'failed to fetch attestations' error #5495

aerickson · 2024-07-15T20:02:11Z

aerickson
Jul 15, 2024

Output of `brew config`

HOMEBREW_VERSION: 4.3.9-245-gcb48a95
ORIGIN: https://github.com/Homebrew/brew
HEAD: cb48a95bbd2fb17a2b927c6bb77f0c65cfd9935c
Last commit: 70 minutes ago
Core tap HEAD: 4d26d5546369dae8caabf6dfd0b3e4ee48f4d8e8
Core tap last commit: 4 weeks ago
Core tap JSON: 15 Jul 19:21 UTC
Core cask tap HEAD: c14d46031fee9e4ace71d9419c99594728d7a877
Core cask tap last commit: 4 weeks ago
Core cask tap JSON: 15 Jul 19:21 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DISPLAY: /private/tmp/com.apple.launchd.Sek3uxis4L/org.xquartz:0
HOMEBREW_EDITOR: nvim
HOMEBREW_GITHUB_API_TOKEN: set
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 3.3.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.4/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 15.0.0 build 1500
Git: 2.45.2 => /opt/homebrew/bin/git
Curl: 8.6.0 => /usr/bin/curl
macOS: 14.5-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

Output of `brew doctor`

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Some installed casks are deprecated or disabled.
You should find replacements for the following casks:
  dia
  googleappengine
  namebench
  skitch

Warning: Some installed formulae are deprecated or disabled.
You should find replacements for the following formulae:
  cowsay
  elinks
  neofetch
  node@14
  openssl@1.1
  packer
  terraform
  vault
  whatmask
  youtube-dl

Warning: You have the following deprecated, official taps tapped:
  Homebrew/homebrew-cask-versions
  Homebrew/homebrew-cask-fonts
  Homebrew/homebrew-cask-drivers
Untap them with `brew untap`.

Warning: You have unlinked kegs in your Cellar.
Leaving kegs unlinked can lead to build-trouble and cause formulae that depend on
those kegs to fail to run properly once built. Run `brew link` on these:
  powershell
  virtualenv

Warning: You have an unnecessary local Cask tap.
This can cause problems installing up-to-date casks.
Please remove it by running:
  brew untap homebrew/cask

Warning: You have an unnecessary local Core tap!
This can cause problems installing up-to-date formulae.
Please remove it by running:
 brew untap homebrew/core

Warning: Some installed formulae are not readable:
  aerickson/recipes/polipo2: /opt/homebrew/Library/Taps/aerickson/homebrew-recipes/polipo2.rb:25: syntax error, unexpected <<
<<<<<<< Updated upstream
^~

Description of issue

$ brew upgrade
...
==> Upgrading ca-certificates
  2024-03-11 -> 2024-07-02 
==> Verifying attestation for ca-certificates
Error: The bottle for ca-certificates has an invalid build provenance attestation.

This may indicate that the bottle was not produced by the expected
tap, or was maliciously inserted into the expected tap's bottle
storage.

Additional context:

attestation verification failed: Failure while executing; `/usr/bin/env GH_TOKEN=****** /opt/homebrew/bin/gh attestation verify /Users/aerickson/Library/Caches/Homebrew/downloads/9af01538d558e40dd9cf236c9e9d04f265bd12b0e10d9ee3881ca667e043acd9--ca-certificates--2024-07-02.all.bottle.tar.gz --repo trailofbits/homebrew-brew-verify --format json` exited with 1. Here's the output:

Error: failed to fetch attestations from trailofbits/homebrew-brew-verify: HTTP 401: Bad credentials (https://api.github.com/repos/trailofbits/homebrew-brew-verify/attestations/sha256:73eb1a6bf9a5e12ee3f1acd295a4aaa28f08a9125a94342ddbf0aa65349c9db2?per_page=30)

I do have brew developer enabled, disabling fixes this. It seems attestations was just enabled for 'developers' in Homebrew/brew#17692.

I do use gh normally. gh auth status is happy.

Not sure if this is an issue just with my installation or not, so not opening a GH issue yet per https://github.com/Homebrew/brew/issues/new/choose.

Answered by woodruffw

Jul 17, 2024

PSA for folks hitting this: this is a beta feature that we've enabled for people with developer mode enabled, as a way to shake out bugs before it becomes stable.

