jdx/mise · error

signed mise release checksum manifest contains an invalid…

Error message

signed mise release checksum manifest contains an invalid SHA-256 checksum

What it means

After signature verification, every entry of the signed SHA-256 checksum manifest is validated: each checksum must be exactly 64 ASCII hex characters. If any entry deviates, the manifest is malformed and mise rejects it rather than verifying binaries against a corrupt checksum, throwing this error.

Solutions

1. Re-download the checksum manifest and retry
2. Verify the manifest against the release's published signature/announce data
3. Check for proxies or download layers that truncate long lines
4. Use mise_bin/remote_mise to bypass official-release verification if the environment cannot fetch clean manifests

Example fix

// corrupt entry
"abc123  mise-linux-x64"
// valid entry (64 hex chars)
"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  mise-linux-x64"

awk 'NF { if ($1 !~ /^[0-9a-fA-F]{64}$/) exit 1 }' SHA256SUMS

fn valid_sha256(s: &str) -> bool { s.len() == 64 && s.bytes().all(|b| b.is_ascii_hexdigit()) }

if let Err(e) = manifest { if e.to_string().contains("invalid SHA-256 checksum") { redownload_manifest(); } }

When it happens

Trigger: Parsing a downloaded mise release SHA256SUMS manifest (ReleaseManifest::verified) where at least one checksum value is not 64 hex chars — truncated download, hand-edited manifest, or upstream format change.

Common situations: HTTP truncation cutting a checksum line mid-value; a mirror serving a re-wrapped/line-wrapped checksums file; tampered or corrupted manifest on disk; mixing checksum files between release formats.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• invalid Hex OTP checksum for
• brew-cask: : cask metadata has no sha256
• # : malformed sha256
• # : missing sha256
• Invalid checksum format

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/9449473599efca8c. Report an issue: GitHub.

Appendix: source

Thrown at src/system/remote.rs:1483

    }
}

impl ReleaseManifest {
    fn verified(contents: &str, signature: &str) -> Result<Self> {
        crate::minisign::verify(
            &crate::minisign::MISE_PUB_KEY,
            contents.as_bytes(),
            signature,
        )
        .wrap_err("mise release checksum signature is invalid")?;
        let checksums = crate::hash::parse_shasums(contents);
        if checksums.is_empty() {
            bail!("signed mise release checksum manifest is empty");
        }
        if checksums.values().any(|checksum| {
            checksum.len() != 64 || !checksum.bytes().all(|byte| byte.is_ascii_hexdigit())
        }) {
            bail!("signed mise release checksum manifest contains an invalid SHA-256 checksum");
        }
        Ok(Self { checksums })
    }

    fn checksum(&self, asset: &str) -> Result<&str> {
        self.checksums
            .get(asset)
            .or_else(|| self.checksums.get(&format!("./{asset}")))
            .map(String::as_str)
            .ok_or_else(|| eyre!("signed mise release manifest does not contain {asset}"))
    }
}

impl RemoteArtifactResolver {
    async fn resolve(&mut self, platform: &RemotePlatform, local: &Path) -> Result<PathBuf> {
        let asset = platform.release_asset_name()?;
        if let Some(path) = self.artifacts.get(&asset) {
            return Ok(path.clone());

View on GitHub (pinned to 533346cc37)