{"record":{"id":"dfc8a6ccb7a6455c","repo":"denoland/deno","slug":"mismatch-in-the-number-of-files-in-the-manifest-e","errorCode":null,"errorMessage":"Mismatch in the number of files in the manifest: expected {}, got {}","messagePattern":"Mismatch in the number of files in the manifest: expected (.+?), got (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cli/tools/publish/mod.rs","lineNumber":1470,"sourceCode":"  } else {\n    text.to_string()\n  }\n}\n\nfn verify_version_manifest(\n  meta_bytes: &[u8],\n  package: &PreparedPublishPackage,\n) -> Result<(), AnyError> {\n  let manifest = serde_json::from_slice::<VersionManifest>(meta_bytes)\n    .with_context(|| {\n      format!(\n        \"Failed to parse package manifest as JSON. Response body:\\n\\n{}\",\n        response_body_snippet(meta_bytes),\n      )\n    })?;\n  // Check that nothing was removed from the manifest.\n  if manifest.manifest.len() != package.tarball.files.len() {\n    bail!(\n      \"Mismatch in the number of files in the manifest: expected {}, got {}\",\n      package.tarball.files.len(),\n      manifest.manifest.len()\n    );\n  }\n\n  for (path, entry) in manifest.manifest {\n    // Verify each path with the files in the tarball.\n    let file = package\n      .tarball\n      .files\n      .iter()\n      .find(|f| f.path_str == path.as_str());\n\n    if let Some(file) = file {\n      if file.hash != entry.checksum {\n        bail!(\n          \"Checksum mismatch for {}: expected {}, got {}\",","sourceCodeStart":1452,"sourceCodeEnd":1488,"githubUrl":"https://github.com/denoland/deno/blob/f7822238cab635a3a19f99f493f675fa81a7f9d8/cli/tools/publish/mod.rs#L1452-L1488","documentation":"As part of provenance verification, publish compares the manifest JSR reports for the just-published version against the tarball it uploaded. This error means the file counts differ — the registry manifest does not describe the same file set as the local tarball. Since upload and verification happen moments apart in the same run, a mismatch points at a JSR bug or, in the worst case, tampered upload content.","triggerScenarios":"`verify_version_manifest` finds `manifest.manifest.len() != package.tarball.files.len()` — the registry stored/recorded a different set of files than were sent (registry ingest bug or content mutated in transit).","commonSituations":"JSR infrastructure incidents during a release; essentially never caused by package code; reproducible occurrences indicate a Deno or JSR defect worth reporting.","solutions":["Re-run publish (the existing version is skipped) to confirm the mismatch is persistent rather than transient.","Report persistent cases at https://github.com/denoland/deno/issues (or JSR support) with the @scope/package/version.","As an urgent-release workaround, publish with `--no-provenance`, which skips manifest verification."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"#!/usr/bin/env bash\nout=\"$(deno publish 2>&1)\" || {\n  if printf '%s' \"$out\" | grep -q 'Mismatch in the number of files in the manifest'; then\n    echo \"INTEGRITY: registry manifest disagrees with uploaded tarball — do not blind-retry; report upstream\" >&2\n    exit 70\n  fi\n  printf '%s\\n' \"$out\" >&2; exit 1\n}","preventionTips":["Treat manifest-count mismatches as integrity incidents: capture the package/version and report, don't force releases through.","Keep `--no-provenance` documented as the explicit, review-approved bypass for urgent releases only.","Record CI logs of every provenance-enabled publish so mismatches can be correlated with registry incidents."],"tags":["publish","jsr","manifest","integrity","provenance"],"backgroundTag":"manifest-verification-failed","analyzedSha":"f7822238cab635a3a19f99f493f675fa81a7f9d8","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}