{"record":{"id":"858c87067fd05f47","repo":"jdx/mise","slug":"the-packslip-is-for-not-project","errorCode":null,"errorMessage":"the packslip is for {}, not {project}","messagePattern":"the packslip is for (.+?), not (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":1133,"sourceCode":"        if !pinned.is_empty() {\n            let (actual, _) = packslip::digest_file(&bundle_path)?;\n            for expected in pinned {\n                if &actual != expected {\n                    bail!(\n                        \"the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})\",\n                        located.url\n                    );\n                }\n            }\n        }\n        let bundle = file::read_to_string(&bundle_path)?;\n        ctx.pr.set_message(\"verify packslip\".into());\n        let verified = verify_bundle(&bundle, &pin, require_log, &[])\n            .wrap_err_with(|| format!(\"verifying the packslip of {}\", tv.style()))?;\n        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!(\"{e}\"))?;\n        let statement: Statement = serde_json::from_slice(&payload)?;\n        if verified.project != project {\n            bail!(\"the packslip is for {}, not {project}\", verified.project);\n        }\n        if verified.version != tv.version {\n            bail!(\n                \"the packslip says version {}, not {}; the release's tag and its manifest disagree\",\n                verified.version,\n                tv.version\n            );\n        }\n        debug!(\n            \"{}: packslip signed by {} ({}){}\",\n            tv.style(),\n            verified.key_id,\n            verified.scheme,\n            verified\n                .logged_at\n                .as_deref()\n                .map(|t| format!(\", logged {t}\"))\n                .unwrap_or_default()","sourceCodeStart":1115,"sourceCodeEnd":1151,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L1115-L1151","documentation":"After the packslip bundle's signature verifies, mise reads the statement payload and confirms the verified manifest's `project` matches the project being installed. A valid signature on the wrong project means the bundle URL for this release points at another package's packslip. Install is refused rather than trusting a correct signature on the wrong artifact.","triggerScenarios":"install_payload (via install/install_version_) when verify_bundle succeeds but verified.project != the requested project — typically a release-list URL pointing at a different package's bundle, or a misconfigured registry entry.","commonSituations":"Copy-paste error in the vendor's signed release list (wrong bundle URL); a registry/alias for the tool points at the wrong packslip; you mistyped the project name in mise.toml and got redirected to a similarly-named project.","solutions":["Verify the packslip URL in your config/registry entry matches the intended project","Re-run `mise ls-remote packslip:<project>` to re-resolve the correct bundle","Report the wrong bundle link in the vendor's signed release list upstream"],"exampleFix":"// before (mise.toml)\n[tools]\nmytool = \"packslip:mytool-typo\"\n// after\n[tools]\nmytool = \"packslip:mytool\"","handlingStrategy":"validation","validationCode":"fn bundle_is_for_project(verified_project: &str, expected: &str) -> bool {\n    verified_project == expected\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm packslip URLs/aliases resolve to the intended project before installing","Report wrong-bundle links in vendor release lists instead of working around them","Avoid similarly-named project aliases that can redirect installs"],"tags":["packslip","verification","identity-mismatch"],"backgroundTag":"schema-validation-failed","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}