{"record":{"id":"9449473599efca8c","repo":"jdx/mise","slug":"signed-mise-release-checksum-manifest-contains-an","errorCode":null,"errorMessage":"signed mise release checksum manifest contains an invalid SHA-256 checksum","messagePattern":"signed mise release checksum manifest contains an invalid SHA-256 checksum","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/remote.rs","lineNumber":1483,"sourceCode":"    }\n}\n\nimpl ReleaseManifest {\n    fn verified(contents: &str, signature: &str) -> Result<Self> {\n        crate::minisign::verify(\n            &crate::minisign::MISE_PUB_KEY,\n            contents.as_bytes(),\n            signature,\n        )\n        .wrap_err(\"mise release checksum signature is invalid\")?;\n        let checksums = crate::hash::parse_shasums(contents);\n        if checksums.is_empty() {\n            bail!(\"signed mise release checksum manifest is empty\");\n        }\n        if checksums.values().any(|checksum| {\n            checksum.len() != 64 || !checksum.bytes().all(|byte| byte.is_ascii_hexdigit())\n        }) {\n            bail!(\"signed mise release checksum manifest contains an invalid SHA-256 checksum\");\n        }\n        Ok(Self { checksums })\n    }\n\n    fn checksum(&self, asset: &str) -> Result<&str> {\n        self.checksums\n            .get(asset)\n            .or_else(|| self.checksums.get(&format!(\"./{asset}\")))\n            .map(String::as_str)\n            .ok_or_else(|| eyre!(\"signed mise release manifest does not contain {asset}\"))\n    }\n}\n\nimpl RemoteArtifactResolver {\n    async fn resolve(&mut self, platform: &RemotePlatform, local: &Path) -> Result<PathBuf> {\n        let asset = platform.release_asset_name()?;\n        if let Some(path) = self.artifacts.get(&asset) {\n            return Ok(path.clone());","sourceCodeStart":1465,"sourceCodeEnd":1501,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/remote.rs#L1465-L1501","documentation":"After signature verification, every entry of the signed SHA-256 checksum manifest is validated: each checksum must be exactly 64 ASCII hex characters. If any entry deviates, the manifest is malformed and mise rejects it rather than verifying binaries against a corrupt checksum, throwing this error.","triggerScenarios":"Parsing a downloaded mise release SHA256SUMS manifest (ReleaseManifest::verified) where at least one checksum value is not 64 hex chars — truncated download, hand-edited manifest, or upstream format change.","commonSituations":"HTTP truncation cutting a checksum line mid-value; a mirror serving a re-wrapped/line-wrapped checksums file; tampered or corrupted manifest on disk; mixing checksum files between release formats.","solutions":["Re-download the checksum manifest and retry","Verify the manifest against the release's published signature/announce data","Check for proxies or download layers that truncate long lines","Use mise_bin/remote_mise to bypass official-release verification if the environment cannot fetch clean manifests"],"exampleFix":"// corrupt entry\n\"abc123  mise-linux-x64\"\n// valid entry (64 hex chars)\n\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  mise-linux-x64\"","handlingStrategy":"validation","validationCode":"awk 'NF { if ($1 !~ /^[0-9a-fA-F]{64}$/) exit 1 }' SHA256SUMS","typeGuard":"fn valid_sha256(s: &str) -> bool { s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit()) }","tryCatchPattern":"if let Err(e) = manifest { if e.to_string().contains(\"invalid SHA-256 checksum\") { redownload_manifest(); } }","preventionTips":["Never hand-edit or line-wrap checksum manifests","Re-download rather than repairing corrupted manifests","Verify manifests end-to-end (TLS, signature) before parsing"],"tags":["checksum","sha256","validation"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}