jdx/mise · error

packslip:{project}@{version}: verified manifest project/vers

Error message

packslip:{project}@{version}: verified manifest project/version differs from discovery

What it means

After cryptographic verification of the packslip bundle succeeds, mise checks that the verified manifest's project and version fields match the project/version that was requested during discovery. A mismatch means the signed bundle is valid but attests to a different release than the one being installed. This prevents installing a correctly-signed bundle for the wrong package or version.

Source

Thrown at src/backend/packslip.rs:856

        };
        let url = url.as_str();
        let text = HTTP_FETCH
            .get_text_request(url)
            .headers(&headers_for(url)?)
            .send()
            .await?;
        let actual = hex::encode(Sha256::digest(text.as_bytes()));
        for expected in vendor_digest
            .iter()
            .chain(stamp.and_then(|s| s.digest.as_ref()))
        {
            if &actual != expected {
                bail!("packslip:{project}@{version}: manifest digest differs from signed list");
            }
        }
        let verified = verify_bundle(&text, pin, !opts.allow_unlogged(), &[])?;
        if verified.project != project || verified.version != version {
            bail!(
                "packslip:{project}@{version}: verified manifest project/version differs from discovery"
            );
        }
        let scheme = verified.scheme.to_string();
        let attested_by = verified.attested_by.to_string();
        packslip_pins::check(
            project,
            Observed {
                scheme: &scheme,
                key_id: &verified.key_id,
                issuer: verified.issuer.as_deref(),
                attested_by: &attested_by,
                provenance: verified.provenance_linked,
                logged: verified.logged_at.is_some(),
            },
        )?;
        // Parse errors are verification errors, not age-policy exclusions.
        if !verified_age_allowed(

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Re-run discovery (`mise ls-remote packslip:<project>`) so the bundle URL is re-resolved for the correct project/version
2. Check the vendor's signed release list for a wrong bundle link and report it upstream
3. Pin an exact version in mise.toml instead of `latest` to avoid discovery/version drift

Example fix

// before
[tools]
node = "packslip:latest"
// after
[tools]
node = "packslip:22.4.1" # pin exact version so bundle matches discovery

fn matches_discovery(verified_project: &str, verified_version: &str, project: &str, version: &str) -> bool {
    verified_project == project && verified_version == version
}

When it happens

Trigger: latest_version_with_selection_options resolving a version for a packslip: tool when verify_bundle returns a manifest whose `project` or `version` differs from the discovery request — e.g. the release list entry points at a bundle for another project/version, or an alias/redirect maps to the wrong bundle.

Common situations: A vendor publishes a release list entry with a copy-pasted bundle URL from another release; a `latest` alias resolves to a newer version than the one whose bundle URL was cached; typo'd project name in a tool request.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• the packslip says version {}, not {}; the release's tag and
• the packslip is for {}, not {project}
• task action manifest has an invalid identity
• unrecognized provenance table format in lockfile: {:?}
• must not record a pin before replacement succeeds

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/43d218c19d3b2bf9. Report an issue: GitHub.