jdx/mise · error

provenance asset should exist since we found its name

Error message

provenance asset should exist since we found its name

What it means

While verifying SLSA provenance at lock time, `pick_slsa_provenance` returns a provenance asset name derived from the same `asset_names` list that was searched; the subsequent `.expect` re-finds that asset in `release.assets`. The panic fires when the name exists in the candidate list but not in `release.assets` itself — an internal consistency failure between the picker inputs and the release asset vector.

Source

Thrown at src/backend/github.rs:1443

            // Keep provenance aligned with the matching-selected binary, unless
            // `asset_pattern` is set (it selects the binary, ignoring `matching`).
            let (matching, matching_regex) =
                opts.matching_for_provenance(&current_platform, verification.explicit_pattern);
            let picker = AssetPicker::with_libc(
                current_platform.os_name().to_string(),
                current_platform.arch_name().to_string(),
                current_platform.qualifier().map(|s| s.to_string()),
            )
            .with_matching(matching.unwrap_or_default())
            .with_matching_regex(matching_regex.unwrap_or_default());

            if let Some(provenance_name) = pick_slsa_provenance(&picker, &asset_names, &asset.name)
            {
                let provenance_asset = release
                    .assets
                    .iter()
                    .find(|a| a.name == provenance_name)
                    .expect("provenance asset should exist since we found its name");

                let provenance_path = tmp_dir.path().join(&provenance_asset.name);
                HTTP.download_file(
                    &provenance_asset.browser_download_url,
                    &provenance_path,
                    None,
                )
                .await?;

                let provenance_url = provenance_asset.browser_download_url.clone();
                match crate::github::sigstore::verify_slsa_provenance(
                    &artifact_path,
                    &provenance_path,
                    1u8,
                )
                .await
                {
                    Ok(true) => {

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Update mise to the latest version
2. Capture the backtrace and the release being verified, and file a bug — this indicates an internal inconsistency
3. As a workaround, skip provenance verification for the affected tool or pin a version whose release assets are stable

# ensure release assets (incl. *provenance.intoto.jsonl) are stable before locking
gh release view <tag> --repo owner/repo --json assets --jq '.assets[].name'

if ! mise install github:owner/repo; then echo 'provenance verify failed; retry or pin another version'; fi

When it happens

Trigger: Calling `resolve_lock_info` → `verify_provenance_at_lock_time` for a GitHub release where the provenance name was picked from a filtered/derived `asset_names` collection that is out of sync with `release.assets` (e.g. names normalized, deduplicated, or release data refetched between the two steps).

Common situations: Unreachable in normal operation; could surface if upstream release data is mutated between asset-name collection and lookup, or a refactor changes the relationship between `asset_names` and `release.assets`.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• content-level SLSA verification does not support non-regular
• content-level SLSA verification does not support symlink arc
• content-level SLSA verification found no regular files in ar
• content-level SLSA verification found duplicate installed ar
• content-level SLSA verification rejected unsafe archive path

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/48e3fef2fd1c5cf2. Report an issue: GitHub.