fix(core): improve error messages for provenance checks #32680

MaxKless · 2025-09-10T14:49:34Z

Current Behavior

there are instances where the provenance checks might error out with unclear errors, leading to confusion.

Expected Behavior

the whole provenance check always throws a proper provenance error if it fails and some more common cases are handled.

vercel · 2025-09-10T14:49:38Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
nx-dev	Ready	Preview	Sep 12, 2025 2:10pm

nx-cloud · 2025-09-10T14:50:21Z

View your CI Pipeline Execution ↗ for commit 46a2a4a

Command	Status	Duration	Result
`nx affected --targets=lint,test,build,e2e,e2e-c...`	✅ Succeeded	39m 35s	View ↗
`nx run-many -t check-imports check-commit check...`	✅ Succeeded	2m 18s	View ↗
`nx-cloud record -- nx-cloud conformance:check`	✅ Succeeded	2s	View ↗
`nx-cloud record -- nx format:check`	✅ Succeeded	2s	View ↗
`nx-cloud record -- nx sync:check`	✅ Succeeded	<1s	View ↗
`nx documentation`	✅ Succeeded	1m 2s	View ↗

☁️ Nx Cloud last updated this comment at 2025-09-12 14:34:15 UTC

nx-cloud

Nx Cloud is proposing a fix for your failed CI:

We've fixed the formatting issue in the provenance.ts file by removing trailing whitespace on line 70. This ensures the file passes the format:check validation and maintains consistent code formatting across the codebase.

We verified this fix by re-running nx-cloud record -- nx format:check.

diff --git a/packages/nx/src/utils/provenance.ts b/packages/nx/src/utils/provenance.ts
index abb2a6219b..988cab9c7e 100644
--- a/packages/nx/src/utils/provenance.ts
+++ b/packages/nx/src/utils/provenance.ts
@@ -67,7 +67,7 @@ export async function ensurePackageHasProvenance(
     if (!jsonResponse || typeof jsonResponse !== 'object') {
       throw new Error('Invalid attestation response format');
     }
-    
+

     attestations = jsonResponse as { attestations: Attestation[] };
   } catch (error) {
     throw noProvenanceError(

View interactive diff and more actions ↗

_{⚙️ An Nx Cloud workspace admin can disable these reviews in workspace settings.}

graphite-app · 2025-09-12T13:47:55Z

packages/nx/src/utils/provenance.ts

+    const provenanceAttestation = attestations?.attestations?.find(
+      (a) => a.predicateType === 'https://slsa.dev/provenance/v1'
    );
-  }
-  if (workflowParameters?.path !== '.github/workflows/publish.yml') {
-    throw noProvenanceError(
-      packageName,
-      packageVersion,
-      'Publishing workflow does not match .github/workflows/publish.yml'
+
+    const dsseEnvelopePayload = JSON.parse(
+      Buffer.from(
+        provenanceAttestation.bundle.dsseEnvelope.payload,
+        'base64'
+      ).toString()


There appears to be a potential null reference issue in this code. After finding the provenance attestation, the code immediately tries to access provenanceAttestation.bundle.dsseEnvelope.payload without first verifying that provenanceAttestation exists.

Consider adding a null check after line 60:

if (!provenanceAttestation) { throw new ProvenanceError( packageName, packageVersion, 'No provenance attestation found' ); }

This would prevent a runtime error if no matching attestation is found and provide a more descriptive error message.

Suggested change

const provenanceAttestation = attestations?.attestations?.find(

(a) => a.predicateType === 'https://slsa.dev/provenance/v1'

);

}

if (workflowParameters?.path !== '.github/workflows/publish.yml') {

throw noProvenanceError(

packageName,

packageVersion,

'Publishing workflow does not match .github/workflows/publish.yml'

const dsseEnvelopePayload = JSON.parse(

Buffer.from(

provenanceAttestation.bundle.dsseEnvelope.payload,

'base64'

).toString()

const provenanceAttestation = attestations?.attestations?.find(

(a) => a.predicateType === 'https://slsa.dev/provenance/v1'

);

if (!provenanceAttestation) {

throw new ProvenanceError(

packageName,

packageVersion,

'No provenance attestation found'

);

}

const dsseEnvelopePayload = JSON.parse(

Buffer.from(

provenanceAttestation.bundle.dsseEnvelope.payload,

'base64'

).toString()

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2025-09-12T13:51:03Z

packages/nx/src/utils/package-manager.ts

  }

-  const { stdout } = await execAsync(`${pm} view ${pkg}@${version} ${args}`, {
+  const { stdout } = await execAsync(`${pm} ${pkg}@${version} ${args}`, {


Critical bug: The 'view' command has been removed from the npm command, making it invalid. The line should be ${pm} view ${pkg}@${version} ${args} not ${pm} ${pkg}@${version} ${args}. This will cause npm commands to fail with 'command not found' errors.

Suggested change

const { stdout } = await execAsync(`${pm} ${pkg}@${version} ${args}`, {

const { stdout } = await execAsync(`${pm} view ${pkg}@${version} ${args}`, {

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

@MaxKless this seems legit?

graphite-app · 2025-09-12T13:51:04Z

packages/nx/src/utils/provenance.ts

+    const distSha = Buffer.from(
+      npmViewResult.dist.integrity.replace('sha512-', ''),
+      'base64'
+    ).toString('hex');
+    const attestationSha = dsseEnvelopePayload.subject[0].digest.sha512;


Critical null pointer bug: The code accesses npmViewResult.dist.integrity and dsseEnvelopePayload.subject[0].digest.sha512 without null checks. If dist, integrity, subject, or the first subject element is null/undefined, this will cause a TypeError. Add proper null checks before accessing these nested properties.

