kubernetes/kops · error

parsing PKCS7 signature: %w

Error message

parsing PKCS7 signature: %w

What it means

This wraps a failure from go-pkcs7's pkcs7.Parse when the base64-decoded bytes could not be parsed as a PKCS#7/CMS SignedData structure. It means the signature decoded successfully but the DER bytes are not a well-formed PKCS#7 message, so signature verification could not proceed.

Source

Thrown at upup/pkg/fi/cloudup/azure/attest.go:246

// parseAndValidatePKCS7Signer decodes and parses a base64-encoded PKCS7 signature, verifies its
// self-signature, and validates that the signer certificate's SAN identifies an Azure metadata
// endpoint. All checks here are CPU-only; no network I/O is performed, so this is safe to call
// before triggering intermediate certificate fetches.
func parseAndValidatePKCS7Signer(signature string) (*pkcs7.PKCS7, *x509.Certificate, error) {
	if signature == "" {
		return nil, nil, fmt.Errorf("empty PKCS7 signature")
	}

	sigBytes, err := base64.StdEncoding.DecodeString(signature)
	if err != nil {
		return nil, nil, fmt.Errorf("decoding PKCS7 signature: %w", err)
	}
	klog.V(4).Infof("Decoded PKCS7 signature (%d bytes)", len(sigBytes))

	p7, err := pkcs7.Parse(sigBytes)
	if err != nil {
		return nil, nil, fmt.Errorf("parsing PKCS7 signature: %w", err)
	}
	klog.V(8).Infof("Parsed PKCS7 structure with %d embedded certificate(s)", len(p7.Certificates))

	// Verify the PKCS7 signature against the embedded leaf certificate.
	if err := p7.Verify(); err != nil {
		return nil, nil, fmt.Errorf("verifying PKCS7 signature: %w", err)
	}
	klog.V(4).Infof("PKCS7 self-signature verified")

	signer := p7.GetOnlySigner()
	if signer == nil {
		return nil, nil, fmt.Errorf("PKCS7 signer certificate not found")
	}
	klog.V(8).Infof("PKCS7 signer certificate: subject=%q issuer=%q SANs=%v", signer.Subject, signer.Issuer, signer.DNSNames)
	if err := validateAzureMetadataSignerSAN(signer); err != nil {
		return nil, nil, fmt.Errorf("validating PKCS7 signer SAN: %w", err)
	}
	klog.V(4).Infof("PKCS7 signer SAN validated as Azure metadata endpoint")

View on GitHub (pinned to 4c8573c808)

Solutions

1. Dump the decoded bytes (hex) and run `openssl pkcs7 -inform DER -text` to confirm they form a PKCS#7 SignedData structure
2. If the bytes are PEM-encoded, strip the BEGIN/END armor and base64-decode the inner payload before passing it
3. Verify the attested document fetcher returns the complete, untruncated IMDS response (compare Content-Length with received bytes)
4. Regenerate test fixtures using a real Azure attested document or a correctly DER-encoded PKCS7 blob rather than hand-written strings

Example fix

// before
sigBytes, _ := base64.StdEncoding.DecodeString("-----BEGIN PKCS7-----\nMIAG...") // armor stripped incorrectly, parse fails
p7, err := pkcs7.Parse(sigBytes)
// after
inner := strings.TrimSuffix(strings.TrimPrefix(pemBody, "-----BEGIN PKCS7-----"), "-----END PKCS7-----")
sigBytes, _ := base64.StdEncoding.DecodeString(strings.TrimSpace(inner))
p7, err := pkcs7.Parse(sigBytes)

sigBytes, err := base64.StdEncoding.DecodeString(signature)
if err != nil {
    return err
}
if len(sigBytes) < 8 || !bytes.HasPrefix(sigBytes, []byte{0x30}) {
    return fmt.Errorf("decoded signature is not DER (missing ASN.1 SEQUENCE header)")
}

func looksLikeDER(b []byte) bool {
    return len(b) >= 2 && b[0] == 0x30 && int(b[1]) <= len(b)-2
}

p7, err := pkcs7.Parse(sigBytes)
if err != nil {
    klog.V(4).Infof("pkcs7.Parse failed (%d bytes): %v; first bytes: % x", len(sigBytes), err, sigBytes[:min(8, len(sigBytes))])
    return nil, nil, fmt.Errorf("parsing PKCS7 signature: %w", err)
}

When it happens

Trigger: parseAndValidatePKCS7Signer passes sigBytes to pkcs7.Parse; the underlying bytes are not DER (e.g. PEM headers left in, JSON, DER of the wrong ASN.1 type), or are truncated mid-sequence.

Common situations: Fake IMDS responses in tests containing arbitrary base64 strings; PEM-wrapped certificates ('-----BEGIN PKCS7-----') pasted as the signature; a truncated attested document from a network hiccup; pointing the code at a non-Azure metadata service whose signature format differs.

Related errors

• decoding PKCS7 signature: %w
• verifying PKCS7 signature: %w
• PKCS7 signer certificate not found
• validating PKCS7 signer SAN: %w
• attested document expired at %s

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/3a789fca0693b573. Report an issue: GitHub.