{"record":{"id":"2aa627896669a0d8","repo":"jdx/mise","slug":"the-release-list-in-github-com-repo-is-for-n","errorCode":null,"errorMessage":"the release list in github.com/{repo} is for {}, not {project}","messagePattern":"the release list in github\\.com/(.+?) is for (.+?), not (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":678,"sourceCode":"            .get_text_request(&url)\n            .headers(&headers)\n            .send()\n            .await\n        {\n            Ok(text) => text,\n            Err(err) if crate::http::error_code(&err) == Some(404) => {\n                packslip_pins::check_missing_list(project)?;\n                return Ok(None);\n            }\n            Err(err) => {\n                return Err(err)\n                    .wrap_err_with(|| format!(\"fetching the release list of packslip:{project}\"));\n            }\n        };\n        let list = verify_release_list(&text, &pin, !opts.allow_unlogged())\n            .wrap_err_with(|| format!(\"verifying the release list of packslip:{project}\"))?;\n        if list.predicate.project != project {\n            bail!(\n                \"the release list in github.com/{repo} is for {}, not {project}\",\n                list.predicate.project\n            );\n        }\n        check_sequence(project, &list)?;\n        Ok(Some(list))\n    }\n\n    /// What the vendor themselves say about a version, from the release\n    /// list they sign: a withdrawal refuses it outright, and the entry pins\n    /// the manifest's digest. `None` only when no signed list covers the\n    /// version, which a project served from a GitHub repository is allowed\n    /// to do and any other project is not.\n    async fn vendor_entry(\n        &self,\n        project: &str,\n        tv: &ToolVersion,\n        pin: &Pin,","sourceCodeStart":660,"sourceCodeEnd":696,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L660-L696","documentation":"Same project-binding guard as the URL-based list, but for lists discovered via a GitHub repository. After verifying the list fetched from github.com/{repo}, mise checks `list.predicate.project` against the requested project and refuses if the list belongs to a different project, preventing a repo's list from being used to install another project's artifacts.","triggerScenarios":"Calling `github_list` (from `vendor_entry`, `recommendation`, or `vendor_versions`) when the verified list obtained from the GitHub repo has a `predicate.project` different from the requested packslip project.","commonSituations":"The GitHub repo configured for the packslip backend hosts release lists for a differently-named project (repo renamed or forked); a typo in the project slug; a fork serving the upstream project's lists is pinned by mistake.","solutions":["Point the packslip pin at the correct GitHub repository that publishes lists for this project","Fix the project name/slug in your config to match the list's subject","Contact the vendor if their repo publishes a list with the wrong project field"],"exampleFix":"// before\n[tools.\"packslip:acme\"]\ngithub_repo = \"acme-org/acme-lib-releases\"\n// after\n[tools.\"packslip:acme\"]\ngithub_repo = \"acme-org/acme-releases\"","handlingStrategy":"validation","validationCode":"if (!githubRepo.split('/').pop().startsWith(projectBaseName)) {\n  console.warn(`repo ${githubRepo} may not publish lists for ${project}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin the vendor's canonical release repo, not forks or renamed repos","Verify the repo actually publishes lists whose project field matches your packslip project","Review packslip pins when migrating between upstream and forks"],"tags":["packslip","github","mismatch"],"backgroundTag":"unexpected-response-shape","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}