{"record":{"id":"1fe75d16b4a20945","repo":"denoland/deno","slug":"file-not-found-in-the-tarball","errorCode":null,"errorMessage":"File {} not found in the tarball","messagePattern":"File (.+?) not found in the tarball","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/publish/mod.rs","lineNumber":1495,"sourceCode":"  for (path, entry) in manifest.manifest {\n    // Verify each path with the files in the tarball.\n    let file = package\n      .tarball\n      .files\n      .iter()\n      .find(|f| f.path_str == path.as_str());\n\n    if let Some(file) = file {\n      if file.hash != entry.checksum {\n        bail!(\n          \"Checksum mismatch for {}: expected {}, got {}\",\n          path,\n          entry.checksum,\n          file.hash\n        );\n      }\n    } else {\n      bail!(\"File {} not found in the tarball\", path);\n    }\n  }\n\n  for (specifier, expected) in &manifest.exports {\n    let actual = package.exports.get(specifier).ok_or_else(|| {\n      deno_core::anyhow::anyhow!(\n        \"Export {} not found in the package\",\n        specifier\n      )\n    })?;\n    if actual != expected {\n      bail!(\n        \"Export {} mismatch: expected {}, got {}\",\n        specifier,\n        expected,\n        actual\n      );\n    }","sourceCodeStart":1477,"sourceCodeEnd":1513,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/tools/publish/mod.rs#L1477-L1513","documentation":"The registry's version manifest lists a file path that has no matching entry in the tarball Deno prepared (`tarball.files` has no file whose `path_str` equals the manifest path), so per-file verification cannot proceed. Like the other `verify_version_manifest` failures, it only appears in the provenance flow after a successful upload.","triggerScenarios":"A path in `manifest.manifest` (e.g. from path normalization differences or a registry ingest bug) that does not exist in the uploaded tarball's file list.","commonSituations":"Rare; associated with unusual file names/paths or JSR incidents during provenance-enabled releases.","solutions":["Re-run the publish job — completed versions are skipped and verification re-executes.","Report a reproducible case at https://github.com/denoland/deno/issues including the affected path names.","Unblock urgent releases with `--no-provenance`."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"#!/usr/bin/env bash\nout=\"$(deno publish 2>&1)\" || {\n  if printf '%s' \"$out\" | grep -q 'not found in the tarball'; then\n    echo \"registry manifest references a file absent from the tarball — retry once, then report upstream\" >&2\n    exit 72\n  fi\n  printf '%s\\n' \"$out\" >&2; exit 1\n}","preventionTips":["Retry once — usually transient; persistent cases belong upstream with the affected paths attached.","Avoid exotic file names/paths in packages (unusual unicode, trailing spaces) to stay clear of normalization drift.","Keep the release pipeline able to re-run provenance for an already-uploaded version without republishing."],"tags":["publish","jsr","manifest","tarball","provenance"],"backgroundTag":"missing-archive-file","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}