What causes "Rekor transparency log returned no entries" in denoland/deno?

Retry the publish (bump the version if the partial upload consumed it) — transient Rekor failures are the usual cause

denoland/deno · error · anyhow::Error

Rekor transparency log returned no entries

Error message

Rekor transparency log returned no entries

What it means

With `--provenance`, after Fulcio signs the attestation Deno submits it to the Rekor transparency log (`testify`) and embeds the first returned entry into the provenance bundle. If the Rekor response contains zero entries there is nothing to embed, so publish fails. An empty entry list is a server-side anomaly (outage, throttling, API change), not a local misconfiguration.

Source

Thrown at cli/tools/publish/provenance.rs:357

  let content = SignatureBundle {
    case: "dsseSignature",
    dsse_envelope: Envelope {
      payload_type: type_.to_string(),
      payload: BASE64_STANDARD.encode(data),
      signatures: vec![Signature {
        keyid: "",
        sig: BASE64_STANDARD.encode(signature.as_ref()),
      }],
    },
  };
  let transparency_logs =
    testify(http_client, &content, &key_material.certificate).await?;

  // First log entry is the one we're interested in
  let (_, log_entry) = transparency_logs
    .iter()
    .next()
    .ok_or_else(|| anyhow!("Rekor transparency log returned no entries"))?;

  let bundle = ProvenanceBundle {
    media_type: "application/vnd.in-toto+json",
    content,
    verification_material: VerificationMaterial {
      content: VerificationMaterialContent {
        case: "x509CertificateChain",
        x509_certificate_chain: X509CertificateChain {
          certificates: [X509Certificate {
            raw_bytes: key_material.certificate,
          }],
        },
      },
      tlog_entries: [TlogEntry {
        log_index: log_entry.log_index,
      }],
    },
  };

View on GitHub (pinned to 89f33cbef2)

Solutions

Retry the publish (bump the version if the partial upload consumed it) — transient Rekor failures are the usual cause
Check Rekor reachability from the runner: curl https://rekor.sigstore.dev/api/v1/log
Bypass proxies or TLS inspection for *.sigstore.dev if applicable
If persistent on the latest Deno, open an issue with DENO_LOG=debug output

Defensive patterns

Strategy: retry

Validate before calling

# preflight: is Rekor reachable from this runner?
curl -fsS https://rekor.sigstore.dev/api/v1/log > /dev/null \
  || { echo "rekor.sigstore.dev unreachable" >&2; exit 1; }

Try / catch

Wrap the publish in a bounded retry with backoff in CI:
```sh
for i in 1 2 3; do
  if deno publish --provenance; then exit 0; fi
  echo "attempt $i failed; retrying after backoff" >&2
  sleep $((i * 30))
done
exit 1
```
Bump the package version between retries if a partial upload consumed the version.

Prevention

Check Rekor/Sigstore status before release windows
Allow egress to *.sigstore.dev in runner networking and bypass TLS-intercepting proxies
Treat provenance failures as transient first: retry with a fresh version before debugging locally

When it happens

Trigger: `deno publish --provenance` in GitHub Actions where the Rekor API (rekor.sigstore.dev) returns an empty entry set — a transient Rekor incident, rate limiting, or a proxy mangling the response.

Common situations: Sigstore/Rekor outages; corporate proxies or TLS-inspecting middleboxes altering API responses; publishing during peak registry load.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/ca405d927eda99ee. Report an issue: GitHub.