denoland/deno · error

Failed to fetch package manifest from {meta_url}: status {st

Error message

Failed to fetch package manifest from {meta_url}: status {status}

{}

What it means

For provenance attestation, publish fetches the just-uploaded version manifest (`{jsr}/@scope/pkg/{version}_meta.json`) to hash its contents into the attestation subject. A non-success HTTP status aborts with this error including a truncated body — unless `DISABLE_JSR_MANIFEST_VERIFICATION_FOR_TESTING` is set.

Source

Thrown at cli/tools/publish/mod.rs:1216

    // Get the version manifest from the registry
    let meta_url = jsr_url().join(&format!(
      "@{}/{}/{}_meta.json",
      package.scope, package.package, package.version
    ))?;

    let resp = http_client
      .get(meta_url.clone())?
      .send()
      .await
      .with_context(|| {
        format!("Failed to fetch package manifest from {meta_url}")
      })?;
    let status = resp.status();
    let meta_bytes = resp.collect().await?.to_bytes();

    if std::env::var("DISABLE_JSR_MANIFEST_VERIFICATION_FOR_TESTING").is_err() {
      if !status.is_success() {
        bail!(
          "Failed to fetch package manifest from {meta_url}: status {status}\n\n{}",
          response_body_snippet(&meta_bytes),
        );
      }

      verify_version_manifest(&meta_bytes, &package).with_context(|| {
        format!("Failed to verify package manifest from {meta_url}")
      })?;
    }

    let subject = provenance::Subject {
      name: format!(
        "pkg:jsr/@{}/{}@{}",
        package.scope, package.package, package.version
      ),
      digest: provenance::SubjectDigest {
        sha256: faster_hex::hex_string(&sha2::Sha256::digest(&meta_bytes)),
      },

View on GitHub (pinned to f7822238ca)

Solutions

1. Re-run the publish job — already-uploaded versions are skipped, so the retry goes straight to provenance against a now-available manifest.
2. Pass `--no-provenance` if attestations must not block the release.
3. Check https://status.jsr.io for ongoing incidents before retrying.

#!/usr/bin/env bash
for attempt in 1 2; do
  out="$(deno publish 2>&1)" && exit 0
  if printf '%s' "$out" | grep -q 'Failed to fetch package manifest'; then
    echo "manifest not queryable yet (attempt $attempt) — retrying" >&2
    sleep 60   # give the CDN time to make the version manifest available
    continue
  fi
  printf '%s\n' "$out" >&2; exit 1
done
echo "persistent manifest fetch failure — publish with --no-provenance or check status.jsr.io" >&2
exit 1

When it happens

Trigger: Right after upload, the manifest GET returns >= 400 while provenance is enabled (GitHub Actions + OIDC token, no `--no-provenance`): 404 when the version is not queryable on the CDN yet, or 5xx/HTML from a JSR/CDN incident.

Common situations: The eventual-consistency window between upload and manifest availability during Actions releases; JSR infrastructure incidents.

Related errors

• Mismatch in the number of files in the manifest: expected {}
• File {} not found in the tarball
• Export {} mismatch: expected {}, got {}
• Rekor transparency log returned no entries
• No certificate chain returned

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/ade4e545fceb38af. Report an issue: GitHub.