{"record":{"id":"43d218c19d3b2bf9","repo":"jdx/mise","slug":"packslip-project-version-verified-manifest-pr","errorCode":null,"errorMessage":"packslip:{project}@{version}: verified manifest project/version differs from discovery","messagePattern":"packslip:(.+?)@(.+?): verified manifest project/version differs from discovery","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":856,"sourceCode":"        };\n        let url = url.as_str();\n        let text = HTTP_FETCH\n            .get_text_request(url)\n            .headers(&headers_for(url)?)\n            .send()\n            .await?;\n        let actual = hex::encode(Sha256::digest(text.as_bytes()));\n        for expected in vendor_digest\n            .iter()\n            .chain(stamp.and_then(|s| s.digest.as_ref()))\n        {\n            if &actual != expected {\n                bail!(\"packslip:{project}@{version}: manifest digest differs from signed list\");\n            }\n        }\n        let verified = verify_bundle(&text, pin, !opts.allow_unlogged(), &[])?;\n        if verified.project != project || verified.version != version {\n            bail!(\n                \"packslip:{project}@{version}: verified manifest project/version differs from discovery\"\n            );\n        }\n        let scheme = verified.scheme.to_string();\n        let attested_by = verified.attested_by.to_string();\n        packslip_pins::check(\n            project,\n            Observed {\n                scheme: &scheme,\n                key_id: &verified.key_id,\n                issuer: verified.issuer.as_deref(),\n                attested_by: &attested_by,\n                provenance: verified.provenance_linked,\n                logged: verified.logged_at.is_some(),\n            },\n        )?;\n        // Parse errors are verification errors, not age-policy exclusions.\n        if !verified_age_allowed(","sourceCodeStart":838,"sourceCodeEnd":874,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L838-L874","documentation":"After cryptographic verification of the packslip bundle succeeds, mise checks that the verified manifest's project and version fields match the project/version that was requested during discovery. A mismatch means the signed bundle is valid but attests to a different release than the one being installed. This prevents installing a correctly-signed bundle for the wrong package or version.","triggerScenarios":"latest_version_with_selection_options resolving a version for a packslip: tool when verify_bundle returns a manifest whose `project` or `version` differs from the discovery request — e.g. the release list entry points at a bundle for another project/version, or an alias/redirect maps to the wrong bundle.","commonSituations":"A vendor publishes a release list entry with a copy-pasted bundle URL from another release; a `latest` alias resolves to a newer version than the one whose bundle URL was cached; typo'd project name in a tool request.","solutions":["Re-run discovery (`mise ls-remote packslip:<project>`) so the bundle URL is re-resolved for the correct project/version","Check the vendor's signed release list for a wrong bundle link and report it upstream","Pin an exact version in mise.toml instead of `latest` to avoid discovery/version drift"],"exampleFix":"// before\n[tools]\nnode = \"packslip:latest\"\n// after\n[tools]\nnode = \"packslip:22.4.1\" # pin exact version so bundle matches discovery","handlingStrategy":"validation","validationCode":"fn matches_discovery(verified_project: &str, verified_version: &str, project: &str, version: &str) -> bool {\n    verified_project == project && verified_version == version\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin exact versions instead of `latest` for reproducible installs","Re-resolve discovery after vendor release-list changes","Double-check project names/aliases in mise.toml"],"tags":["packslip","verification","version-mismatch"],"backgroundTag":"checksum-mismatch","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}