Merge pull request #1759 from actions/bdehamer/rekor-409

config rekor to fetch on conflict

packages/attest/RELEASES.md

@@ -4,6 +4,7 @@
 
 - Dynamic construction of Sigstore API URLs
 - Switch to new GH provenance build type
+- Fetch existing Rekor entry on 409 conflict error
 - Bump @sigstore/bundle from 2.3.0 to 2.3.2
 - Bump @sigstore/sign from 2.3.0 to 2.3.2
 

packages/attest/src/sign.ts

@@ -87,6 +87,7 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
       new RekorWitness({
         rekorBaseURL: opts.rekorURL,
         entryType: 'dsse',
+        fetchOnConflict: true,
         timeout,
         retry
       })