Recordsnpm@sigstore/bundlefailure issue
Failure signature
PROJECT_TEST exit 1 ERR_ASSERTION ×1
AssertionError [ERR_ASSERTION]: Expected values to be strictly equal: · + actual - expected · + <str> · - <str>
Evidence quality: complete · javascript/test-runner · test-runner-diagnostic · outer npm test · First recorded: 2026-10-18 · Last seen: 2026-10-18
sha256:4904e63e5296…
Where it was measured
PASS means the release recorded a passing observation at PROJECT_TEST and no record of this failure. That is the nearest thing to absence this network can report, not a proof of it.
Where it reproduced
- executionContext=node · moduleSystem=esm · os=linux · runtime=node@22.23 ×1 2026-10-18 → 2026-10-18
Nearest known PASS/FAIL boundaries
No release either side of this failure recorded a passing observation at this stage, so where it starts and stops is not established.
Dependency versions across releases
What each release of this package resolved its children to. A child whose version moved is listed first: that is where an upgrade changed something underneath you.
| Library | 4.0.0 | 3.1.0 |
|---|---|---|
| @sigstore/protobuf-specs | 0.5.0 | 0.4.3 |
Moved: 1 · unchanged at every release: 0
An edge records that a resolver placed one release beside another on a real machine. It is not a claim that the two work together; that question is answered by samples and contracts, not by presence here.
Evidence gaps
- No release in this window recorded a passing observation at PROJECT_TEST.
- Releases in this window never measured at PROJECT_TEST: 1
- No failure domain was inferred for this failure.
Published answers for the affected releases
- @sigstore/bundle 3.1.0: BUNDLE_V02_MEDIA_TYPE This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOW@sigstore/bundle.BUNDLE_V02_MEDIA_TYPE MIT-0 · 2026-10-18
- @sigstore/bundle 3.1.0: assertBundle, assertBundleLatest, bundleFromJSON This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOWassertBundleassertBundleLatestbundleFromJSONbundleToJSONtoDSSEBundletoMessageSignatureBundlenode MIT-0 · 2026-10-18