signed mise release checksum manifest contains an invalid SH

Error message

signed mise release checksum manifest contains an invalid SHA-256 checksum

What it means

After verifying the signature of mise's SHA256SUMS manifest, `ReleaseManifest::verified` validates every checksum value: each must be exactly 64 ASCII hex digits (a valid SHA-256 hex digest). If any entry fails that shape — wrong length or non-hex characters — the manifest cannot be trusted for byte-for-byte verification and this error is thrown.

Source

Thrown at src/system/remote.rs:1481

    }
}

impl ReleaseManifest {
    fn verified(contents: &str, signature: &str) -> Result<Self> {
        crate::minisign::verify(
            &crate::minisign::MISE_PUB_KEY,
            contents.as_bytes(),
            signature,
        )
        .wrap_err("mise release checksum signature is invalid")?;
        let checksums = crate::hash::parse_shasums(contents);
        if checksums.is_empty() {
            bail!("signed mise release checksum manifest is empty");
        }
        if checksums.values().any(|checksum| {
            checksum.len() != 64 || !checksum.bytes().all(|byte| byte.is_ascii_hexdigit())
        }) {
            bail!("signed mise release checksum manifest contains an invalid SHA-256 checksum");
        }
        Ok(Self { checksums })
    }

    fn checksum(&self, asset: &str) -> Result<&str> {
        self.checksums
            .get(asset)
            .or_else(|| self.checksums.get(&format!("./{asset}")))
            .map(String::as_str)
            .ok_or_else(|| eyre!("signed mise release manifest does not contain {asset}"))
    }
}

impl RemoteArtifactResolver {
    async fn resolve(&mut self, platform: &RemotePlatform, local: &Path) -> Result<PathBuf> {
        let asset = platform.release_asset_name()?;
        if let Some(path) = self.artifacts.get(&asset) {
            return Ok(path.clone());

View on GitHub (pinned to afd2eddd3a)

Solutions

Confirm the mise release's SHA256SUMS asset actually contains 64-char hex digests (inspect it manually).
Retry from a different mirror/network in case the manifest was corrupted in transit.
Upgrade or downgrade mise — a parser/format mismatch may be fixed in another release.
Set `mise_bin`, `remote_mise`, or `bootstrap_command` to skip signed-manifest verification.

Defensive patterns

Strategy: validation

Validate before calling

# shell: sanity-check manifest shape before trusting it
awk 'NF && $1 !~ /^[0-9a-fA-F]{64}$/ {print "bad digest:", $1; exit 1}' SHA256SUMS

Prevention

Fetch manifests only from the official release URL, not mirrors.
Keep mise updated so manifest parsing matches upstream format.
Report persistent failures — likely an upstream format change.

When it happens

Trigger: A signed manifest whose checksum column is malformed: truncated digests, uppercase-inconsistent or non-hex characters (e.g. 'sha256-...' base64 digests instead of hex), or an upstream tooling change in how checksums are written.

Common situations: Upstream switched checksum format (e.g. minisign/concatenated formats), a corrupted manifest served by a mirror, or a parser mis-splitting lines so only part of the digest is captured.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/9449473599efca8c. Report an issue: GitHub.