{"record":{"id":"18738904571790e2","repo":"jdx/mise","slug":"the-packslip-says-version-not-the-release","errorCode":null,"errorMessage":"the packslip says version {}, not {}; the release's tag and its manifest disagree","messagePattern":"the packslip says version (.+?), not (.+?); the release's tag and its manifest disagree","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":1262,"sourceCode":"                if &actual != expected {\n                    bail!(\n                        \"the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})\",\n                        located.url\n                    );\n                }\n            }\n        }\n        let bundle = file::read_to_string(&bundle_path)?;\n        ctx.pr.set_message(\"verify packslip\".into());\n        let verified = verify_bundle(&bundle, &pin, require_log, &[])\n            .wrap_err_with(|| format!(\"verifying the packslip of {}\", tv.style()))?;\n        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!(\"{e}\"))?;\n        let statement: Statement = serde_json::from_slice(&payload)?;\n        if verified.project != project {\n            bail!(\"the packslip is for {}, not {project}\", verified.project);\n        }\n        if verified.version != tv.version {\n            bail!(\n                \"the packslip says version {}, not {}; the release's tag and its manifest disagree\",\n                verified.version,\n                tv.version\n            );\n        }\n        debug!(\n            \"{}: packslip signed by {} ({}){}\",\n            tv.style(),\n            verified.key_id,\n            verified.scheme,\n            verified\n                .logged_at\n                .as_deref()\n                .map(|t| format!(\", logged {t}\"))\n                .unwrap_or_default()\n        );\n        // Release age governs selection, and this release was already selected:\n        // either a committed lockfile recorded it, or the request named it","sourceCodeStart":1244,"sourceCodeEnd":1280,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L1244-L1280","documentation":"mise compares the version recorded inside the verified packslip statement with the version being installed (derived from the release tag). If they disagree, the release's tag and its signed manifest are inconsistent, which indicates a mis-published release or tampering, so the install is aborted.","triggerScenarios":"install_payload finds verified.version != tv.version — e.g. a release was re-tagged after the manifest was signed, or the asset packslip was copied from another release.","commonSituations":"Maintainer moves a git tag after publishing; CI regenerates the manifest with a different version string than the tag; a release asset uploaded from the wrong workflow run; manually uploaded packslip assets.","solutions":["Ask/verify the release maintainer to re-sign the manifest matching the tag, or fix the tag","Check for a re-tagged release and pin the original unmodified version","Report the release as mis-published to the project","Clear cached assets (mise cache) and retry in case a stale bundle was fetched"],"exampleFix":"# before: pinning a re-tagged version\n[tools]\nfoo = \"1.2.3\"  # tag moved after signing\n# after: pin the version whose tag matches the signed manifest\n[tools]\nfoo = \"1.2.2\"","handlingStrategy":"validation","validationCode":"# Compare release tag vs manifest version before pinning\ncurl -sL https://github.com/org/foo/releases/download/v1.2.3/packslip.json | jq -r '.subject[0].name'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid installing versions whose tags were re-published/moved after signing","Pin concrete versions instead of moving tags","Report tag/manifest mismatches to maintainers rather than bypassing"],"tags":["packslip","security","version-mismatch","install"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}