{"record":{"id":"962dc48d408e1519","repo":"jdx/mise","slug":"signed-mise-release-checksum-manifest-is-empty","errorCode":null,"errorMessage":"signed mise release checksum manifest is empty","messagePattern":"signed mise release checksum manifest is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/remote.rs","lineNumber":1476,"sourceCode":"    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {\n        match self {\n            Self::Glibc => f.write_str(\"glibc\"),\n            Self::Musl => f.write_str(\"musl\"),\n        }\n    }\n}\n\nimpl ReleaseManifest {\n    fn verified(contents: &str, signature: &str) -> Result<Self> {\n        crate::minisign::verify(\n            &crate::minisign::MISE_PUB_KEY,\n            contents.as_bytes(),\n            signature,\n        )\n        .wrap_err(\"mise release checksum signature is invalid\")?;\n        let checksums = crate::hash::parse_shasums(contents);\n        if checksums.is_empty() {\n            bail!(\"signed mise release checksum manifest is empty\");\n        }\n        if checksums.values().any(|checksum| {\n            checksum.len() != 64 || !checksum.bytes().all(|byte| byte.is_ascii_hexdigit())\n        }) {\n            bail!(\"signed mise release checksum manifest contains an invalid SHA-256 checksum\");\n        }\n        Ok(Self { checksums })\n    }\n\n    fn checksum(&self, asset: &str) -> Result<&str> {\n        self.checksums\n            .get(asset)\n            .or_else(|| self.checksums.get(&format!(\"./{asset}\")))\n            .map(String::as_str)\n            .ok_or_else(|| eyre!(\"signed mise release manifest does not contain {asset}\"))\n    }\n}\n","sourceCodeStart":1458,"sourceCodeEnd":1494,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/remote.rs#L1458-L1494","documentation":"`ReleaseManifest::verified` parses mise's signed SHA256SUMS manifest after verifying its minisign signature. If the signature is valid but `parse_shasums` yields zero entries, this error is thrown: an authentic but empty checksum manifest cannot be used to verify any release asset, so provisioning aborts.","triggerScenarios":"Fetching the checksum manifest for a mise release where the manifest file exists and is correctly signed but contains no parseable checksum lines — e.g. an upstream release published with an empty SHA256SUMS file, a truncated/whitespace-only manifest, or a format change that breaks the parser.","commonSituations":"A newly cut mise release whose checksum assets weren't populated yet; a proxy/mirror serving a placeholder empty file; parsing a manifest from the wrong asset (e.g. an empty file fetched due to URL construction).","solutions":["Retry later — if the release was just published, upstream SHA256SUMS may not be populated yet.","Verify the manifest URL points at the real SHA256SUMS asset for the target release, not a placeholder.","Bypass automatic provisioning by setting `mise_bin`, `remote_mise`, or `bootstrap_command` to a known-good binary.","Check for a mise release-automation or parser bug if the manifest visibly contains entries (report/inspect `crate::hash::parse_shasums` handling)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"// rust\nmatch provision().await {\n    Err(e) if e.to_string().contains(\"checksum manifest is empty\") => {\n        tokio::time::sleep(Duration::from_secs(60)).await; // release may still be publishing\n        retry_provision().await\n    }\n    other => other,\n}","preventionTips":["Don't target a mise release seconds after it's published.","Pin to released, established mise versions for remote provisioning.","Keep mise_bin fallback configured for air-gapped/mirrored environments."],"tags":["security","checksum","release","signing"],"backgroundTag":"empty-required-field","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}