denoland/deno · critical

Mismatch in the number of files in the manifest: expected {}

Error message

Mismatch in the number of files in the manifest: expected {}, got {}

What it means

As part of provenance verification, publish compares the manifest JSR reports for the just-published version against the tarball it uploaded. This error means the file counts differ — the registry manifest does not describe the same file set as the local tarball. Since upload and verification happen moments apart in the same run, a mismatch points at a JSR bug or, in the worst case, tampered upload content.

Source

Thrown at cli/tools/publish/mod.rs:1470

  } else {
    text.to_string()
  }
}

fn verify_version_manifest(
  meta_bytes: &[u8],
  package: &PreparedPublishPackage,
) -> Result<(), AnyError> {
  let manifest = serde_json::from_slice::<VersionManifest>(meta_bytes)
    .with_context(|| {
      format!(
        "Failed to parse package manifest as JSON. Response body:\n\n{}",
        response_body_snippet(meta_bytes),
      )
    })?;
  // Check that nothing was removed from the manifest.
  if manifest.manifest.len() != package.tarball.files.len() {
    bail!(
      "Mismatch in the number of files in the manifest: expected {}, got {}",
      package.tarball.files.len(),
      manifest.manifest.len()
    );
  }

  for (path, entry) in manifest.manifest {
    // Verify each path with the files in the tarball.
    let file = package
      .tarball
      .files
      .iter()
      .find(|f| f.path_str == path.as_str());

    if let Some(file) = file {
      if file.hash != entry.checksum {
        bail!(
          "Checksum mismatch for {}: expected {}, got {}",

View on GitHub (pinned to f7822238ca)

Solutions

1. Re-run publish (the existing version is skipped) to confirm the mismatch is persistent rather than transient.
2. Report persistent cases at https://github.com/denoland/deno/issues (or JSR support) with the @scope/package/version.
3. As an urgent-release workaround, publish with `--no-provenance`, which skips manifest verification.

#!/usr/bin/env bash
out="$(deno publish 2>&1)" || {
  if printf '%s' "$out" | grep -q 'Mismatch in the number of files in the manifest'; then
    echo "INTEGRITY: registry manifest disagrees with uploaded tarball — do not blind-retry; report upstream" >&2
    exit 70
  fi
  printf '%s\n' "$out" >&2; exit 1
}

When it happens

Trigger: `verify_version_manifest` finds `manifest.manifest.len() != package.tarball.files.len()` — the registry stored/recorded a different set of files than were sent (registry ingest bug or content mutated in transit).

Common situations: JSR infrastructure incidents during a release; essentially never caused by package code; reproducible occurrences indicate a Deno or JSR defect worth reporting.

Related errors

• Failed to fetch package manifest from {meta_url}: status {st
• Checksum mismatch for {}: expected {}, got {}
• File {} not found in the tarball
• Export {} mismatch: expected {}, got {}
• Automatic provenance is only available in GitHub Actions

AI-assisted analysis of denoland/deno@f7822238ca (2026-08-20). Data as JSON: /api/errors/dfc8a6ccb7a6455c. Report an issue: GitHub.