{"record":{"id":"38aa0ea05fe049b1","repo":"jdx/mise","slug":"packslip-release-was-recorded-by-the-source-at","errorCode":null,"errorMessage":"packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age","messagePattern":"packslip release was recorded by the (.+?) at (.+?), after the allowed cutoff (.+?); refusing to bypass minimum_release_age","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":542,"sourceCode":"}\n\n/// The headers a download from GitHub needs; nothing for anywhere else.\n/// Listing timestamps only filter candidates. The authenticated log time\n/// decides whether a selected release is old enough to install.\nfn check_verified_age(\n    logged_at: Option<&str>,\n    published_at: &str,\n    before: Option<jiff::Timestamp>,\n) -> Result<()> {\n    let Some(before) = before else {\n        return Ok(());\n    };\n    let (time, source) = match logged_at {\n        Some(time) => (time, \"transparency log\"),\n        None => (published_at, \"unlogged manifest\"),\n    };\n    if !verified_age_allowed(logged_at, published_at, Some(before))? {\n        bail!(\n            \"packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age\"\n        );\n    }\n    Ok(())\n}\n\n/// A withdrawal in the vendor's signed list is the end of the matter: no\n/// stamp, mirror, or cached manifest reinstates the version.\nfn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {\n    if entry.is_yanked() {\n        bail!(\n            \"packslip:{project}@{version} was withdrawn by the vendor{}\",\n            entry\n                .status_reason\n                .as_deref()\n                .map(|r| format!(\": {r}\"))\n                .unwrap_or_default()\n        );","sourceCodeStart":524,"sourceCodeEnd":560,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L524-L560","documentation":"mise's `minimum_release_age` grace period protects against freshly published (possibly compromised) releases. `check_verified_age` compares the release's recording time — transparency-log time when logged, publication time otherwise — against the allowed cutoff and refuses to install a release that was recorded after the cutoff, so users can't bypass the age requirement.","triggerScenarios":"Calling `install_payload` for a packslip release when `verified_age_allowed(logged_at, published_at, Some(before))` returns false: the release's transparency-log record time (or published_at for unlogged manifests) is newer than the configured `minimum_release_age` cutoff.","commonSituations":"A user sets `minimum_release_age` (e.g. 7 days for supply-chain safety) and tries to install a version released minutes ago; a brand-new tool release is requested on day zero; a backdated re-publication triggers on the unlogged path.","solutions":["Pick an older version that predates the `minimum_release_age` cutoff","Lower or remove `minimum_release_age` in settings if you accept the risk of very fresh releases","Wait until the release is older than the configured age and retry"],"exampleFix":"// before (mise.toml)\n[settings]\nminimum_release_age = 30\n// after\n[settings]\nminimum_release_age = 1","handlingStrategy":"validation","validationCode":"const cutoff = Date.now() - minReleaseAgeDays * 86400_000;\nif (new Date(release.published_at).getTime() > cutoff) {\n  throw new Error(`release ${release.version} is newer than minimum_release_age allows`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin versions in lockfiles so installs are reproducible and age-checked versions are deliberate","Set minimum_release_age consciously and document its interaction with brand-new releases","For urgent fresh releases, explicitly lower the setting rather than being surprised by it"],"tags":["packslip","supply-chain","policy"],"backgroundTag":"invalid-config-value","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}