jdx/mise · error

signed mise release checksum manifest is empty

Error message

signed mise release checksum manifest is empty

What it means

`ReleaseManifest::verified` parses mise's signed SHA256SUMS manifest after verifying its minisign signature. If the signature is valid but `parse_shasums` yields zero entries, this error is thrown: an authentic but empty checksum manifest cannot be used to verify any release asset, so provisioning aborts.

Source

Thrown at src/system/remote.rs:1476

    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::Glibc => f.write_str("glibc"),
            Self::Musl => f.write_str("musl"),
        }
    }
}

impl ReleaseManifest {
    fn verified(contents: &str, signature: &str) -> Result<Self> {
        crate::minisign::verify(
            &crate::minisign::MISE_PUB_KEY,
            contents.as_bytes(),
            signature,
        )
        .wrap_err("mise release checksum signature is invalid")?;
        let checksums = crate::hash::parse_shasums(contents);
        if checksums.is_empty() {
            bail!("signed mise release checksum manifest is empty");
        }
        if checksums.values().any(|checksum| {
            checksum.len() != 64 || !checksum.bytes().all(|byte| byte.is_ascii_hexdigit())
        }) {
            bail!("signed mise release checksum manifest contains an invalid SHA-256 checksum");
        }
        Ok(Self { checksums })
    }

    fn checksum(&self, asset: &str) -> Result<&str> {
        self.checksums
            .get(asset)
            .or_else(|| self.checksums.get(&format!("./{asset}")))
            .map(String::as_str)
            .ok_or_else(|| eyre!("signed mise release manifest does not contain {asset}"))
    }
}

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Retry later — if the release was just published, upstream SHA256SUMS may not be populated yet.
2. Verify the manifest URL points at the real SHA256SUMS asset for the target release, not a placeholder.
3. Bypass automatic provisioning by setting `mise_bin`, `remote_mise`, or `bootstrap_command` to a known-good binary.
4. Check for a mise release-automation or parser bug if the manifest visibly contains entries (report/inspect `crate::hash::parse_shasums` handling).

// rust
match provision().await {
    Err(e) if e.to_string().contains("checksum manifest is empty") => {
        tokio::time::sleep(Duration::from_secs(60)).await; // release may still be publishing
        retry_provision().await
    }
    other => other,
}

When it happens

Trigger: Fetching the checksum manifest for a mise release where the manifest file exists and is correctly signed but contains no parseable checksum lines — e.g. an upstream release published with an empty SHA256SUMS file, a truncated/whitespace-only manifest, or a format change that breaks the parser.

Common situations: A newly cut mise release whose checksum assets weren't populated yet; a proxy/mirror serving a placeholder empty file; parsing a manifest from the wrong asset (e.g. an empty file fetched due to URL construction).

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• brew-cask:{}: cask metadata has no sha256
• verified checksum file digest does not match expected checks
• Checksum mismatch for file {}: Expected: {algo}:{checksum} A
• packslip:{project}: this release {}. If the vendor announce
• {target} on '{}' changed after it was installed; another wri

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/962dc48d408e1519. Report an issue: GitHub.