jdx/mise · error

the packslip at {} is not the one the signed release list po

Error message

the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})

What it means

Before verification, mise hashes the downloaded packslip bundle file and compares it against the digests pinned in the release list (and any stamp). If the file at the located URL does not hash to the listed digest, the bundle served is not the one the signed release list points at. This catches substituted or tampered bundles before signature verification is even attempted.

Source

Thrown at src/backend/packslip.rs:1119

            // digest is already the one checked below.
            None => (self.locate_bundle(&project, &tv, &pin, &opts).await?, None),
        };
        let bundle_path = tv.download_path().join(bundle_name(&project));
        file::create_dir_all(tv.download_path())?;
        ctx.pr.set_message("download packslip".into());
        HTTP.download_file_with_headers(
            &located.url,
            &bundle_path,
            &located.headers,
            Some(ctx.pr.as_ref()),
        )
        .await?;
        let pinned: Vec<&String> = located.digest.iter().chain(vendor_digest.iter()).collect();
        if !pinned.is_empty() {
            let (actual, _) = packslip::digest_file(&bundle_path)?;
            for expected in pinned {
                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Delete the cached bundle and re-download (`mise cache clean` or remove the install dir), then `mise install` again
2. Bypass the mirror/proxy (set MISE_* network settings to fetch directly) and retry
3. Check the vendor's release page: if the artifact was genuinely replaced, refresh the signed release list entry in mise.lock

Example fix

# before: install fails with digest mismatch
mise cache clean
# after: fresh download, digest matches again
mise install

use sha2::{Digest, Sha256};
fn bundle_matches_release_list(bundle_bytes: &[u8], expected: &[String]) -> bool {
    let actual = hex::encode(Sha256::digest(bundle_bytes));
    expected.iter().any(|e| e.eq_ignore_ascii_case(&actual))
}

When it happens

Trigger: install_payload (via install/install_version_) when packslip::digest_file of the downloaded bundle yields a sha256 that differs from any entry in located.digest or vendor_digest — CDN/proxy substitution, cache poisoning, or the vendor replaced the artifact without updating the list.

Common situations: Corporate proxy rewrites or caches artifacts; a mirror serves stale bundles; the vendor force-pushed a re-uploaded release asset; transient network corruption on download.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• {name}: sha256 is {actual}, the packslip says {}
• packslip:{project}@{version}: manifest digest differs from s
• brew-cask:{}: cask metadata has no sha256
• remote cache blob failed digest verification
• Size mismatch for {}: expected {}, got {}

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/cad763feb231cc63. Report an issue: GitHub.