denoland/deno · error

File {} not found in the tarball

Error message

File {} not found in the tarball

What it means

The registry's version manifest lists a file path that has no matching entry in the tarball Deno prepared (`tarball.files` has no file whose `path_str` equals the manifest path), so per-file verification cannot proceed. Like the other `verify_version_manifest` failures, it only appears in the provenance flow after a successful upload.

Source

Thrown at cli/tools/publish/mod.rs:1495

  for (path, entry) in manifest.manifest {
    // Verify each path with the files in the tarball.
    let file = package
      .tarball
      .files
      .iter()
      .find(|f| f.path_str == path.as_str());

    if let Some(file) = file {
      if file.hash != entry.checksum {
        bail!(
          "Checksum mismatch for {}: expected {}, got {}",
          path,
          entry.checksum,
          file.hash
        );
      }
    } else {
      bail!("File {} not found in the tarball", path);
    }
  }

  for (specifier, expected) in &manifest.exports {
    let actual = package.exports.get(specifier).ok_or_else(|| {
      deno_core::anyhow::anyhow!(
        "Export {} not found in the package",
        specifier
      )
    })?;
    if actual != expected {
      bail!(
        "Export {} mismatch: expected {}, got {}",
        specifier,
        expected,
        actual
      );
    }

View on GitHub (pinned to f7822238ca)

Solutions

1. Re-run the publish job — completed versions are skipped and verification re-executes.
2. Report a reproducible case at https://github.com/denoland/deno/issues including the affected path names.
3. Unblock urgent releases with `--no-provenance`.

#!/usr/bin/env bash
out="$(deno publish 2>&1)" || {
  if printf '%s' "$out" | grep -q 'not found in the tarball'; then
    echo "registry manifest references a file absent from the tarball — retry once, then report upstream" >&2
    exit 72
  fi
  printf '%s\n' "$out" >&2; exit 1
}

When it happens

Trigger: A path in `manifest.manifest` (e.g. from path normalization differences or a registry ingest bug) that does not exist in the uploaded tarball's file list.

Common situations: Rare; associated with unusual file names/paths or JSR incidents during provenance-enabled releases.

Related errors

• Failed to fetch package manifest from {meta_url}: status {st
• Mismatch in the number of files in the manifest: expected {}
• Export {} mismatch: expected {}, got {}
• Checksum mismatch for {}: expected {}, got {}
• Export {} not found in the package

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/1fe75d16b4a20945. Report an issue: GitHub.