Looks like npm does some validation on the server side that isn't compatible with SLSA v1.0 provenance generated BYOB

npm ERR! code E422
npm ERR! 422 Unprocessable Entity - PUT https://registry.npmjs.org/@ianlewis%2factions-test - Error verifying sigstore provenance bundle: Invalid GitHub Actions SLSA v1 provenance predicate:
npm ERR! buildDefinition.buildType: https://github.com/slsa-framework/slsa-github-generator/delegator-generic@v0 does not match expected value for buildType: https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1,
npm ERR! buildDefinition.externalParameters.workflow.ref: <empty> does not match expected value for SourceRepositoryRef: refs/tags/v0.1.160,
npm ERR! buildDefinition.externalParameters.workflow.repository: <empty> does not match expected value for SourceRepositoryURI: https://github.com/ianlewis/actions-test,
npm ERR! buildDefinition.externalParameters.workflow.path: <empty> does not match expected value for BuildConfigURI: .github/workflows/nodejs.yml,
npm ERR! buildDefinition.internalParameters.github.event_name: <empty> does not match expected value for BuildTrigger: push,
npm ERR! buildDefinition.internalParameters.github.repository_id: <empty> does not match expected value for SourceRepositoryIdentifier: 474793590,
npm ERR! buildDefinition.internalParameters.github.repository_owner_id: <empty> does not match expected value for SourceRepositoryOwnerIdentifier: 49289,
npm ERR! runDetails.builder.id: https://github.com/ianlewis/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@refs/heads/nodejs-slsa-v10 does not match expected value for builderId: https://github.com/actions/runner/github-hosted

https://github.com/ianlewis/actions-test/actions/runs/5817446938/job/15772122301

This might be the kind of thing that could be solved by slsa-framework/slsa#940

/cc @steiza @MarkLodato @joshuagl

[feature][nodejs] SLSA v1.0 support #2499

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions