{"record":{"id":"ca405d927eda99ee","repo":"denoland/deno","slug":"rekor-transparency-log-returned-no-entries","errorCode":null,"errorMessage":"Rekor transparency log returned no entries","messagePattern":"Rekor transparency log returned no entries","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":357,"sourceCode":"  let content = SignatureBundle {\n    case: \"dsseSignature\",\n    dsse_envelope: Envelope {\n      payload_type: type_.to_string(),\n      payload: BASE64_STANDARD.encode(data),\n      signatures: vec![Signature {\n        keyid: \"\",\n        sig: BASE64_STANDARD.encode(signature.as_ref()),\n      }],\n    },\n  };\n  let transparency_logs =\n    testify(http_client, &content, &key_material.certificate).await?;\n\n  // First log entry is the one we're interested in\n  let (_, log_entry) = transparency_logs\n    .iter()\n    .next()\n    .ok_or_else(|| anyhow!(\"Rekor transparency log returned no entries\"))?;\n\n  let bundle = ProvenanceBundle {\n    media_type: \"application/vnd.in-toto+json\",\n    content,\n    verification_material: VerificationMaterial {\n      content: VerificationMaterialContent {\n        case: \"x509CertificateChain\",\n        x509_certificate_chain: X509CertificateChain {\n          certificates: [X509Certificate {\n            raw_bytes: key_material.certificate,\n          }],\n        },\n      },\n      tlog_entries: [TlogEntry {\n        log_index: log_entry.log_index,\n      }],\n    },\n  };","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L339-L375","documentation":"After signing the provenance attestation, Deno submits it to the Rekor transparency log (`testify()`) and reads back the logged entries; taking `.iter().next()` of the returned list fails with this error when the response contained zero entries. That is a server-side/infrastructure outcome — a valid inclusion normally always returns at least the entry for the just-submitted attestation.","triggerScenarios":"`deno publish --provenance` where the Rekor API (via the signing infrastructure) responds 200 with an empty body/list; transient upstream outage of the transparency log; a proxy or GHE environment returning an unexpected empty payload.","commonSituations":"Flaky publish runs in CI that succeed on retry; rare outages of the public Sigstore/Rekor infrastructure; corporate proxies mangling responses. Almost always transient, not a code problem.","solutions":["Simply re-run `deno publish` — empty Rekor responses are almost always transient; also bump nothing since the failed publish did not complete.","Check Sigstore/Rekor status pages (status.sigstore.dev) if the error repeats, and retry after recovery.","Verify no corporate proxy is intercepting/rewriting HTTPS responses to api.sigstore.dev; exclude it from inspection.","If it persists deterministically, capture `DENO_LOG=debug` output and report it upstream."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"const maxAttempts = 3;\nfor (let attempt = 1; attempt <= maxAttempts; attempt++) {\n  try {\n    await runDeno(['publish', '--provenance']);\n    break;\n  } catch (e) {\n    const msg = String(e.message);\n    if (msg.includes('Rekor transparency log returned no entries') && attempt < maxAttempts) {\n      await delay(30_000 * attempt); // exponential-ish backoff, then retry\n      continue;\n    }\n    throw e;\n  }\n}","preventionTips":["Treat Rekor/empty-response errors as transient; retry the publish with backoff.","Monitor Sigstore status during release windows.","Keep corporate proxies from intercepting api.sigstore.dev traffic.","A failed publish leaves no partial release on jsr.io, so a plain retry is safe."],"tags":["publish","provenance","sigstore","rekor","transparency-log","network"],"backgroundTag":"transparency-log-empty-response","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}