{"record":{"id":"4812b1cfc61b2583","repo":"jdx/mise","slug":"packslip-list-identity-prefix-cannot-be-combined","errorCode":null,"errorMessage":"packslip: list_identity_prefix cannot be combined with pubkey","messagePattern":"packslip: list_identity_prefix cannot be combined with pubkey","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":465,"sourceCode":"        Some(policy) => Ok(Pin::Identity(policy)),\n        None => bail!(\n            \"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options\"\n        ),\n    }\n}\n\nimpl Pin {\n    /// A vendor may publish its index from a different workflow than its bundles.\n    /// The override replaces only the list's subject constraint, retaining the issuer.\n    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {\n        let Some(value) = opts.raw.opts.get(\"list_identity_prefix\") else {\n            return Ok(self.clone());\n        };\n        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {\n            bail!(\"packslip: list_identity_prefix must be a non-empty string\");\n        };\n        let Self::Identity(policy) = self else {\n            bail!(\"packslip: list_identity_prefix cannot be combined with pubkey\");\n        };\n        if policy.issuer.as_deref().is_none_or(str::is_empty) {\n            bail!(\"packslip: list_identity_prefix requires an issuer\");\n        }\n        Ok(Self::Identity(Policy {\n            issuer: policy.issuer.clone(),\n            identity: None,\n            identity_prefix: Some(prefix.to_string()),\n        }))\n    }\n\n    fn trust(&self) -> Trust<'_> {\n        match self {\n            Pin::Identity(policy) => Trust::Identity(policy),\n            Pin::Key(key) => Trust::Key(key),\n        }\n    }\n}","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L447-L483","documentation":"`for_release_list` only allows `list_identity_prefix` on an Identity-based policy (issuer + identity-prefix trust). If the active policy is a raw pubkey pin, a prefix override cannot apply — the two trust modes are mutually exclusive — so mise refuses the combination rather than silently ignoring one side. This prevents a config that looks like it narrows trust but actually verifies against a pubkey.","triggerScenarios":"Calling `release_list` or `github_list` with a packslip pin that resolves to `Policy::Identity`'s opposite variant (pubkey-based trust) while an override sets `list_identity_prefix` in the packslip options.","commonSituations":"A vendor's mise.toml pins the release list with a raw pubkey, and the user (or a copied config snippet) also sets `list_identity_prefix`; someone migrates config from identity-prefix style to pubkey pinning but keeps the old prefix key.","solutions":["Remove the `list_identity_prefix` override, since a pubkey pin doesn't use an identity prefix","Switch the pin to identity-based trust (issuer + optional prefix) if you want to constrain by identity prefix instead of a literal pubkey","Use only one trust mechanism: either pubkey or identity configuration, not both"],"exampleFix":"// before\n[tools.\"packslip:acme\"]\npubkey = \"sha256:AAAA...\"\nlist_identity_prefix = \"acme\"\n// after\n[tools.\"packslip:acme\"]\npubkey = \"sha256:AAAA...\"","handlingStrategy":"validation","validationCode":"const hasPubkey = cfg.pubkey != null;\nconst hasPrefix = cfg.list_identity_prefix != null;\nif (hasPubkey && hasPrefix) throw new Error(\"pubkey and list_identity_prefix are mutually exclusive\");","typeGuard":"fn uses_identity_policy(policy: &Policy) -> bool {\n    matches!(policy, Policy::Identity { .. })\n}","tryCatchPattern":null,"preventionTips":["Decide on one trust mode (pubkey OR identity) per packslip pin and stick to it","When migrating config from identity-prefix to pubkey pinning, remove the old prefix key","Copy config examples from the vendor wholesale instead of mixing examples"],"tags":["packslip","config","conflict"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}