Skip to main content

Failed to verify GitHub Artifact Attestations

aqua >= v2.66.1

You may face the error when you install a package providing GitHub Artifact Attestations.

e.g.

$ aqua i
WRN execute gh attestation verify args="attestation verify ... -R suzuki-shunsuke/mkghtag" credential=gh error="exit status 1" failure=rate_limit ...
ERR aqua failed doc="https://aquaproj.github.io/docs/reference/codes/008" error="verify a package with gh attestation: verify GitHub Artifact Attestations" program=aqua

What does this error mean?​

aqua verifies GitHub Artifact Attestations by running GitHub CLI (gh attestation verify) internally. This error means the verification failed, so aqua didn't install the package.

aqua tries GitHub access tokens in order until the verification succeeds.

If GitHub CLI has its own credential (GH_TOKEN, GITHUB_TOKEN, or gh auth login):

  1. GitHub CLI's own credential
  2. AQUA_GITHUB_TOKEN
  3. The access token managed by the keyring
  4. The access token managed by ghtkn

Otherwise:

  1. AQUA_GITHUB_TOKEN
  2. The access token managed by the keyring
  3. The access token managed by ghtkn
  4. No access token

The same access token isn't tried twice even if it comes from different sources. Access tokens which are invalid or hit the rate limit aren't used for the rest of the process.

Before aqua v2.66.1, aqua skipped the verification if GitHub CLI failed because of the authentication. aqua doesn't skip it anymore, because skipping the verification would install packages without verifying them.

The output of GitHub CLI and the warning execute gh attestation verify show the cause. The attribute failure of the warning shows how aqua classified the failure. aqua outputs GitHub CLI's outputs of all attempts after the verification fails. If the verification succeeds with a fallback access token, only the output of the successful attempt is shown.

How to solve the error​

The verification failed (failure=verification)​

GitHub CLI outputs verifying with issuer or expected ... to be ..., got ....

The package may be tampered with, or the registry settings may be wrong. Please don't disable the verification to avoid the error. Please check the package and the registry settings.

No attestation is found (failure=no_attestation)​

GitHub CLI outputs no attestations found.

The package doesn't provide GitHub Artifact Attestations, or the registry settings may be wrong. Please check the registry settings.

Rate limit, authentication, or permission errors (failure=rate_limit, failure=invalid_token, failure=auth, failure=permission)​

GitHub CLI outputs API rate limit exceeded, HTTP 401: Bad credentials, gh auth login, or HTTP 403.

Without an access token, GitHub CLI calls GitHub API without authentication, so the verification may fail because of the rate limit of unauthenticated requests (60 requests per hour per IP address). Please pass a valid GitHub access token by one of the following ways.

On GitHub Actions, you can pass the access token easily.

- run: aqua i
  env:
    GITHUB_TOKEN: ${{ github.token }}

If the access token is blocked by SAML SSO, please authorize the access token for the organization.

Not Found (failure=not_found)​

GitHub CLI outputs HTTP 404: Not Found.

If the package is a private repository, please pass a GitHub access token which can access the repository, and set private: true in the registry. aqua tries other access tokens only if the package is private. If private: true isn't set, aqua treats the package as public and fails immediately, because attestations of public repositories can be read without an access token.

Note that private is the setting of the package itself. If the registry looks up attestations in another repository by github_artifact_attestations.repository, aqua can't know whether that repository is private.

Temporary errors (failure=temporary)​

GitHub CLI outputs HTTP 5xx or network errors such as dial tcp and i/o timeout. aqua retries them up to 4 times in total, and then tries the remaining access tokens once each. Please check the network and GitHub Status, and retry later.

Unknown errors (failure=unknown)​

aqua doesn't retry unknown errors or try other access tokens, because they may not be solved by retrying. Please check the output of GitHub CLI. If the error should be handled by aqua, please create an issue.

No GitHub access token is available​

aqua outputs no GitHub access token is available for gh attestation verify. All access tokens have been disabled because they were invalid or hit the rate limit. Please pass a valid GitHub access token as described above.

Disable the verification​

If you can't solve the error, you can disable the verification by the environment variable. We don't recommend it for security.

export AQUA_DISABLE_GITHUB_ARTIFACT_ATTESTATION=true