jdx/mise · error

{name}: sha256 is {actual}, the packslip says {}

Error message

{name}: sha256 is {actual}, the packslip says {}

What it means

Thrown by packslip::fetch_files after downloading and unpacking an artifact: the file's computed sha256 does not match the digest declared in the signed packslip manifest. mise deletes the bad file and aborts, protecting against corrupted or tampered downloads.

Source

Thrown at src/packslip.rs:244

                    };
                    pr.set_message(format!("download {name}"));
                    file::create_dir_all(dest.parent().unwrap_or(&base))?;
                    // The tool is installed by now and the asset is an extra:
                    // one that cannot be fetched is reported, not fatal. One
                    // that arrives with the wrong digest is another matter.
                    if let Err(err) = HTTP
                        .download_file_with_headers(url, &dest, &headers_for(url)?, Some(pr))
                        .await
                    {
                        let _ = file::remove_all(&dest);
                        warn!("{}: could not fetch {name}: {err}", tv.style());
                        continue;
                    }
                    let (actual, _) = packslip::digest_file(&dest)?;
                    let expected = statement.digest_of(name);
                    if expected != Some(actual.as_str()) {
                        let _ = file::remove_all(&dest);
                        bail!(
                            "{name}: sha256 is {actual}, the packslip says {}",
                            expected.unwrap_or("it is not a subject")
                        );
                    }
                }
                // The archive and the unpacked skill are separate: an archive
                // left by an earlier attempt still needs unpacking.
                if resource.kind == "skill"
                    && let Some(skill) = skill_name(resource)
                {
                    let dir = base.join("skills").join(skill);
                    // Like the other skill sources: a skill that cannot be
                    // unpacked is reported, and the tool still installs. The
                    // digest check above stays fatal.
                    if !dir.join("SKILL.md").is_file()
                        && let Err(err) = unpack_skill(&dest, &dir, pr)
                    {
                        warn!("{}: could not unpack skill {skill}: {err}", tv.style());

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Retry the fetch to rule out a corrupted/truncated download
2. Purge the mise cache for this tool and retry so a fresh copy is downloaded
3. Check whether the project's release assets changed; regenerate or update the packslip if you maintain it
4. Ensure every file you expect is listed in the packslip's subject/digest list
5. Verify your network isn't serving content through a stale caching proxy

Example fix

// packslip before: stale digest for renamed artifact
{"name":"tool-1.2.3.tar.gz","digest":"sha256:old..."}
// after: digest updated to match the released asset
{"name":"tool-1.2.3.tar.gz","digest":"sha256:computed-from-release..."}

// verify the expected digest against the packslip before fetching
let expected = statement.digest_of(name).ok_or_else(|| anyhow!("{name} not listed in packslip subjects"))?;
let actual = sha256_hex(&downloaded_bytes);
if expected != format!("sha256:{actual}") {
    bail!("refusing to install {name}: digest mismatch (got {actual}, want {expected})");
}

match result {
    Err(e) if e.to_string().contains("the packslip says") => {
        eprintln!("artifact corrupted or packslip stale; purge cache and retry once");
        purge_cache_and_retry(e)
    }
    other => other,
}

When it happens

Trigger: The downloaded artifact's sha256 differs from digest_of(name) in the packslip statement — either the digest is listed but wrong, or the file is not listed as a subject at all (message says 'it is not a subject').

Common situations: Stale mirror or CDN serving an old artifact version; interrupted/corrupt download; a project changed its release artifacts without updating the packslip; the file being verified was never declared in the packslip manifest.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• the packslip at {} is not the one the signed release list po
• brew-cask:{}: cask metadata has no sha256
• packslip:{project}@{version}: manifest digest differs from s
• recovery content failed verification
• #{context}: sha256 mismatch (expected #{sha256}, got #{actua

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/5de09b203199c360. Report an issue: GitHub.