[bug] Provenance subject pkg:npm/hereby/hereby@1.8.3 does not match the package: pkg:npm/hereby@1.8.3

[jakebailey]

Describe the bug

I just set up the nodejs builder to publish my package with provenance; I had to use the main version because the npm version used in the published workflow is too old and fails, but when I do get it running, it appears to fail because the subject and the package do not match.

To Reproduce
Steps to reproduce the behavior:

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm verb stack Error: Provenance subject pkg:npm/hereby/hereby@1.8.3 does not match the package: pkg:npm/hereby@1.8.3
npm verb stack     at verifyProvenance (/tmp/tmp.FXPIVTdzY6/node_modules/npm/node_modules/libnpmpublish/lib/provenance.js:216:11)
npm verb stack     at async buildMetadata (/tmp/tmp.FXPIVTdzY6/node_modules/npm/node_modules/libnpmpublish/lib/publish.js:181:26)
npm verb stack     at async publish (/tmp/tmp.FXPIVTdzY6/node_modules/npm/node_modules/libnpmpublish/lib/publish.js:45:44)
npm verb stack     at async otplease (/tmp/tmp.FXPIVTdzY6/node_modules/npm/lib/utils/otplease.js:4:12)
npm verb stack     at async Publish.exec (/tmp/tmp.FXPIVTdzY6/node_modules/npm/lib/commands/publish.js:123:7)
npm verb stack     at async module.exports (/tmp/tmp.FXPIVTdzY6/node_modules/npm/lib/cli-entry.js:61:5)
npm verb cwd /home/runner/work/hereby/hereby
npm verb Linux 5.15.0-1041-azure
npm verb node v18.16.1
npm verb npm  v9.8.0
npm ERR! Provenance subject pkg:npm/hereby/hereby@1.8.3 does not match the package: pkg:npm/hereby@1.8.3
npm verb exit 1
npm verb code 1

https://github.com/jakebailey/hereby/actions/runs/5483129736/jobs/9989176122#step:3:399

Expected behavior

Publish succeeds.

[jakebailey]

Indeed, the sigstore file does contain this:

{
  _type: 'https://in-toto.io/Statement/v0.1',
  subject: [ { name: 'pkg:npm/hereby/hereby@1.8.3', digest: [Object] } ],
  predicateType: 'https://slsa.dev/provenance/v0.2',
  predicate: {
    builder: {
      id: 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@refs/tags/v1.7.0'
    },
    buildType: 'https://github.com/slsa-framework/slsa-github-generator/delegator-generic@v0',
    invocation: {
      configSource: [Object],
      parameters: [Object],
      environment: [Object]
    },
    metadata: { buildInvocationId: '5483129736-1', completeness: [Object] },
    materials: [ [Object] ]
  }
}

Must be somthing here that is thinking that my package is scoped:

slsa-github-generator/internal/builders/nodejs/generate-layout.sh

Line 26 in ffbc1e5

# pkg:npm/<scope>/<name>@<version>

[jakebailey]

Yeah, this code doesn't quite work:

raw_package_scope=$(echo "${PACKAGE_NAME:-}" | cut -d'/' -f1)
raw_package_name=$(echo "${PACKAGE_NAME:-}" | cut -d'/' -f2)
if [ "${raw_package_name}" == "" ]; then
    raw_package_name="${raw_package_scope}"
    raw_package_scope=""
fi

When there's no /, both -f1 and -f2 give the entire string, meaning when PACKAGE_NAME=hereby, it ends up thinking my package is hereby/hereby.

[ianlewis]

Right. This was a mistake on my part. We need to handle packages without a scope properly. Should have used the -s flag...