{"record":{"id":"2aa627896669a0d8","repo":"jdx/mise","slug":"the-release-list-in-github-com-repo-is-for-n","errorCode":null,"errorMessage":"the release list in github.com/{repo} is for {}, not {project}","messagePattern":"the release list in github\\.com/(.+?) is for (.+?), not (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":783,"sourceCode":"            .get_text_request(&url)\n            .headers(&headers)\n            .send()\n            .await\n        {\n            Ok(text) => text,\n            Err(err) if crate::http::error_code(&err) == Some(404) => {\n                packslip_pins::check_missing_list(project)?;\n                return Ok(None);\n            }\n            Err(err) => {\n                return Err(err)\n                    .wrap_err_with(|| format!(\"fetching the release list of packslip:{project}\"));\n            }\n        };\n        let list = verify_release_list(&text, &pin, !opts.allow_unlogged())\n            .wrap_err_with(|| format!(\"verifying the release list of packslip:{project}\"))?;\n        if list.predicate.project != project {\n            bail!(\n                \"the release list in github.com/{repo} is for {}, not {project}\",\n                list.predicate.project\n            );\n        }\n        check_sequence(project, &list)?;\n        Ok(Some(list))\n    }\n\n    /// What the vendor themselves say about a version, from the release\n    /// list they sign: a withdrawal refuses it outright, and the entry pins\n    /// the manifest's digest. `None` only when no signed list covers the\n    /// version, which a project served from a GitHub repository is allowed\n    /// to do and any other project is not.\n    async fn vendor_entry(\n        &self,\n        project: &str,\n        tv: &ToolVersion,\n        pin: &Pin,","sourceCodeStart":765,"sourceCodeEnd":801,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L765-L801","documentation":"mise's packslip backend fetched a signed release list from the GitHub repository, but the project identity recorded inside the signed list's predicate does not match the project mise was asked to install. This is a safety check against installing a manifest published by a different (possibly hijacked or misconfigured) repository than the one requested.","triggerScenarios":"Calling packslip version listing or install (via vendor_entry/vendor_versions/recommendation → github_list) where the repo's release list asset embeds a predicate.project different from the registry entry's project name — e.g. the registry maps project 'foo' to a repo whose packslip manifest declares project 'foo-cli'.","commonSituations":"A registry entry points at the wrong repo; a project was renamed in its packslip manifest but the mise registry entry still uses the old name; a fork or squatted repo publishes a manifest for a different project.","solutions":["Fix the project field in the packslip manifest published in the repo's release list to match the requested project name","Correct the registry entry in registry/ so the project name matches the manifest's predicate.project","If intentionally installing from a different project, change the requested project to the one the manifest actually declares"],"exampleFix":"// before (registry entry)\nfoo = 'packslip:acme/foo-cli'\n// after — match the manifest's predicate.project\nfoo-cli = 'packslip:acme/foo-cli'","handlingStrategy":"validation","validationCode":"// mise will verify this itself; as a packslip author, check the manifest matches:\nlet manifest_project = /* read from your packslip manifest */;\nassert_eq!(manifest_project, env!(\"CARGO_PKG_NAME\"), \"predicate.project must equal the registry project name\");","typeGuard":"null","tryCatchPattern":"null","preventionTips":["Keep the packslip manifest's project field identical to the mise registry project name","Rename the registry entry and the manifest together when a project is renamed","Never copy a release-list generator from another project without updating the project predicate"],"tags":["packslip","security","supply-chain","project-mismatch"],"backgroundTag":"checksum-mismatch","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}