{"record":{"id":"18738904571790e2","repo":"jdx/mise","slug":"the-packslip-says-version-not-the-release","errorCode":null,"errorMessage":"the packslip says version {}, not {}; the release's tag and its manifest disagree","messagePattern":"the packslip says version (.+?), not (.+?); the release's tag and its manifest disagree","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":1136,"sourceCode":"                if &actual != expected {\n                    bail!(\n                        \"the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})\",\n                        located.url\n                    );\n                }\n            }\n        }\n        let bundle = file::read_to_string(&bundle_path)?;\n        ctx.pr.set_message(\"verify packslip\".into());\n        let verified = verify_bundle(&bundle, &pin, require_log, &[])\n            .wrap_err_with(|| format!(\"verifying the packslip of {}\", tv.style()))?;\n        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!(\"{e}\"))?;\n        let statement: Statement = serde_json::from_slice(&payload)?;\n        if verified.project != project {\n            bail!(\"the packslip is for {}, not {project}\", verified.project);\n        }\n        if verified.version != tv.version {\n            bail!(\n                \"the packslip says version {}, not {}; the release's tag and its manifest disagree\",\n                verified.version,\n                tv.version\n            );\n        }\n        debug!(\n            \"{}: packslip signed by {} ({}){}\",\n            tv.style(),\n            verified.key_id,\n            verified.scheme,\n            verified\n                .logged_at\n                .as_deref()\n                .map(|t| format!(\", logged {t}\"))\n                .unwrap_or_default()\n        );\n        let before = crate::install_before::resolve_before_date_for_tool(\n            &self.ba,","sourceCodeStart":1118,"sourceCodeEnd":1154,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L1118-L1154","documentation":"Same check as the project mismatch, but for the version: the signed manifest must attest to exactly the version being installed. When the verified manifest's version differs from tv.version, the release's tag and its manifest disagree — often meaning the tag was moved/re-tagged or the manifest belongs to a different release. Install is refused.","triggerScenarios":"install_payload (via install/install_version_) when verify_bundle succeeds but verified.version != tv.version — e.g. a git tag was re-pointed at a newer/older release while the old packslip URL still resolves, or the release list entry lags the tag.","commonSituations":"Vendor re-tagged a release (moving tag) so the URL content changed version; a `latest` resolution picked a version whose bundle URL still serves the previous release; lockfile pinned one version while the manifest was regenerated for another.","solutions":["Clear cached bundles and re-resolve the version (`mise cache clean && mise install`)","Pin the exact version that the manifest actually attests to","Ask the vendor to fix the mismatched tag/manifest pair before trusting the release"],"exampleFix":"// before (mise.toml, tag moved under you)\n[tools]\nmytool = \"packslip:1.2.0\"\n// after — pin the version the manifest really is\n[tools]\nmytool = \"packslip:1.2.1\"","handlingStrategy":"validation","validationCode":"fn bundle_is_for_version(verified_version: &str, requested: &str) -> bool {\n    verified_version == requested\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin exact versions so tag movement doesn't silently change what you install","After a vendor re-tags a release, re-resolve and re-lock","Never treat a moved tag as the same release"],"tags":["packslip","verification","version-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}