jdx/mise · error

the packslip says version

Error message

the packslip says version {}, not {}; the release's tag and its manifest disagree

What it means

mise compares the version recorded inside the verified packslip statement with the version being installed (derived from the release tag). If they disagree, the release's tag and its signed manifest are inconsistent, which indicates a mis-published release or tampering, so the install is aborted.

Solutions

1. Ask/verify the release maintainer to re-sign the manifest matching the tag, or fix the tag
2. Check for a re-tagged release and pin the original unmodified version
3. Report the release as mis-published to the project
4. Clear cached assets (mise cache) and retry in case a stale bundle was fetched

Example fix

# before: pinning a re-tagged version
[tools]
foo = "1.2.3"  # tag moved after signing
# after: pin the version whose tag matches the signed manifest
[tools]
foo = "1.2.2"

# Compare release tag vs manifest version before pinning
curl -sL https://github.com/org/foo/releases/download/v1.2.3/packslip.json | jq -r '.subject[0].name'

When it happens

Trigger: install_payload finds verified.version != tv.version — e.g. a release was re-tagged after the manifest was signed, or the asset packslip was copied from another release.

Common situations: Maintainer moves a git tag after publishing; CI regenerates the manifest with a different version string than the tag; a release asset uploaded from the wrong workflow run; manually uploaded packslip assets.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

• the packslip is for , not
• mise.lock says signed , but this release is signed by …
• mise.lock says the vendor's own packslip was accepted for
• : sha256 is , the packslip says
• packslip: : this release . If the vendor announced the…

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/18738904571790e2. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/packslip.rs:1262

                if &actual != expected {
                    bail!(
                        "the packslip at {} is not the one the signed release list points at (sha256 {actual}, list says {expected})",
                        located.url
                    );
                }
            }
        }
        let bundle = file::read_to_string(&bundle_path)?;
        ctx.pr.set_message("verify packslip".into());
        let verified = verify_bundle(&bundle, &pin, require_log, &[])
            .wrap_err_with(|| format!("verifying the packslip of {}", tv.style()))?;
        let payload = packslip::sigstore::peek_statement(&bundle).map_err(|e| eyre!("{e}"))?;
        let statement: Statement = serde_json::from_slice(&payload)?;
        if verified.project != project {
            bail!("the packslip is for {}, not {project}", verified.project);
        }
        if verified.version != tv.version {
            bail!(
                "the packslip says version {}, not {}; the release's tag and its manifest disagree",
                verified.version,
                tv.version
            );
        }
        debug!(
            "{}: packslip signed by {} ({}){}",
            tv.style(),
            verified.key_id,
            verified.scheme,
            verified
                .logged_at
                .as_deref()
                .map(|t| format!(", logged {t}"))
                .unwrap_or_default()
        );
        // Release age governs selection, and this release was already selected:
        // either a committed lockfile recorded it, or the request named it

View on GitHub (pinned to 533346cc37)