jdx/mise · error

the packslip says version {}, not {}; the release's tag and

Error message

the packslip says version {}, not {}; the release's tag and its manifest disagree

What it means

Same check as the project mismatch, but for the version: the signed manifest must attest to exactly the version being installed. When the verified manifest's version differs from tv.version, the release's tag and its manifest disagree — often meaning the tag was moved/re-tagged or the manifest belongs to a different release. Install is refused.

Source

Thrown at src/backend/packslip.rs:1136

                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",
                verified.version,
                tv.version
            );
        }
        debug!(
            "{}: packslip signed by {} ({}){}",
            tv.style(),
            verified.key_id,
            verified.scheme,
            verified
                .logged_at
                .as_deref()
                .map(|t| format!(", logged {t}"))
                .unwrap_or_default()
        );
        let before = crate::install_before::resolve_before_date_for_tool(
            &self.ba,

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Clear cached bundles and re-resolve the version (`mise cache clean && mise install`)
2. Pin the exact version that the manifest actually attests to
3. Ask the vendor to fix the mismatched tag/manifest pair before trusting the release

Example fix

// before (mise.toml, tag moved under you)
[tools]
mytool = "packslip:1.2.0"
// after — pin the version the manifest really is
[tools]
mytool = "packslip:1.2.1"

fn bundle_is_for_version(verified_version: &str, requested: &str) -> bool {
    verified_version == requested
}

When it happens

Trigger: install_payload (via install/install_version_) when verify_bundle succeeds but verified.version != tv.version — e.g. a git tag was re-pointed at a newer/older release while the old packslip URL still resolves, or the release list entry lags the tag.

Common situations: Vendor re-tagged a release (moving tag) so the URL content changed version; a `latest` resolution picked a version whose bundle URL still serves the previous release; lockfile pinned one version while the manifest was regenerated for another.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• packslip:{project}@{version}: verified manifest project/vers
• the packslip is for {}, not {project}
• task action manifest has an invalid identity
• unrecognized provenance table format in lockfile: {:?}
• must not record a pin before replacement succeeds

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/18738904571790e2. Report an issue: GitHub.