InternalError: Equivalent entry already exists in the transparency log

[caendesilva]

After being able to create several attestations, my workflow using this action has now two times in a row failed due to the following error:

Run actions/attest-build-provenance@v[1](https://github.com/hydephp/cli/actions/runs/9466300050/job/26077668879#step:16:1)
Run actions/attest-build-provenance/predicate@db1dde0f270afe12073070ac7aa802958ae3ec04
Run actions/attest@32795ed9174327efe1734fa[6](https://github.com/hydephp/cli/actions/runs/9466300050/job/26077668879#step:16:7)d09c9223658ef225
  
Error: InternalError: error creating tlog entry - (409) an equivalent entry already exists in the transparency log with UUID 24296fb24b8ad[7](https://github.com/hydephp/cli/actions/runs/9466300050/job/26077668879#step:16:9)7ad1462c39db32ce379b402445ee1bfb00546e4d127500853b563c821125437692
Error: (409) an equivalent entry already exists in the transparency log with UUID 24296fb24b8ad77ad[14](https://github.com/hydephp/cli/actions/runs/9466300050/job/26077668879#step:16:16)62c39db32ce379b402445ee1bfb00546e4d127500853b563c821125437692

Action run logs: https://github.com/hydephp/cli/actions/runs/9466300050/job/26077668879

[mhils]

I can confirm the same over here: https://github.com/mitmproxy/mitmproxy/actions/runs/9466172695/job/26077600512

[caendesilva]

I can confirm the same over here: https://github.com/mitmproxy/mitmproxy/actions/runs/9466172695/job/26077600512

Did this also happen within the last hour? My last successful attestation was less than 30 minutes ago.

[mhils]

Yes, this also just started for us.

[caendesilva]

Thanks for confirming. Should make it easier for the team to trace what went wrong. And good to know it's not on my end either.

[bdehamer]

@caendesilva / @mhils I was able to confirm that there was an issue with the Rekor transparency log yesterday between 6:15am PDT and 6:20am PDT that resulted in increased API latency. I believe what happened is that the request to add the attestation signature to the transparency log timed-out and was retried -- the initial request likely succeeded at some point and the 409 response was reported on the retry.

I'm working on a fix which should make the attestation action more resilient to this sort of thing in the future.

Thanks for the report.

[mhils]

@bdehamer: Thank you for digging into this and providing a detailed explanation, really appreciate it! 🍰 ❤️

[caendesilva]

Thanks for the information, really appreciate it too! The action seems to be working again, so the outage theory seems very valid!

[bdehamer]

Thanks for reporting the issue. The latest release of the action should better handle this scenario if it happens again.