unrecognized provenance table format in lockfile: {:?}

Error message

unrecognized provenance table format in lockfile: {:?}

What it means

A platform table's provenance entry must be a table containing an slsa sub-table (optionally with a url); if the provenance table holds any other key, mise bails listing the offending keys (src/lockfile.rs:626-643). The format is unknown to this build — a forward-compatibility guard.

Source

Thrown at src/lockfile.rs:639

                        if let ProvenanceType::Slsa { ref mut url } = prov {
                            *url = legacy_provenance_url;
                        }
                        Some(prov)
                    }
                    Some(toml::Value::Table(mut prov_table)) => {
                        if let Some(slsa_val) = prov_table.remove("slsa") {
                            let slsa_url = match slsa_val {
                                toml::Value::Table(mut st) => match st.remove("url") {
                                    Some(toml::Value::String(u)) => Some(u),
                                    _ => None,
                                },
                                _ => None,
                            };
                            Some(ProvenanceType::Slsa { url: slsa_url })
                        } else {
                            // Unknown table variant
                            let keys: Vec<_> = prov_table.keys().cloned().collect();
                            bail!(
                                "unrecognized provenance table format in lockfile: {:?}",
                                keys
                            );
                        }
                    }
                    _ => None,
                };
                let provenance_verified = provenance.is_some()
                    && matches!(
                        t.remove("provenance_verified"),
                        Some(toml::Value::Boolean(true))
                    );
                let github_attestations = if provenance.is_some() {
                    None
                } else {
                    github_attestations
                };
                let additional_artifacts = match t.remove("additional_artifacts") {

View on GitHub (pinned to 6f52dcdf99)

Solutions

Upgrade mise to the writer's version or newer.
Regenerate the lockfile: rm mise.lock && mise lock.
Pin mise repo-wide and upgrade writer and readers together.
Use the printed key list to locate the offending entry if investigating.

Defensive patterns

Strategy: validation

Validate before calling

# CI guard: every provenance table must contain an slsa key
python3 -c "
import tomllib

def walk(v):
    if isinstance(v, dict):
        if 'provenance' in v and isinstance(v['provenance'], dict) and 'slsa' not in v['provenance']:
            raise SystemExit('unsupported provenance keys: %s' % list(v['provenance']))
        for x in v.values(): walk(x)
    elif isinstance(v, list):
        for x in v: walk(x)

walk(tomllib.load(open('mise.lock', 'rb')))
"

Try / catch

Treat "unrecognized provenance table format" as a version-skew signal: upgrade mise to match the writer or regenerate the lockfile; the error prints the offending keys, so report those in the job log before failing.

Prevention

Align mise versions between lockfile writer and readers.
Regenerate mise.lock after upgrades; do not merge old and new sections by hand.
Review lockfile diffs in PRs to catch new/unknown format keys early.

When it happens

Trigger: mise.lock contains provenance = { <keys other than slsa> } — written by a newer mise release that added a new provenance type, read by an older build; or provenance keys added by hand.

Common situations: Version skew across team/CI after upgrading mise on one machine; lockfiles produced by newer formats consumed by pinned older versions.

Related errors

AI-assisted analysis of jdx/mise@6f52dcdf99 (2026-08-22). Data as JSON: /api/errors/3396be6883865276. Report an issue: GitHub.