Recordsnpm@sigstore/signfailure issue
Failure signature
UNKNOWN exit 1 Evidence gap ×1
<path>:<n> · throw new error_1.UnsignedMetadataError(`${delegatedRole} was signed by ${signingKeys.size}/${role.threshold} keys`); · ^ …
Evidence quality: complete · node · unclassified-diagnostic · outer node · gap stage-unknown · First recorded: 2026-10-18 · Last seen: 2026-10-18
sha256:5cb8e084fdab…
Where it was measured
PASS means the release recorded a passing observation at UNKNOWN and no record of this failure. That is the nearest thing to absence this network can report, not a proof of it.
Where it reproduced
- executionContext=node · moduleSystem=esm · os=linux · runtime=node@22.23 ×1 2026-10-18 → 2026-10-18
Nearest known PASS/FAIL boundaries
No release either side of this failure recorded a passing observation at this stage, so where it starts and stops is not established.
Dependency versions across releases
What each release of this package resolved its children to. A child whose version moved is listed first: that is where an upgrade changed something underneath you.
| Library | 4.1.1 | 4.1.0 | 3.1.0 |
|---|---|---|---|
| @sigstore/bundle | 4.0.0 | 4.0.0 | 3.1.0 |
| @sigstore/core | 3.2.1 | 3.1.0 | 2.0.0 |
| @sigstore/protobuf-specs | 0.5.1 | 0.5.0 | 0.4.3 |
| make-fetch-happen | 15.0.6 | 15.0.3 | 14.0.3 |
| proc-log | 6.1.0 | 6.1.0 | 5.0.0 |
| @gar/promise-retry | 1.0.3 | — | — |
| promise-retry | — | 2.0.1 | 2.0.1 |
Moved: 5 · unchanged at every release: 2
An edge records that a resolver placed one release beside another on a real machine. It is not a claim that the two work together; that question is answered by samples and contracts, not by presence here.
Evidence gaps
- The evidence for this failure was not preserved, so it has no established cause. Its stored hash is provenance, not an identity.
- The captured output could not establish: stage-unknown.
- No release in this window recorded a passing observation at UNKNOWN.
- Releases in this window never measured at UNKNOWN: 2
- No failure domain was inferred for this failure.
Published answers for the affected releases
- @sigstore/sign 3.1.0: InternalError This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOW@sigstore/sign.InternalError MIT-0 · 2026-10-18
- @sigstore/sign 3.1.0: DSSEBundleBuilder This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOW@sigstore/sign.DSSEBundleBuilder MIT-0 · 2026-10-18
- @sigstore/sign 3.1.0 This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. HOW MIT-0 · 2026-10-18