{"record":{"id":"cad763feb231cc63","repo":"jdx/mise","slug":"the-packslip-at-is-not-the-one-the-signed-relea","errorCode":null,"errorMessage":"the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})","messagePattern":"the packslip at (.+?) is not the one the signed release list points at \\(sha256 (.+?), list says (.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":1245,"sourceCode":"                        digest: Some(digest),\n                    },\n                    vendor.and_then(|v| v.digest),\n                )\n            }\n            // Without a stamp the located bundle is the vendor's own, so its\n            // digest is already the one checked below.\n            None => (self.locate_bundle(&project, &tv, &pin, &opts).await?, None),\n        };\n        let bundle_path = tv.download_path().join(bundle_name(&project));\n        file::create_dir_all(tv.download_path())?;\n        ctx.pr.set_message(\"download packslip\".into());\n        crate::packslip::download_file(&located.url, &bundle_path, Some(ctx.pr.as_ref())).await?;\n        let pinned: Vec<&String> = located.digest.iter().chain(vendor_digest.iter()).collect();\n        if !pinned.is_empty() {\n            let (actual, _) = packslip::digest_file(&bundle_path)?;\n            for expected in pinned {\n                if &actual != expected {\n                    bail!(\n                        \"the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})\",\n                        located.url\n                    );\n                }\n            }\n        }\n        let bundle = file::read_to_string(&bundle_path)?;\n        ctx.pr.set_message(\"verify packslip\".into());\n        let verified = verify_bundle(&bundle, &pin, require_log, &[])\n            .wrap_err_with(|| format!(\"verifying the packslip of {}\", tv.style()))?;\n        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!(\"{e}\"))?;\n        let statement: Statement = serde_json::from_slice(&payload)?;\n        if verified.project != project {\n            bail!(\"the packslip is for {}, not {project}\", verified.project);\n        }\n        if verified.version != tv.version {\n            bail!(\n                \"the packslip says version {}, not {}; the release's tag and its manifest disagree\",","sourceCodeStart":1227,"sourceCodeEnd":1263,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L1227-L1263","documentation":"After downloading the packslip bundle from the located URL, mise hashes the file and compares it against the digests pinned by the signed release list and/or the stamp. A mismatch means the file served at the URL is not the manifest the signed list points at.","triggerScenarios":"install_payload runs packslip::download_file for located.url, then digest_file on the bundle and compares with each pinned digest (located.digest chained with vendor_digest); any mismatch bails with actual vs expected sha256.","commonSituations":"A mirror serving stale or tampered content; the vendor updated the file at the URL without updating the signed list; an interrupted/corrupted download; supply-chain tampering attempt.","solutions":["Retry the install to rule out a corrupted download","Clear/refresh the mirror or CDN cache so the digest-matching file is served","Ask the vendor to update the signed release list digests to match the current file at the URL"],"exampleFix":"null","handlingStrategy":"retry","validationCode":"sha256sum <downloaded-packslip>  # compare against the digest in the signed release list before installing","typeGuard":"null","tryCatchPattern":"// one clean retry for corruption; persistent mismatch is an upstream problem\nmatch install() {\n    Err(e) if e.to_string().contains(\"not the one the signed release list points at\") => {\n        eprintln!(\"downloaded file digest mismatch; retry once, then report the mirror\");\n    }\n    other => other?,\n}","preventionTips":["Vendors: never replace a file at a URL without updating the signed list digests","Use content-addressed or immutable URLs for published manifests","Report mismatching mirrors rather than bypassing verification"],"tags":["packslip","sha256","checksum","supply-chain"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}