayloadType != envelope.PayloadType || rawEnvelope.Payload != envelope.Payload {
		return fmt.Errorf("sigstore bundle payload does not match attestation")

View on GitHub (pinned to eb36e3c3e4)

Solutions

1. Read the wrapped sigstore-go error to see which check failed (certificate, signature, tlog, timestamp)
2. Re-sync system clock (NTP) and refresh trusted root, then retry
3. Re-obtain the bundle/attestation from the signing step; confirm the artifact is byte-identical to the signed one
4. Relax or align policy flags: only pass RequireTransparencyLog/RequireObserverTimestamp if the bundle actually carries that evidence

if err := verify(...); err != nil {
    if strings.Contains(err.Error(), "verify Sigstore bundle") {
        inner := errors.Unwrap(errors.Unwrap(err))
        log.Printf("sigstore verification failed: %v", inner) // names failing check
    }
}

When it happens

Trigger: verifier.Verify(bundle, policyBuilder) returns an error: expired/invalid Fulcio cert, signature mismatch, RequireTransparencyLog set but bundle lacks a valid Rekor entry, RequireObserverTimestamp set but no trusted timestamp, or identity policy does not match the certificate.

Common situations: Verifying an old bundle after the Fulcio root rotated; artifact bytes changed since signing (digest mismatch); requiring Rekor inclusion on a bundle without an entry; system clock far off (timestamp validation); identity/issuer mismatch with the certificate.

Related errors

• verify signed attestation: %w
• signing_mode %q does not support Sigstore bundle emission
• unsupported public key type %T
• verify Fulcio certificate chain: %w
• verify Fulcio certificate SCT: %w

AI-assisted analysis of hashicorp/packer@eb36e3c3e4 (2026-09-05). Data as JSON: /api/errors/dabc8b742cd9b492. Report an issue: GitHub.