Missing provenance

[adamgreg]

Hi,

I'm writing a script to generate SBOM content for my JSR deps, and I've noticed that the latest versions of a couple of std packages are missing the provenance link to Rekor: https://jsr.io/@std/collections/1.0.8 and https://jsr.io/@std/streams/1.0.7

The previous versions (https://jsr.io/@std/collections/1.0.7 and https://jsr.io/@std/streams/1.0.6) do have this, as well as the latest versions of the other @std packages I checked.

I don't know if it represents a security problem, but it's surprising (and causing some difficulties for my SBOM generation!)

Thanks,
Adam

[kt3k]

streams@1.0.8 also didn't get the provenance https://jsr.io/@std/streams@1.0.8

[kt3k]

path@1.0.8 also doesn't have provenance https://jsr.io/@std/path@1.0.8

[kt3k]

Note: This happens when the publishing failed in the middle of the process.

This is currently worked on at denoland/deno#26829