packslip: : this release . If the vendor announced the…

Error message

packslip:{project}: this release {}.

If the vendor announced the change, run `mise packslip forget {project}` and install again; the next release accepted sets the pin.

What it means

Packslip pins record properties of the first accepted release of a project (signer set, repackager attestation, build provenance). `check_against` compares the new release against that pin and bails listing every property the release changed. This is a supply-chain guard: a vendor-side change to signing or provenance silently differing from what you accepted before is blocked until you explicitly acknowledge it.

Solutions

Confirm the vendor publicly announced the signing/provenance change
Run `mise packslip forget <project>` to clear the pin, then reinstall — the next accepted release sets a new pin
If the change was NOT announced, do not forget the pin; treat it as a possible supply-chain compromise and verify artifacts out-of-band
Inspect the error's problem list (joined by ', and ') to see exactly which property changed before deciding

Example fix

// before: update blocked by pin
mise install packslip:example-cli   # error: this release drops the build provenance...
// after: acknowledge the announced change
mise packslip forget example-cli && mise install packslip:example-cli

Defensive patterns

Strategy: validation

Validate before calling

mise packslip show <project>  # inspect pinned signers/provenance before updating

Try / catch

match packslip_pins::check_against(&pin, &observed) {
    Ok(()) => proceed_install(),
    Err(e) if vendor_announced_change() => { packslip_forget(project)?; proceed_install(); }
    Err(e) => halt_and_alert_user(e),
}

Prevention

Subscribe to vendor announcements for signing-key rotations
Review the pins file when migrating machines so stale pins are intentional
Never blindly `packslip forget` when the problem list mentions dropped provenance or signer changes
Treat unexplained pin violations as potential supply-chain incidents

When it happens

Trigger: Installing or updating a packslip tool where the new release's signer list shrinks/changes, provenance metadata disappears, or attestation flips relative to the pinned state recorded in the pins file.

Common situations: Vendor rotated signing keys or switched CI and dropped provenance; a repackager replaced the official distribution; pins file carried over from an old install while upstream changed its release process.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/b8b34e27e2512de7. Report an issue: GitHub.

Appendix: source

Thrown at src/packslip_pins.rs:151

}

fn check_against(pin: &Pin, project: &str, observed: Observed<'_>) -> Result<()> {
    let signer = signer_of(observed.scheme, observed.key_id);
    let mut problems = Vec::new();
    if pin.scheme != observed.scheme || pin.signer != signer {
        problems.push(format!(
            "is signed by {signer} ({}), but {} ({}) signed what mise accepted before",
            observed.scheme, pin.signer, pin.scheme
        ));
    }
    if pin.attested_by == "vendor" && observed.attested_by == "repackager" {
        problems.push(
            "is attested by a repackager, but the vendor's own packslip was accepted before".into(),
        );
    }
    if pin.provenance && !observed.provenance {
        problems.push("drops the build provenance every artifact linked before".into());
    }
    if !problems.is_empty() {
        bail!(
            "packslip:{project}: this release {}.\n\nIf the vendor announced the change, run `mise packslip forget {project}` and install again; the next release accepted sets the pin.",
            problems.join(", and ")
        );
    }
    Ok(())
}

/// Set the project's pin from an accepted release, or strengthen it: what
/// got stronger is remembered, what stayed the same is left alone. Checks
/// again under the lock, since the file may have changed since [`check`].
pub(crate) fn record(project: &str, observed: Observed<'_>) -> Result<Pin> {
    record_at(&pins_file(), project, observed)
}

pub(crate) fn record_at(path: &Path, project: &str, observed: Observed<'_>) -> Result<Pin> {
    let _lock = locked(path)?;

View on GitHub (pinned to 533346cc37)