jdx/mise · error

the packslip is for , not

Error message

the packslip is for {}, not {project}

What it means

mise verifies a downloaded packslip (signed release manifest) during installation. After signature verification it extracts the project identifier from the statement and compares it with the project actually being installed. When they differ, the downloaded packslip belongs to a different project than the one requested, so mise refuses to install it to prevent cross-project artifact substitution.

Solutions

1. Confirm the tool source/repo in mise.toml or the registry entry matches the project the packslip was signed for
2. Regenerate the packslip for the correct project and re-publish the release
3. Pin a different version whose packslip matches the requested project
4. Check whether a mise.lock entry or stale cache is binding the install to the wrong release and refresh it

Example fix

# before (registry/shorthand points at wrong project)
[tools]
foo = "github:wrong-org/foo"
# after
[tools]
foo = "github:right-org/foo"

# Before installing, check the packslip's project matches the tool's source project
mise ls-remote github:org/foo | head -1  # confirm source repo identity
# or inspect the release manifest's project field before accepting

When it happens

Trigger: Running `mise install` (via install_version_ → install_payload) where the packslip statement's verified.project does not equal the backend project identifier being installed — e.g. the release manifest was generated for a different repository/package than the tool requested.

Common situations: A GitHub release tag points at a manifest generated for a renamed/renamed-again project; a registry shorthand maps to the wrong repo; a maintainer reuses release assets across projects; a mirror or fork publishes its own packslips.

Related errors

• the packslip says version
• dotnet SDK was not found in `dotnet --list-sdks` output
• mise.lock says signed , but this release is signed by …
• mise.lock says the vendor's own packslip was accepted for
• : sha256 is , the packslip says

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/858c87067fd05f47. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/packslip.rs:1259

        if !pinned.is_empty() {
            let (actual, _) = packslip::digest_file(&bundle_path)?;
            for expected in pinned {
                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",
                verified.version,
                tv.version
            );
        }
        debug!(
            "{}: packslip signed by {} ({}){}",
            tv.style(),
            verified.key_id,
            verified.scheme,
            verified
                .logged_at
                .as_deref()
                .map(|t| format!(", logged {t}"))
                .unwrap_or_default()

View on GitHub (pinned to 533346cc37)