If you want to opt out, you can either:

Disable just this beta: HOMEBREW_NO_VERIFY_ATTESTATIONS=1
Disable developer mode (most users shouldn't need this): brew developer off + unset HOMEBREW_DEVELOPER

If you'd like to keep it enabled but are hitting HTTP 401 errors, you can check the following:

If you have a HOMEBREW_GITHUB_API_TOKEN set, make sure it's valid and not expired
If you have gh installed, make sure that gh auth status shows a valid token

Long term, this functionality won't require a GitHub API token but for now i…

View full answer

carlocab · 2024-07-15T20:06:13Z

carlocab
Jul 15, 2024

Does it work if you do unset HOMEBREW_GITHUB_API_TOKEN first?

4 replies

aerickson Jul 15, 2024
Author

Yeah, that seems to have fixed it.

powderdry  ~  ➜  brew developer on
powderdry  ~  ➜  brew reinstall ca-certificates
==> Downloading https://ghcr.io/v2/homebrew/core/ca-certificates/manifests/2024-07-02
Already downloaded: /Users/aerickson/Library/Caches/Homebrew/downloads/f1e786c502c23070efef1c7716aeaea181b28fd0cdbc5327d6d7c243b49e7700--ca-certificates-2024-07-02.bottle_manifest.json
==> Fetching ca-certificates
==> Downloading https://ghcr.io/v2/homebrew/core/ca-certificates/blobs/sha256:73eb1a6bf9a5e12ee3f1acd295a4aaa28f08a9125a94342ddbf0aa65349c9db2
Already downloaded: /Users/aerickson/Library/Caches/Homebrew/downloads/9af01538d558e40dd9cf236c9e9d04f265bd12b0e10d9ee3881ca667e043acd9--ca-certificates--2024-07-02.all.bottle.tar.gz
==> Reinstalling ca-certificates 
==> Verifying attestation for ca-certificates
Error: The bottle for ca-certificates has an invalid build provenance attestation.

This may indicate that the bottle was not produced by the expected
tap, or was maliciously inserted into the expected tap's bottle
storage.

Additional context:

attestation verification failed: Failure while executing; `/usr/bin/env GH_TOKEN=****** /opt/homebrew/bin/gh attestation verify /Users/aerickson/Library/Caches/Homebrew/downloads/9af01538d558e40dd9cf236c9e9d04f265bd12b0e10d9ee3881ca667e043acd9--ca-certificates--2024-07-02.all.bottle.tar.gz --repo trailofbits/homebrew-brew-verify --format json` exited with 1. Here's the output:

Error: failed to fetch attestations from trailofbits/homebrew-brew-verify: HTTP 401: Bad credentials (https://api.github.com/repos/trailofbits/homebrew-brew-verify/attestations/sha256:73eb1a6bf9a5e12ee3f1acd295a4aaa28f08a9125a94342ddbf0aa65349c9db2?per_page=30)


powderdry  ~  ➜  unset HOMEBREW_GITHUB_API_TOKEN
powderdry  ~  ➜  brew reinstall ca-certificates 
==> Downloading https://ghcr.io/v2/homebrew/core/ca-certificates/manifests/2024-07-02
Already downloaded: /Users/aerickson/Library/Caches/Homebrew/downloads/f1e786c502c23070efef1c7716aeaea181b28fd0cdbc5327d6d7c243b49e7700--ca-certificates-2024-07-02.bottle_manifest.json
==> Fetching ca-certificates
==> Downloading https://ghcr.io/v2/homebrew/core/ca-certificates/blobs/sha256:73eb1a6bf9a5e12ee3f1acd295a4aaa28f08a9125a94342ddbf0aa65349c9db2
Already downloaded: /Users/aerickson/Library/Caches/Homebrew/downloads/9af01538d558e40dd9cf236c9e9d04f265bd12b0e10d9ee3881ca667e043acd9--ca-certificates--2024-07-02.all.bottle.tar.gz
==> Reinstalling ca-certificates 
==> Verifying attestation for ca-certificates
==> Pouring ca-certificates--2024-07-02.all.bottle.tar.gz
==> Regenerating CA certificate bundle from keychain, this may take a while...
🍺  /opt/homebrew/Cellar/ca-certificates/2024-07-02: 4 files, 231.4KB
==> Running `brew cleanup ca-certificates`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> No outdated dependents to upgrade!
==> Checking for dependents of upgraded formulae...
Disable this behaviour by setting HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> Reinstalling 1 dependent with broken linkage from source:
node@14
Error: node@14 has been disabled because it is not supported upstream! It will be disabled on 2024-02-20.
powderdry  ~  ➜

tisba Jul 17, 2024

unset HOMEBREW_GITHUB_API_TOKEN did not help in my case. I'm getting the same error when brew reinstall gdbm (for example).

