the packslip at is not the one the signed release list…

Error message

the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})

What it means

After downloading the packslip bundle from the located URL, mise hashes the file and compares it against the digests pinned by the signed release list and/or the stamp. A mismatch means the file served at the URL is not the manifest the signed list points at.

Solutions

Retry the install to rule out a corrupted download
Clear/refresh the mirror or CDN cache so the digest-matching file is served
Ask the vendor to update the signed release list digests to match the current file at the URL

Example fix

null

Defensive patterns

Strategy: retry

Validate before calling

sha256sum <downloaded-packslip>  # compare against the digest in the signed release list before installing

Type guard

null

Try / catch

// one clean retry for corruption; persistent mismatch is an upstream problem
match install() {
    Err(e) if e.to_string().contains("not the one the signed release list points at") => {
        eprintln!("downloaded file digest mismatch; retry once, then report the mirror");
    }
    other => other?,
}

Prevention

Vendors: never replace a file at a URL without updating the signed list digests
Use content-addressed or immutable URLs for published manifests
Report mismatching mirrors rather than bypassing verification

When it happens

Trigger: install_payload runs packslip::download_file for located.url, then digest_file on the bundle and compares with each pinned digest (located.digest chained with vendor_digest); any mismatch bails with actual vs expected sha256.

Common situations: A mirror serving stale or tampered content; the vendor updated the file at the URL without updating the signed list; an interrupted/corrupted download; supply-chain tampering attempt.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/cad763feb231cc63. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/packslip.rs:1245

                        digest: Some(digest),
                    },
                    vendor.and_then(|v| v.digest),
                )
            }
            // Without a stamp the located bundle is the vendor's own, so its
            // digest is already the one checked below.
            None => (self.locate_bundle(&project, &tv, &pin, &opts).await?, None),
        };
        let bundle_path = tv.download_path().join(bundle_name(&project));
        file::create_dir_all(tv.download_path())?;
        ctx.pr.set_message("download packslip".into());
        crate::packslip::download_file(&located.url, &bundle_path, Some(ctx.pr.as_ref())).await?;
        let pinned: Vec<&String> = located.digest.iter().chain(vendor_digest.iter()).collect();
        if !pinned.is_empty() {
            let (actual, _) = packslip::digest_file(&bundle_path)?;
            for expected in pinned {
                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",

View on GitHub (pinned to 533346cc37)