{"record":{"id":"ca405d927eda99ee","repo":"denoland/deno","slug":"rekor-transparency-log-returned-no-entries","errorCode":null,"errorMessage":"Rekor transparency log returned no entries","messagePattern":"Rekor transparency log returned no entries","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":357,"sourceCode":"  let content = SignatureBundle {\n    case: \"dsseSignature\",\n    dsse_envelope: Envelope {\n      payload_type: type_.to_string(),\n      payload: BASE64_STANDARD.encode(data),\n      signatures: vec![Signature {\n        keyid: \"\",\n        sig: BASE64_STANDARD.encode(signature.as_ref()),\n      }],\n    },\n  };\n  let transparency_logs =\n    testify(http_client, &content, &key_material.certificate).await?;\n\n  // First log entry is the one we're interested in\n  let (_, log_entry) = transparency_logs\n    .iter()\n    .next()\n    .ok_or_else(|| anyhow!(\"Rekor transparency log returned no entries\"))?;\n\n  let bundle = ProvenanceBundle {\n    media_type: \"application/vnd.in-toto+json\",\n    content,\n    verification_material: VerificationMaterial {\n      content: VerificationMaterialContent {\n        case: \"x509CertificateChain\",\n        x509_certificate_chain: X509CertificateChain {\n          certificates: [X509Certificate {\n            raw_bytes: key_material.certificate,\n          }],\n        },\n      },\n      tlog_entries: [TlogEntry {\n        log_index: log_entry.log_index,\n      }],\n    },\n  };","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/cli/tools/publish/provenance.rs#L339-L375","documentation":"With `--provenance`, after Fulcio signs the attestation Deno submits it to the Rekor transparency log (`testify`) and embeds the first returned entry into the provenance bundle. If the Rekor response contains zero entries there is nothing to embed, so publish fails. An empty entry list is a server-side anomaly (outage, throttling, API change), not a local misconfiguration.","triggerScenarios":"`deno publish --provenance` in GitHub Actions where the Rekor API (rekor.sigstore.dev) returns an empty entry set — a transient Rekor incident, rate limiting, or a proxy mangling the response.","commonSituations":"Sigstore/Rekor outages; corporate proxies or TLS-inspecting middleboxes altering API responses; publishing during peak registry load.","solutions":["Retry the publish (bump the version if the partial upload consumed it) — transient Rekor failures are the usual cause","Check Rekor reachability from the runner: curl https://rekor.sigstore.dev/api/v1/log","Bypass proxies or TLS inspection for *.sigstore.dev if applicable","If persistent on the latest Deno, open an issue with DENO_LOG=debug output"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# preflight: is Rekor reachable from this runner?\ncurl -fsS https://rekor.sigstore.dev/api/v1/log > /dev/null \\\n  || { echo \"rekor.sigstore.dev unreachable\" >&2; exit 1; }","typeGuard":null,"tryCatchPattern":"Wrap the publish in a bounded retry with backoff in CI:\n```sh\nfor i in 1 2 3; do\n  if deno publish --provenance; then exit 0; fi\n  echo \"attempt $i failed; retrying after backoff\" >&2\n  sleep $((i * 30))\ndone\nexit 1\n```\nBump the package version between retries if a partial upload consumed the version.","preventionTips":["Check Rekor/Sigstore status before release windows","Allow egress to *.sigstore.dev in runner networking and bypass TLS-intercepting proxies","Treat provenance failures as transient first: retry with a fresh version before debugging locally"],"tags":["publish","provenance","rekor","sigstore","network"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}