google / google/go-containerregistry
crane: Build provenances have been failing since v0.19.2
- Dominant language
- Go
- Stars
- 4k
- Forks
- 686
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 26
Description
### Describe the bug
Build provenances are not properly included with releases since v0.19.2
```
No certificate provided, trying Redis search index to find entries by subject digest
Verifying artifact go-containerregistry.tar.gz: FAILED: error searching rekor entries: no matching entries found
FAILED: SLSA verification failed: error searching rekor entries: no matching entries found
```
### To Reproduce
https://github.com/google/go-containerregistry/actions/runs/9966916706/job/27539952152
https://github.com/google/go-containerregistry/actions/runs/9845572711/job/27181699181
https://github.com/google/go-containerregistry/actions/runs/9527779284/job/26264811699
### Expected behavior
Proper build provenances to be included in the release to they can be used for validation.
### Additional context
N/A
Contributor guide
Assessment
This issue has not been assessed yet.