Error: failed to fetch attestations (for duti)

[oschrenk]

brew gist-logs <formula> link OR brew config AND brew doctor output

❯ brew config
HOMEBREW_VERSION: 4.3.17-134-gff8bb50
ORIGIN: https://github.com/Homebrew/brew
HEAD: ff8bb50cfa4fe84d0a5d513cff1dade3dd7db64d
Last commit: 50 minutes ago
Core tap JSON: 24 Aug 19:58 UTC
Core cask tap JSON: 24 Aug 19:58 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_EDITOR: nvim
HOMEBREW_MAKE_JOBS: 12
HOMEBREW_NO_ANALYTICS: set
HOMEBREW_NO_ENV_HINTS: set
HOMEBREW_NO_UPDATE_REPORT_NEW: set
HOMEBREW_SORBET_RUNTIME: set
Homebrew Ruby: 3.3.4 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.3.4_1/bin/ruby
CPU: dodeca-core 64-bit arm_blizzard_avalanche
Clang: 15.0.0 build 1500
Git: 2.46.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 14.6.1-arm64
CLT: 15.3.0.0.1.1708646388
Xcode: 15.4
Rosetta 2: false

❯ brew doctor
Your system is ready to brew.

### Verification

- [X] My `brew doctor` output says `Your system is ready to brew.` and am still able to reproduce my issue.
- [X] I ran `brew update` and am still able to reproduce my issue.
- [X] I have resolved all warnings from `brew doctor` and that did not fix my problem.
- [X] I searched for recent similar issues at https://github.com/Homebrew/homebrew-core/issues?q=is%3Aissue and found no duplicates.

### What were you trying to do (and why)?

Tried to install package `duti` to use it.


### What happened (include all command output)?

❯ brew install duti
==> Downloading https://ghcr.io/v2/homebrew/core/duti/manifests/1.5.4_1-1
Already downloaded: /Users/oliver/Library/Caches/Homebrew/downloads/5389408a7c39fb3b875bd29415f6bf109490fb184f8640c403d46c502dd885bc--duti-1.5.4_1-1.bottle_manifest.json
==> Fetching duti
==> Downloading https://ghcr.io/v2/homebrew/core/duti/blobs/sha256:396053ac173
Already downloaded: /Users/oliver/Library/Caches/Homebrew/downloads/10c2a79ca6597ea86f1287263dc6779b017c53efe6d988cddb1e37830b1df423--duti--1.5.4_1.arm64_ventura.bottle.1.tar.gz
==> Verifying attestation for duti
Error: The bottle for duti has an invalid build provenance attestation.

This may indicate that the bottle was not produced by the expected
tap, or was maliciously inserted into the expected tap's bottle
storage.

Additional context:

attestation not found: Failure while executing; /usr/bin/env GH_TOKEN=****** GH_HOST=github.com /opt/homebrew/bin/gh attestation verify /Users/oliver/Library/Caches/Homebrew/downloads/10c2a79ca6597ea86f1287263dc6779b017c53efe6d988cddb1e37830b1df423--duti--1.5.4_1.arm64_ventura.bottle.1.tar.gz --repo trailofbits/homebrew-brew-verify --format json exited with 1. Here's the output:

Error: failed to fetch attestations from trailofbits/homebrew-brew-verify: HTTP 404: Not Found (https://api.github.com/repos/trailofbits/homebrew-brew-verify/attestations/sha256:396053ac173f80066c3ea7df5f61d6dbda8ddd26e97e8e4d269b382588a1e9e9?per_page=30)

### What did you expect to happen?

Package installed.

### Step-by-step reproduction instructions (by running `brew` commands)

```shell
brew install duti

I have seem similar but not the same discussions and issue. But they have issues with a 401 error (which can be solved via gh auth login) but this is a 404 issue. There was a comment about 404 issues that a "re-bottling" seems to be necessary

See #177384 (comment)

export HOMEBREW_NO_VERIFY_ATTESTATIONS=1 does help

[branchvincent]

Thanks for the report, yup this issue was on our side. Should be fixed after #182341, you can brew update && brew install duti