{"record":{"id":"34eae939b8877374","repo":"jdx/mise","slug":"the-release-list-expired-at-the-vendor-has-not","errorCode":null,"errorMessage":"the release list expired at {}; the vendor has not published a fresh one","messagePattern":"the release list expired at (.+?); the vendor has not published a fresh one","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":621,"sourceCode":"        packslip::verify(bundle, &pin.trust(), options, artifacts).map_err(|e| eyre!(\"{e}\"))\n    })\n}\n\npub(crate) fn verify_release_list(\n    bundle: &str,\n    pin: &Pin,\n    require_log: bool,\n) -> Result<ReleaseListStatement> {\n    file::run_blocking(|| {\n        let root = packslip::sigstore::trusted_root(None).map_err(|e| eyre!(\"{e}\"))?;\n        let options = packslip::Options {\n            require_log,\n            trusted_root: &root,\n        };\n        let verified = packslip::verify_release_list(bundle, &pin.trust(), options)\n            .map_err(|e| eyre!(\"{e}\"))?;\n        if !verified.list.is_current(jiff::Timestamp::now()) {\n            bail!(\n                \"the release list expired at {}; the vendor has not published a fresh one\",\n                verified.list.predicate.expires_at\n            );\n        }\n        Ok(verified.list)\n    })\n}\n\n/// The headers a download from GitHub needs; nothing for anywhere else.\n/// Listing timestamps only filter candidates. The authenticated log time\n/// decides whether a selected release is old enough to install.\n/// Whether the release-age cutoff has already had its say about this version.\n///\n/// The cutoff decides which release a fuzzy request may pick. A lockfile entry\n/// and an explicit pin like `hk = \"2.0.1\"` are both that decision already taken\n/// and committed, so re-applying the cutoff here would reject a version mise\n/// itself resolved — `minimum_release_age` documents both as unfiltered.\nfn selection_already_made(tv: &ToolVersion) -> bool {","sourceCodeStart":603,"sourceCodeEnd":639,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L603-L639","documentation":"After cryptographically verifying the vendor's signed release list, mise also checks its freshness via the list's expires_at predicate. If the list's expiry timestamp is in the past, the vendor has not published a fresh signed list, and mise refuses to use the stale one even though its signature is valid.","triggerScenarios":"release_list, github_list, or fetch when packslip::verify_release_list succeeds but verified.list.is_current(now) is false, i.e. predicate.expires_at < now.","commonSituations":"A vendor's release-list publishing pipeline broke and stopped refreshing the signed list; a mirror or cache serving an old list; using a tool whose vendor went dormant.","solutions":["Wait for the vendor to publish a fresh release list, then retry.","Check the vendor's status page or repo for a publishing outage.","If you control the packslip, regenerate and republish the signed list with a new expiry.","As a stopgap, pin a version already present in your mise.lock whose artifacts were verified previously."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Check expiry before attempting install.\nif (new Date(list.predicate.expires_at) < new Date()) {\n  console.warn('release list expired; vendor must publish a fresh list');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await miseInstall(tool);\n} catch (e) {\n  if (String(e).includes('release list expired')) {\n    await sleep(retryDelay); // vendor usually republishes within hours\n    await miseInstall(tool);\n  } else throw e;\n}","preventionTips":["Subscribe to vendor status/announcement channels to learn of list-publishing outages.","Keep already-locked versions installed so outages don't block existing environments.","Prefer vendors whose publishing automation is demonstrably reliable.","Don't pin hopes on mirrors — the signature and expiry are checked regardless of source."],"tags":["packslip","expiry","supply-chain","release-list"],"backgroundTag":"jwt-token-expired","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}