{"record":{"id":"48e3fef2fd1c5cf2","repo":"jdx/mise","slug":"provenance-asset-should-exist-since-we-found-its-n","errorCode":null,"errorMessage":"provenance asset should exist since we found its name","messagePattern":"provenance asset should exist since we found its name","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/github.rs","lineNumber":1443,"sourceCode":"            // Keep provenance aligned with the matching-selected binary, unless\n            // `asset_pattern` is set (it selects the binary, ignoring `matching`).\n            let (matching, matching_regex) =\n                opts.matching_for_provenance(&current_platform, verification.explicit_pattern);\n            let picker = AssetPicker::with_libc(\n                current_platform.os_name().to_string(),\n                current_platform.arch_name().to_string(),\n                current_platform.qualifier().map(|s| s.to_string()),\n            )\n            .with_matching(matching.unwrap_or_default())\n            .with_matching_regex(matching_regex.unwrap_or_default());\n\n            if let Some(provenance_name) = pick_slsa_provenance(&picker, &asset_names, &asset.name)\n            {\n                let provenance_asset = release\n                    .assets\n                    .iter()\n                    .find(|a| a.name == provenance_name)\n                    .expect(\"provenance asset should exist since we found its name\");\n\n                let provenance_path = tmp_dir.path().join(&provenance_asset.name);\n                HTTP.download_file(\n                    &provenance_asset.browser_download_url,\n                    &provenance_path,\n                    None,\n                )\n                .await?;\n\n                let provenance_url = provenance_asset.browser_download_url.clone();\n                match crate::github::sigstore::verify_slsa_provenance(\n                    &artifact_path,\n                    &provenance_path,\n                    1u8,\n                )\n                .await\n                {\n                    Ok(true) => {","sourceCodeStart":1425,"sourceCodeEnd":1461,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/github.rs#L1425-L1461","documentation":"While verifying SLSA provenance at lock time, `pick_slsa_provenance` returns a provenance asset name derived from the same `asset_names` list that was searched; the subsequent `.expect` re-finds that asset in `release.assets`. The panic fires when the name exists in the candidate list but not in `release.assets` itself — an internal consistency failure between the picker inputs and the release asset vector.","triggerScenarios":"Calling `resolve_lock_info` → `verify_provenance_at_lock_time` for a GitHub release where the provenance name was picked from a filtered/derived `asset_names` collection that is out of sync with `release.assets` (e.g. names normalized, deduplicated, or release data refetched between the two steps).","commonSituations":"Unreachable in normal operation; could surface if upstream release data is mutated between asset-name collection and lookup, or a refactor changes the relationship between `asset_names` and `release.assets`.","solutions":["Update mise to the latest version","Capture the backtrace and the release being verified, and file a bug — this indicates an internal inconsistency","As a workaround, skip provenance verification for the affected tool or pin a version whose release assets are stable"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# ensure release assets (incl. *provenance.intoto.jsonl) are stable before locking\ngh release view <tag> --repo owner/repo --json assets --jq '.assets[].name'","typeGuard":null,"tryCatchPattern":"if ! mise install github:owner/repo; then echo 'provenance verify failed; retry or pin another version'; fi","preventionTips":["Avoid installing from tags being re-released/rewritten; prefer stable versions","Keep mise updated so provenance-verification internals stay consistent","If it recurs, file a bug — this is an internal invariant, not a user error"],"tags":["github","slsa","provenance","panic","internal-invariant"],"backgroundTag":"internal-invariant-violation","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}