denoland/deno · error · AnyError

Rekor transparency log returned no entries

Error message

Rekor transparency log returned no entries

What it means

After signing the provenance attestation, Deno submits it to the Rekor transparency log (`testify()`) and reads back the logged entries; taking `.iter().next()` of the returned list fails with this error when the response contained zero entries. That is a server-side/infrastructure outcome — a valid inclusion normally always returns at least the entry for the just-submitted attestation.

Solutions

1. Simply re-run `deno publish` — empty Rekor responses are almost always transient; also bump nothing since the failed publish did not complete.
2. Check Sigstore/Rekor status pages (status.sigstore.dev) if the error repeats, and retry after recovery.
3. Verify no corporate proxy is intercepting/rewriting HTTPS responses to api.sigstore.dev; exclude it from inspection.
4. If it persists deterministically, capture `DENO_LOG=debug` output and report it upstream.

const maxAttempts = 3;
for (let attempt = 1; attempt <= maxAttempts; attempt++) {
  try {
    await runDeno(['publish', '--provenance']);
    break;
  } catch (e) {
    const msg = String(e.message);
    if (msg.includes('Rekor transparency log returned no entries') && attempt < maxAttempts) {
      await delay(30_000 * attempt); // exponential-ish backoff, then retry
      continue;
    }
    throw e;
  }
}

When it happens

Trigger: `deno publish --provenance` where the Rekor API (via the signing infrastructure) responds 200 with an empty body/list; transient upstream outage of the transparency log; a proxy or GHE environment returning an unexpected empty payload.

Common situations: Flaky publish runs in CI that succeed on retry; rare outages of the public Sigstore/Rekor infrastructure; corporate proxies mangling responses. Almost always transient, not a code problem.

Related errors

• No certificate chain returned
• Failed to fetch package manifest from
• Automatic provenance is only available in GitHub Actions
• Checksum mismatch for
• Export mismatch: expected , got

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/ca405d927eda99ee. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:357

  let content = SignatureBundle {
    case: "dsseSignature",
    dsse_envelope: Envelope {
      payload_type: type_.to_string(),
      payload: BASE64_STANDARD.encode(data),
      signatures: vec![Signature {
        keyid: "",
        sig: BASE64_STANDARD.encode(signature.as_ref()),
      }],
    },
  };
  let transparency_logs =
    testify(http_client, &content, &key_material.certificate).await?;

  // First log entry is the one we're interested in
  let (_, log_entry) = transparency_logs
    .iter()
    .next()
    .ok_or_else(|| anyhow!("Rekor transparency log returned no entries"))?;

  let bundle = ProvenanceBundle {
    media_type: "application/vnd.in-toto+json",
    content,
    verification_material: VerificationMaterial {
      content: VerificationMaterialContent {
        case: "x509CertificateChain",
        x509_certificate_chain: X509CertificateChain {
          certificates: [X509Certificate {
            raw_bytes: key_material.certificate,
          }],
        },
      },
      tlog_entries: [TlogEntry {
        log_index: log_entry.log_index,
      }],
    },
  };

View on GitHub (pinned to 9ad36f7a2c)