{"record":{"id":"ade4e545fceb38af","repo":"denoland/deno","slug":"failed-to-fetch-package-manifest-from-meta-url","errorCode":null,"errorMessage":"Failed to fetch package manifest from {meta_url}: status {status}\n\n{}","messagePattern":"Failed to fetch package manifest from (.+?): status (.+?)\n\n(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/publish/mod.rs","lineNumber":1216,"sourceCode":"    // Get the version manifest from the registry\n    let meta_url = jsr_url().join(&format!(\n      \"@{}/{}/{}_meta.json\",\n      package.scope, package.package, package.version\n    ))?;\n\n    let resp = http_client\n      .get(meta_url.clone())?\n      .send()\n      .await\n      .with_context(|| {\n        format!(\"Failed to fetch package manifest from {meta_url}\")\n      })?;\n    let status = resp.status();\n    let meta_bytes = resp.collect().await?.to_bytes();\n\n    if std::env::var(\"DISABLE_JSR_MANIFEST_VERIFICATION_FOR_TESTING\").is_err() {\n      if !status.is_success() {\n        bail!(\n          \"Failed to fetch package manifest from {meta_url}: status {status}\\n\\n{}\",\n          response_body_snippet(&meta_bytes),\n        );\n      }\n\n      verify_version_manifest(&meta_bytes, &package).with_context(|| {\n        format!(\"Failed to verify package manifest from {meta_url}\")\n      })?;\n    }\n\n    let subject = provenance::Subject {\n      name: format!(\n        \"pkg:jsr/@{}/{}@{}\",\n        package.scope, package.package, package.version\n      ),\n      digest: provenance::SubjectDigest {\n        sha256: faster_hex::hex_string(&sha2::Sha256::digest(&meta_bytes)),\n      },","sourceCodeStart":1198,"sourceCodeEnd":1234,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/tools/publish/mod.rs#L1198-L1234","documentation":"For provenance attestation, publish fetches the just-uploaded version manifest (`{jsr}/@scope/pkg/{version}_meta.json`) to hash its contents into the attestation subject. A non-success HTTP status aborts with this error including a truncated body — unless `DISABLE_JSR_MANIFEST_VERIFICATION_FOR_TESTING` is set.","triggerScenarios":"Right after upload, the manifest GET returns >= 400 while provenance is enabled (GitHub Actions + OIDC token, no `--no-provenance`): 404 when the version is not queryable on the CDN yet, or 5xx/HTML from a JSR/CDN incident.","commonSituations":"The eventual-consistency window between upload and manifest availability during Actions releases; JSR infrastructure incidents.","solutions":["Re-run the publish job — already-uploaded versions are skipped, so the retry goes straight to provenance against a now-available manifest.","Pass `--no-provenance` if attestations must not block the release.","Check https://status.jsr.io for ongoing incidents before retrying."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"#!/usr/bin/env bash\nfor attempt in 1 2; do\n  out=\"$(deno publish 2>&1)\" && exit 0\n  if printf '%s' \"$out\" | grep -q 'Failed to fetch package manifest'; then\n    echo \"manifest not queryable yet (attempt $attempt) — retrying\" >&2\n    sleep 60   # give the CDN time to make the version manifest available\n    continue\n  fi\n  printf '%s\\n' \"$out\" >&2; exit 1\ndone\necho \"persistent manifest fetch failure — publish with --no-provenance or check status.jsr.io\" >&2\nexit 1","preventionTips":["Run provenance-enabled publishes with automatic retry on this message — the upload itself already succeeded.","Check https://status.jsr.io before large release windows.","If attestation is optional for you, keep `--no-provenance` as a documented emergency override in the release runbook."],"tags":["publish","provenance","jsr","manifest","network"],"backgroundTag":"manifest-fetch-failed","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}