v0.37.1 Darwin ARM64: published executable checksum differs from provenance subject

Hello Buildx maintainers,

I found a metadata consistency mismatch for buildx-v0.37.1.darwin-arm64 and would appreciate clarification on the intended verification path.

The release API and the exact filename entry in checksums-signed.txt agree on this executable SHA-256:

c3cbbc820d578b0aa8158dd62ef1af25a0c8a75ef53331dbe4e219471e1dbe8c

However, buildx-v0.37.1.darwin-arm64.provenance.json contains one subject with that exact filename and a different SHA-256:

efe594940f5eb29dc1157db9a1c666e829eee75609378aecc15c4bcb430d4102

Both downloaded metadata bodies matched their own API-declared sizes and hashes:

The checksum file contains exactly one matching executable-name record. The provenance uses in-toto Statement v1 and SLSA provenance v1. All three assets were listed as uploaded.

Separately, the checksum asset’s API media type was text/plain; charset=utf-8; the provenance asset’s API media type was application/json, while its downloaded response was application/octet-stream. These transport details do not explain the digest difference.

The inspected v0.37.1 build workflow explicitly excludes Darwin/Windows records from checksums.txt and removes their provenance.sigstore.json bundles. Its pinned reusable workflow signs build provenance.

Those exclusions appear deliberate, but the inspected sources did not establish what changed the executable digest. I am not assuming macOS signing explains it.

Could you clarify:

1. What exact artifact does this provenance subject represent, and is this mismatch expected?
2. Is there official, release-specific evidence verifiably linking these two exact digests?
3. Alternatively, where is qualifying provenance whose subject directly matches the published executable’s c3cbbc…1dbe8c digest?

This was a metadata-only investigation. No executable was downloaded or run, and no signature-verification claim is being made. The verification requirement remains exact digest agreement; unequal hashes have not been accepted as equivalent.

Thank you.

Start with .github/workflows/build.yml and the pinned .github/workflows/bake.yml, then inspect the v0.37.1 release assets and their provenance subjects. Trace how the Darwin ARM64 executable and provenance were produced, and document the exact artifact relationship or the release-specific evidence needed to explain the differing digests.