Recordsnpm@sigstore/verify2.1.1VerificationError
Change the conditions
Current conditions
VerificationError @2.1.1debian glibc · x64 · node 22 · npm · node
1 of 1 passed
Verified — this network ran a contract at this coordinate.
there is a sample here, and our run of it at this coordinate came back clean (2)
- Project observations
- 2 / 2
- Contract verifications
- 1 / 1
- Independent reporting peers
- 1
- Last recorded
- 2026-10-18
Dependency Health
Observed combinations and failure evidence for this release
First observed break
2.1.1
linux · node@22.23 · moduleSystem=esm · executionContext=node
1 FAIL
· stage: PROJECT_TEST
· fingerprint: sha256:8c3539be02dd1f227f1488acb657f9634df98ca1b6ac135aa61c43f89c559110
| Library | Version | Health | Measured there | Projects |
|---|---|---|---|---|
| @sigstore/bundle | 3.1.0 | CANDIDATE Correlated change; unproven combination | contract passed | 25 project-days |
| @sigstore/core | 2.0.0 | CANDIDATE Correlated change; unproven combination | contract passed | 25 project-days |
| @sigstore/protobuf-specs | 0.4.3 | CANDIDATE Correlated change; unproven combination | contract passed | 25 project-days |
The measured column is about each dependency's own release, not about the pair. A resolver placing two releases side by side is not evidence that they work together.
Dependency versions across releases
What each release of this package resolved its children to. A child whose version moved is listed first: that is where an upgrade changed something underneath you.
| Library | 3.1.1 | 3.1.0 | 2.1.1 |
|---|---|---|---|
| @sigstore/bundle | 4.0.0 | 4.0.0 | 3.1.0 |
| @sigstore/core | 3.2.1 | 3.1.0 | 2.0.0 |
| @sigstore/protobuf-specs | 0.5.1 | 0.5.0 | 0.4.3 |
Moved: 3 · unchanged at every release: 0
An edge records that a resolver placed one release beside another on a real machine. It is not a claim that the two work together; that question is answered by samples and contracts, not by presence here.
Recent failure clusters
-
observed PROJECT_TEST exit 1 ERR_ASSERTION ×1 2.1.1 executionContext=node · moduleSystem=esm · os=linux · runtime=node@22.23 sha256:8c3539be02dd…AssertionError [ERR_ASSERTION]: Expected values to be strictly deep-equal: · + actual - expected · Comparison { · + message: <str>,javascript/test-runner · test-runner-diagnostic · outer npm testEvidence quality: complete · Environment variants: 1 · First recorded: 2026-10-18 · Last seen: 2026-10-18
-
observed UNKNOWN exit 1 Evidence gap ×1 2.1.1 executionContext=node · moduleSystem=esm · os=linux · runtime=node@22.23 sha256:5cb8e084fdab…<path>:<n> · throw new error_1.UnsignedMetadataError(`${delegatedRole} was signed by ${signingKeys.size}/${role.threshold} keys`); · ^ …node · unclassified-diagnostic · outer node · gap stage-unknownEvidence quality: complete · Environment variants: 1 · First recorded: 2026-10-18 · Last seen: 2026-10-18Diagnostic re-verification candidate