google / google/go-containerregistry

crane: Build provenances have been failing since v0.19.2

Open
#1,982 6 comments 5 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
4k
Forks
686
Avg merge
2d 12h
Merged PRs (30d)
26

Description

### Describe the bug

Build provenances are not properly included with releases since v0.19.2

```
No certificate provided, trying Redis search index to find entries by subject digest
Verifying artifact go-containerregistry.tar.gz: FAILED: error searching rekor entries: no matching entries found

FAILED: SLSA verification failed: error searching rekor entries: no matching entries found
```

### To Reproduce

https://github.com/google/go-containerregistry/actions/runs/9966916706/job/27539952152
https://github.com/google/go-containerregistry/actions/runs/9845572711/job/27181699181
https://github.com/google/go-containerregistry/actions/runs/9527779284/job/26264811699

### Expected behavior

Proper build provenances to be included in the release to they can be used for validation.

### Additional context

N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.