unrecognized provenance table format in lockfile: {keys:?}

Error message

unrecognized provenance table format in lockfile: {keys:?}

What it means

The lockfile entry's provenance table must match one of the known shapes (e.g. a registry/source provenance or a Slsa variant with a 'slsa' sub-table). When the table's keys match none of the recognized variants, mise reports the unknown key set with this error.

Source

Thrown at src/lockfile.rs:679

                        if let ProvenanceType::Slsa { ref mut url } = prov {
                            *url = legacy_provenance_url;
                        }
                        Some(prov)
                    }
                    Some(toml::Value::Table(mut prov_table)) => {
                        if let Some(slsa_val) = prov_table.remove("slsa") {
                            let slsa_url = match slsa_val {
                                toml::Value::Table(mut st) => match st.remove("url") {
                                    Some(toml::Value::String(u)) => Some(u),
                                    _ => None,
                                },
                                _ => None,
                            };
                            Some(ProvenanceType::Slsa { url: slsa_url })
                        } else {
                            // Unknown table variant
                            let keys: Vec<_> = prov_table.keys().cloned().collect();
                            bail!(
                                "unrecognized provenance table format in lockfile: {:?}",
                                keys
                            );
                        }
                    }
                    _ => None,
                };
                let provenance_verified = provenance.is_some()
                    && matches!(
                        t.remove("provenance_verified"),
                        Some(toml::Value::Boolean(true))
                    );
                let github_attestations = if provenance.is_some() {
                    None
                } else {
                    github_attestations
                };
                let signer = match t.remove("signer") {

View on GitHub (pinned to afd2eddd3a)

Solutions

Fix the provenance table keys to match the documented lockfile schema (or just delete the provenance table).
Regenerate the entry with `mise lock` so mise writes a valid provenance table.
Compare with a clean lockfile for the same tool from a working checkout and copy the correct shape.

Example fix

// before (mise.lock)
[tool.node.provenance]
slsaurl = "https://..."
// after
[tool.node.provenance.slsa]
url = "https://..."

Defensive patterns

Strategy: validation

Validate before calling

# a provenance table must use documented shapes; simplest check: none or nested slsa table
tomlq '.tool | to_entries[] | .value.provenance? // empty' mise.lock

Try / catch

// catch
if err.contains("unrecognized provenance table format") {
    regenerate_lockfile(); // `mise lock`
}

Prevention

Regenerate provenance via `mise lock` rather than hand-writing the table.
Copy provenance blocks only from a lockfile produced by the same mise version.
Review mise.lock merge conflicts for mixed provenance shapes; re-lock instead.

When it happens

Trigger: Parsing a mise.lock tool entry whose provenance table contains unexpected keys (misspelled keys, hand-merged fragments, or a schema from a newer mise) — the parser collects the table's keys and bails listing them.

Common situations: Manual lockfile editing with typo'd keys (e.g. 'slsaurl' instead of a nested slsa table), merge conflicts combining two provenance variants, or cross-version lockfile schema drift.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/ffa372ce3fcc0808. Report an issue: GitHub.