$ unset HOMEBREW_GITHUB_API_TOKEN
$ brew install gdbm
==> Downloading https://ghcr.io/v2/homebrew/core/gdbm/manifests/1.24
####################################################################################################################################### 100.0%
==> Fetching gdbm
==> Downloading https://ghcr.io/v2/homebrew/core/gdbm/blobs/sha256:439b678f3befe6e37a2e36c9a8df727137f5a86bdf0fdf6a2e612409ffe1409a
Already downloaded: /Users/basti/Library/Caches/Homebrew/downloads/6a66d1454cea5c04d653d563c34611a6471cc83c12001a3df954008426b7d499--gdbm--1.24.arm64_sonoma.bottle.tar.gz
==> Verifying attestation for gdbm
Error: The bottle for gdbm has an invalid build provenance attestation.

This may indicate that the bottle was not produced by the expected
tap, or was maliciously inserted into the expected tap's bottle
storage.

Additional context:

attestation verification failed: Failure while executing; `/usr/bin/env GH_TOKEN=****** /opt/homebrew/bin/gh attestation verify /Users/basti/Library/Caches/Homebrew/downloads/6a66d1454cea5c04d653d563c34611a6471cc83c12001a3df954008426b7d499--gdbm--1.24.arm64_sonoma.bottle.tar.gz --repo trailofbits/homebrew-brew-verify --format json` exited with 1. Here's the output:

Error: failed to fetch attestations from trailofbits/homebrew-brew-verify: HTTP 401: Bad credentials (https://api.github.com/repos/trailofbits/homebrew-brew-verify/attestations/sha256:439b678f3befe6e37a2e36c9a8df727137f5a86bdf0fdf6a2e612409ffe1409a?per_page=30)

woodruffw Jul 17, 2024

@tisba That suggests that your gh credentials are also invalid. Could you paste the output of gh auth status here?

tisba Jul 17, 2024

damn, yep that was it. I actually checked that on one of my machines, but not the one where it failed. sorry for the noise!

woodruffw · 2024-07-17T19:06:17Z

woodruffw
Jul 17, 2024

PSA for folks hitting this: this is a beta feature that we've enabled for people with developer mode enabled, as a way to shake out bugs before it becomes stable.

If you want to opt out, you can either:

Disable just this beta: HOMEBREW_NO_VERIFY_ATTESTATIONS=1
Disable developer mode (most users shouldn't need this): brew developer off + unset HOMEBREW_DEVELOPER

If you'd like to keep it enabled but are hitting HTTP 401 errors, you can check the following:

If you have a HOMEBREW_GITHUB_API_TOKEN set, make sure it's valid and not expired
If you have gh installed, make sure that gh auth status shows a valid token

Long term, this functionality won't require a GitHub API token but for now it does. If you see other authentication errors, you may need to gh auth login or similar to create an appropriate token.

For all other errors, please paste what you're seeing into our triage issue: Homebrew/homebrew-core#177384

4 replies

mok0 Jul 18, 2024

This tip:

 brew developer off ; unset HOMEBREW_DEVELOPER

helped me upgrade the ruby bottle 3.3.3 -> 3.3.4. I this something we need to put in the .bashrc/.zshrc?

woodruffw Jul 18, 2024

helped me upgrade the ruby bottle 3.3.3 -> 3.3.4. I this something we need to put in the .bashrc/.zshrc?

You can put the unset in your environment/profile file, but the brew developer off should be permanent once you set it (until the next time you call brew developer on).

gromgit Jul 18, 2024

until the next time you call brew developer on

Or run a developer command, which will automatically turn dev mode back on.

sutt0n Aug 24, 2024

Yep, can confirm export HOMEBREW_NO_VERIFY_ATTESTATIONS=1 fixes this issue for me. Only did it for one shell session, seems to work fine for others.

Thank you!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Homebrew

'failed to fetch attestations' error #5495

{{title}}

Replies: 2 comments 8 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

'failed to fetch attestations' error #5495

Output of brew config

Output of brew doctor

Description of issue

Replies: 2 comments · 8 replies

aerickson Jul 15, 2024 Author

Output of `brew config`

Output of `brew doctor`

Replies: 2 comments 8 replies

aerickson Jul 15, 2024
Author