{"record":{"id":"22ebb8db29de53ae","repo":"jdx/mise","slug":"refusing-unsafe-change-to-bootstrap-group-in","errorCode":null,"errorMessage":"refusing unsafe change to bootstrap group '{}'; inspect `mise bootstrap plan`","messagePattern":"refusing unsafe change to bootstrap group '(.+?)'; inspect `mise bootstrap plan`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/accounts.rs","lineNumber":309,"sourceCode":"            ),\n            (GroupInspection::IdCollision { gid, name }, AccountState::Present) => {\n                ResourcePlan::new(\n                    id,\n                    format!(\"absent; gid {gid} belongs to {name}\"),\n                    desired,\n                    ResourceAction::Unknown,\n                )\n            }\n            (GroupInspection::IdCollision { .. }, AccountState::Absent) => {\n                ResourcePlan::new(id, \"absent\", desired, ResourceAction::Noop)\n            }\n        }\n    }\n\n    fn action(&self) -> Result<Option<AccountAction>> {\n        match self.plan().action {\n            ResourceAction::Noop => Ok(None),\n            ResourceAction::Unknown => bail!(\n                \"refusing unsafe change to bootstrap group '{}'; inspect `mise bootstrap plan`\",\n                self.name\n            ),\n            ResourceAction::Create => Ok(Some(AccountAction::CreateGroup {\n                name: self.name.clone(),\n                gid: self.gid,\n                system: self.system,\n            })),\n            ResourceAction::Update => Ok(Some(AccountAction::UpdateGroup {\n                name: self.name.clone(),\n                gid: self.gid.expect(\"group update requires a desired gid\"),\n            })),\n            ResourceAction::Remove => Ok(Some(AccountAction::RemoveGroup {\n                name: self.name.clone(),\n            })),\n        }\n    }\n}","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/accounts.rs#L291-L327","documentation":"Before applying a change to a bootstrap group, mise computes a plan; if the plan's action is Unknown — meaning the current group state could not be inspected reliably enough to guarantee a safe change — mise refuses to proceed rather than guess. This protects against destructive or wrong modifications to system groups. The error tells you to inspect the outcome with `mise bootstrap plan`.","triggerScenarios":"Running `mise bootstrap apply` when the group's plan resolves to ResourceAction::Unknown, e.g. nix group inspection fails, the group exists with ambiguous state, or the system group database is inconsistent; running apply on a host where the group name cannot be resolved and the desired state cannot be verified.","commonSituations":"Corrupt or partially-managed /etc/group entries; the group was created outside mise with unexpected attributes; permission problems reading the group database; race where another tool deleted the group between plan and apply.","solutions":["Run `mise bootstrap plan` and read the reported state/action for the group; reconcile the group manually (groupadd/groupmod/groupdel) so the plan becomes a known action (Create/Modify/Noop)","Fix the underlying inspection problem (permissions on /etc/group, NSS configuration, duplicate group names)","Align the mise.toml entry with the actual group state (correct gid/system/state) so the plan is unambiguous","Re-run apply only after the plan shows a safe, non-Unknown action"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"mise bootstrap plan   # must show a concrete Create/Modify/Noop action, never Unknown, before apply","typeGuard":null,"tryCatchPattern":"# shell\nif ! mise bootstrap plan 2>&1 | grep -q 'Unknown'; then\n  mise bootstrap apply || exit 1\nelse\n  echo \"refusing: unsafe bootstrap plan; reconcile group state manually\" >&2\n  exit 1\nfi","preventionTips":["Always run `mise bootstrap plan` before apply and treat Unknown as a blocker","Keep group state in mise.toml in sync with what other tools create on the host","Avoid hand-editing /etc/group on managed machines","Investigate inspection failures (permissions, duplicate names) immediately rather than re-running apply"],"tags":["bootstrap","groups","safety-guard","system-state"],"backgroundTag":"invalid-state-transition","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}