[BUG] npm publish --provenance fails with TLOG_CREATE_ENTRY_ERROR (409) when Rekor entry already exists #10078

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

npm publish --provenance (also via libnpmpublish, e.g. through lerna publish) intermittently fails with:

TLOG_CREATE_ENTRY_ERROR error creating tlog entry - (409) an equivalent entry already exists in the transparency log with UUID <uuid>

The package is not published. In a monorepo release (lerna 10, libnpmpublish@11.1.2, npm 11.19.0, GitHub Actions) this left 22 of 23 packages published and one missing, so the release ended up half-done.

This looks like a retry-after-success path: Rekor commits the create-entry request, the client then times out or gets a retryable response and retries, and Rekor correctly answers 409 for the now-existing equivalent entry. The 409 is treated as fatal.

@sigstore/sign already has a recovery path for this (TLogClient fetches the existing entry when fetchOnConflict is true), but it's off:

• sigstore hard-codes fetchOnConflict: false in initWitnesses (dist/config.js) and doesn't read it from the options passed to sigstore.attest().
• libnpmpublish/lib/provenance.js calls sigstore.attest(...), so there is no way to enable it from npm today.

Expected Behavior

A 409 for an equivalent existing Rekor entry should be recovered by fetching that entry and continuing, so that npm publish --provenance is idempotent with respect to tlog creation.

Steps To Reproduce

Not deterministic (needs Rekor to commit an entry and the client to retry). Seen in CI on npm publish --provenance / lerna publish in a GitHub Actions workflow with id-token: write.

Environment

• npm: 11.19.0
• libnpmpublish: 11.1.2 (via lerna 10.0.1)
• sigstore / @sigstore/sign: 4.1.1
• Node: LTS on ubuntu-latest (GitHub Actions)

Additional context

Same root cause is tracked on the sigstore side in sigstore/sigstore-js#1708. There the maintainer prefers not to change the library default before a major release and suggested enabling it from the npm CLI instead. Since sigstore doesn't currently accept the option, a non-breaking fix would be:

1. sigstore-js: allow fetchOnConflict to be passed through sigstore.attest() options (default unchanged).
2. libnpmpublish: pass fetchOnConflict: true when generating provenance.