jdx/mise · error

the packslip is for {}, not {project}

Error message

the packslip is for {}, not {project}

What it means

After the packslip bundle's signature verifies, mise reads the statement payload and confirms the verified manifest's `project` matches the project being installed. A valid signature on the wrong project means the bundle URL for this release points at another package's packslip. Install is refused rather than trusting a correct signature on the wrong artifact.

Source

Thrown at src/backend/packslip.rs:1133

        if !pinned.is_empty() {
            let (actual, _) = packslip::digest_file(&bundle_path)?;
            for expected in pinned {
                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",
                verified.version,
                tv.version
            );
        }
        debug!(
            "{}: packslip signed by {} ({}){}",
            tv.style(),
            verified.key_id,
            verified.scheme,
            verified
                .logged_at
                .as_deref()
                .map(|t| format!(", logged {t}"))
                .unwrap_or_default()

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Verify the packslip URL in your config/registry entry matches the intended project
2. Re-run `mise ls-remote packslip:<project>` to re-resolve the correct bundle
3. Report the wrong bundle link in the vendor's signed release list upstream

Example fix

// before (mise.toml)
[tools]
mytool = "packslip:mytool-typo"
// after
[tools]
mytool = "packslip:mytool"

fn bundle_is_for_project(verified_project: &str, expected: &str) -> bool {
    verified_project == expected
}

When it happens

Trigger: install_payload (via install/install_version_) when verify_bundle succeeds but verified.project != the requested project — typically a release-list URL pointing at a different package's bundle, or a misconfigured registry entry.

Common situations: Copy-paste error in the vendor's signed release list (wrong bundle URL); a registry/alias for the tool points at the wrong packslip; you mistyped the project name in mise.toml and got redirected to a similarly-named project.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• packslip:{project}@{version}: verified manifest project/vers
• the packslip says version {}, not {}; the release's tag and
• must not record a pin before replacement succeeds
• no checksum entry found for {filename} in checksum file
• packslip:{tool_name} is not a project name; use github.com/o

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/858c87067fd05f47. Report an issue: GitHub.