Suggested change

const distSha = Buffer.from(

npmViewResult.dist.integrity.replace('sha512-', ''),

'base64'

).toString('hex');

const attestationSha = dsseEnvelopePayload.subject[0].digest.sha512;

const distSha = Buffer.from(

npmViewResult?.dist?.integrity?.replace('sha512-', '') ?? '',

'base64'

).toString('hex');

const attestationSha = dsseEnvelopePayload?.subject?.[0]?.digest?.sha512;

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

graphite-app · 2025-09-12T13:51:06Z

packages/nx/src/utils/provenance.ts

+    throw new ProvenanceError(
      packageName,
      packageVersion,
-      `Version ref does not match refs/tags/${npmViewResult.version}`
+      error.message || error
    );


Logic error in error handling: The catch block uses error.message || error which will always evaluate to error.message when it exists, even if it's an empty string. This could result in empty error messages. Use error.message || String(error) or error?.message ?? String(error) to ensure a meaningful error message is always provided.

Suggested change

throw new ProvenanceError(

packageName,

packageVersion,

`Version ref does not match refs/tags/${npmViewResult.version}`

error.message || error

);

throw new ProvenanceError(

packageName,

packageVersion,

error.message || String(error)

);

Spotted by Diamond

Is this helpful? React 👍 or 👎 to let us know.

(cherry picked from commit d02b7f4)

github-actions · 2025-09-19T00:10:07Z

This pull request has already been merged/closed. If you experience issues related to these changes, please open a new issue referencing this pull request.

fix(core): improve error messages for provenance checks

a6136c5

MaxKless requested a review from a team as a code owner September 10, 2025 14:49

MaxKless requested a review from AgentEnder September 10, 2025 14:49

nx-cloud bot reviewed Sep 10, 2025

View reviewed changes

MaxKless force-pushed the improve-provenance-errors branch 2 times, most recently from 3cb2158 to ec2fbe6 Compare September 10, 2025 15:28

global try/catch in provenance.ts wip

946c3c5

MaxKless force-pushed the improve-provenance-errors branch from ec2fbe6 to 946c3c5 Compare September 10, 2025 15:30

vercel bot deployed to Preview September 10, 2025 15:50 View deployment

MaxKless added 2 commits September 12, 2025 15:45

fix issues wip

baf1e84

env var wip

46a2a4a

graphite-app bot reviewed Sep 12, 2025

View reviewed changes

FrozenPandaz approved these changes Sep 12, 2025

View reviewed changes

graphite-app bot reviewed Sep 12, 2025

View reviewed changes

vercel bot deployed to Preview September 12, 2025 14:10 View deployment

MaxKless mentioned this pull request Sep 12, 2025

Unable to use nx migrate ** cli command #32713

Closed

4 tasks

MaxKless merged commit d02b7f4 into master Sep 12, 2025
15 checks passed

MaxKless deleted the improve-provenance-errors branch September 12, 2025 14:38

FrozenPandaz pushed a commit that referenced this pull request Sep 18, 2025

fix(core): improve error messages for provenance checks (#32680)

5dec1fd

(cherry picked from commit d02b7f4)

github-actions bot locked as resolved and limited conversation to collaborators Sep 19, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(core): improve error messages for provenance checks #32680

fix(core): improve error messages for provenance checks #32680

Uh oh!

MaxKless commented Sep 10, 2025 •

edited

Loading

Uh oh!

vercel bot commented Sep 10, 2025 •

edited

Loading

Uh oh!

nx-cloud bot commented Sep 10, 2025 •

edited

Loading

Uh oh!

nx-cloud bot left a comment •

edited

Loading

Uh oh!

graphite-app bot Sep 12, 2025

Uh oh!

graphite-app bot Sep 12, 2025

Uh oh!

JamesHenry Sep 13, 2025

Uh oh!

graphite-app bot Sep 12, 2025

Uh oh!

graphite-app bot Sep 12, 2025

Uh oh!

Uh oh!

github-actions bot commented Sep 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	const { stdout } = await execAsync(`${pm} ${pkg}@${version} ${args}`, {
	const { stdout } = await execAsync(`${pm} view ${pkg}@${version} ${args}`, {

fix(core): improve error messages for provenance checks #32680

fix(core): improve error messages for provenance checks #32680

Uh oh!

Conversation

MaxKless commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Current Behavior

Expected Behavior

Uh oh!

vercel bot commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nx-cloud bot commented Sep 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nx-cloud bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Nx Cloud is proposing a fix for your failed CI:

Uh oh!

graphite-app bot Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

JamesHenry Sep 13, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

graphite-app bot Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Sep 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MaxKless commented Sep 10, 2025 •

edited

Loading

vercel bot commented Sep 10, 2025 •

edited

Loading

nx-cloud bot commented Sep 10, 2025 •

edited

Loading

nx-cloud bot left a comment •

edited

Loading