{"record":{"id":"0f84548273cdae84","repo":"jdx/mise","slug":"packslip-project-verified-manifest-project-version-differs","errorCode":null,"errorMessage":"packslip:{project}@{}: verified manifest project/version differs from discovery","messagePattern":"packslip:(.+?)@(.+?): verified manifest project/version differs from discovery","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":930,"sourceCode":"                (vendor.url, vendor.digest)\n            }\n        };\n        let text = crate::packslip::fetch_text(&url).await?;\n        let actual = hex::encode(Sha256::digest(text.as_bytes()));\n        for expected in vendor_digest\n            .iter()\n            .chain(stamp.and_then(|stamp| stamp.digest.as_ref()))\n        {\n            if &actual != expected {\n                bail!(\n                    \"packslip:{project}@{}: manifest digest differs from signed list\",\n                    tv.version\n                );\n            }\n        }\n        let verified = verify_bundle(&text, pin, !opts.allow_unlogged(), &[])?;\n        if verified.project != project || verified.version != tv.version {\n            bail!(\n                \"packslip:{project}@{}: verified manifest project/version differs from discovery\",\n                tv.version\n            );\n        }\n        let scheme = verified.scheme.to_string();\n        let attested_by = verified.attested_by.to_string();\n        packslip_pins::check(\n            project,\n            Observed {\n                scheme: &scheme,\n                key_id: &verified.key_id,\n                issuer: verified.issuer.as_deref(),\n                attested_by: &attested_by,\n                provenance: verified.provenance_linked,\n                logged: verified.logged_at.is_some(),\n            },\n        )?;\n        let payload = packslip::sigstore::peek_statement(&text).map_err(|e| eyre!(\"{e}\"))?;","sourceCodeStart":912,"sourceCodeEnd":948,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L912-L948","documentation":"After cryptographic verification of the packslip manifest, mise re-reads the project and version embedded inside the verified manifest and compares them with the project/version discovery requested. A mismatch means the signed content is for a different release than the one being resolved.","triggerScenarios":"verified_release calls verify_bundle and then checks verified.project != project || verified.version != tv.version; happens when the manifest inside the bundle declares a different project name or version than the registry entry / requested tool version.","commonSituations":"Registry entry renamed but manifest not updated; manifest published for version 14.1.0 pointed at from a 14.1.1 entry; copy-paste error in the vendor's manifest metadata.","solutions":["Fix the project/version fields in the packslip manifest so they match the release being published","Correct the registry entry or requested version to match the manifest's declared project/version","Ask the vendor to re-publish the manifest for the intended version"],"exampleFix":"// before (manifest)\nproject = 'ripgrep'\nversion = '14.1.0'\n// after — match requested 14.1.1\nproject = 'ripgrep'\nversion = '14.1.1'","handlingStrategy":"validation","validationCode":"// packslip authors: assert manifest metadata matches the release being cut\nassert_eq!(manifest.project, project_name);\nassert_eq!(manifest.version, tag_version_to_publish);","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Generate the manifest's project/version fields from CI variables, not by hand","Run a manifest-vs-tag linter in the release pipeline","Review manifest metadata in the release PR diff"],"tags":["packslip","metadata-mismatch","integrity"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}