EG-MAN-008: Manifest references a missing package file

What ExtensionGate detects

The rule resolves supported local manifest paths against the extracted archive and flags a missing file, directory-only target, or capitalization mismatch.

Paths are normalized without executing the extension. Unsafe traversal and ambiguous archive entries are rejected earlier in package handling.

Why it may matter

A referenced file that is absent from the uploaded ZIP can make the extension fail to install or break a primary feature. Chrome's troubleshooting documentation includes missing and case-mismatched resources under packaging and functionality problems.

Case-insensitive development machines can hide a mismatch that fails after packaging or store processing.

Synthetic failing example

{
  "action": { "default_popup": "popup.html" },
  "background": { "service_worker": "ServiceWorker.js" }
}

ZIP entries:
popup.html
serviceworker.js

The synthetic manifest's service-worker capitalization does not exactly match the ZIP entry.

Passing or legitimate example

{
  "action": { "default_popup": "popup.html" },
  "background": { "service_worker": "serviceworker.js" }
}

ZIP entries:
popup.html
serviceworker.js

The declared files exist with exact matching paths. Runtime correctness still requires browser testing.

Remediation

1. Inspect the final archive rather than only the source directory.
2. Correct the manifest path or restore the missing build output with exact capitalization.
3. Remove obsolete references and ensure build ignores do not strip required assets.
4. Load the packaged build in clean Chrome and Edge profiles and exercise the affected feature.

False-positive boundaries

• Remote web URLs and extension API pseudo-URLs are not treated as local package files.
• Generated paths not represented in supported manifest fields are outside this rule.
• Locale placeholders and browser-resolved resources use dedicated validation rather than naive file matching.

What static analysis cannot determine

• A present file may contain invalid syntax, throw at runtime, or depend on unsupported APIs.
• Dynamic imports assembled at runtime may not be statically resolvable.
• The scanner cannot reproduce store-side signing, transformation, or reviewer environments.

Official sources

• Chrome extension manifest reference
• Chrome Web Store troubleshooting
• Microsoft: publish an Edge extension

Rule version history

Related guides

• Chrome pre-submission checklist
• Understand Chrome rejection codes