{"record":{"id":"4812b1cfc61b2583","repo":"jdx/mise","slug":"packslip-list-identity-prefix-cannot-be-combined","errorCode":null,"errorMessage":"packslip: list_identity_prefix cannot be combined with pubkey","messagePattern":"packslip: list_identity_prefix cannot be combined with pubkey","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":569,"sourceCode":"        Some(policy) => Ok(Pin::Identity(policy)),\n        None => bail!(\n            \"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options\"\n        ),\n    }\n}\n\nimpl Pin {\n    /// A vendor may publish its index from a different workflow than its bundles.\n    /// The override replaces only the list's subject constraint, retaining the issuer.\n    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {\n        let Some(value) = opts.raw.opts.get(\"list_identity_prefix\") else {\n            return Ok(self.clone());\n        };\n        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {\n            bail!(\"packslip: list_identity_prefix must be a non-empty string\");\n        };\n        let Self::Identity(policy) = self else {\n            bail!(\"packslip: list_identity_prefix cannot be combined with pubkey\");\n        };\n        if policy.issuer.as_deref().is_none_or(str::is_empty) {\n            bail!(\"packslip: list_identity_prefix requires an issuer\");\n        }\n        Ok(Self::Identity(Policy {\n            issuer: policy.issuer.clone(),\n            identity: None,\n            identity_prefix: Some(prefix.to_string()),\n        }))\n    }\n\n    fn trust(&self) -> Trust<'_> {\n        match self {\n            Pin::Identity(policy) => Trust::Identity(policy),\n            Pin::Key(key) => Trust::Key(key),\n        }\n    }\n}","sourceCodeStart":551,"sourceCodeEnd":587,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L551-L587","documentation":"`list_identity_prefix` only refines an identity-based (Sigstore identity) trust policy. If the pin was built from a raw `pubkey`, there is no identity to retain an issuer from, so combining the two options is rejected as contradictory.","triggerScenarios":"Configuring a packslip tool with both `pubkey` and `list_identity_prefix`, then calling release_list or github_list (for_release_list override).","commonSituations":"Copy-pasting trust options from two different examples; a vendor migrating from pubkey pinning to keyless Sigstore identities while the user keeps both options.","solutions":["Remove `pubkey` and pin via `identity` (or `identity` + `issuer`) instead if you want to use list_identity_prefix.","Remove `list_identity_prefix` if you intend to trust via the raw public key.","Keep the two tools' configs separate — one pubkey-pinned tool and one identity-pinned tool cannot share these options."],"exampleFix":"// before\n\"packslip:foo\" = { version = \"1.0\", pubkey = \"...\", list_identity_prefix = \"https://github.com/vendor/\" }\n\n// after\n\"packslip:foo\" = { version = \"1.0\", identity = \"release@vendor.example\", issuer = \"https://token.actions.githubusercontent.com\", list_identity_prefix = \"https://github.com/vendor/\" }","handlingStrategy":"validation","validationCode":"function validateTrustOptions(opts) {\n  if (opts.pubkey && opts.list_identity_prefix !== undefined) {\n    throw new Error('list_identity_prefix cannot be combined with pubkey');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Decide on one trust model per tool: pubkey OR Sigstore identity, never both.","When migrating a vendor from pubkey to keyless signing, delete the old pubkey option.","Keep a per-project config checklist of which trust options are mutually exclusive."],"tags":["packslip","config","conflicting-options","trust"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}