{"record":{"id":"49d0f21f3286f9e7","repo":"jdx/mise","slug":"packslip-list-identity-prefix-requires-an-issuer","errorCode":null,"errorMessage":"packslip: list_identity_prefix requires an issuer","messagePattern":"packslip: list_identity_prefix requires an issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":572,"sourceCode":"        ),\n    }\n}\n\nimpl Pin {\n    /// A vendor may publish its index from a different workflow than its bundles.\n    /// The override replaces only the list's subject constraint, retaining the issuer.\n    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {\n        let Some(value) = opts.raw.opts.get(\"list_identity_prefix\") else {\n            return Ok(self.clone());\n        };\n        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {\n            bail!(\"packslip: list_identity_prefix must be a non-empty string\");\n        };\n        let Self::Identity(policy) = self else {\n            bail!(\"packslip: list_identity_prefix cannot be combined with pubkey\");\n        };\n        if policy.issuer.as_deref().is_none_or(str::is_empty) {\n            bail!(\"packslip: list_identity_prefix requires an issuer\");\n        }\n        Ok(Self::Identity(Policy {\n            issuer: policy.issuer.clone(),\n            identity: None,\n            identity_prefix: Some(prefix.to_string()),\n        }))\n    }\n\n    fn trust(&self) -> Trust<'_> {\n        match self {\n            Pin::Identity(policy) => Trust::Identity(policy),\n            Pin::Key(key) => Trust::Key(key),\n        }\n    }\n}\n\n/// Verify a bundle and, for each artifact path given, its digest and size.\n/// Blocks: packslip drives sigstore on a runtime of its own.","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L554-L590","documentation":"Applying a `list_identity_prefix` override requires the existing identity policy to carry an issuer (e.g. the Sigstore OIDC provider URL), because the prefix alone cannot pin who signed the list. If the policy has no issuer or an empty one, the override is rejected.","triggerScenarios":"Setting list_identity_prefix on a pin whose Identity policy was configured with `identity` only and no `issuer`, then calling release_list/github_list.","commonSituations":"Configuring identity = \"user@example.com\" without issuer for a keyless setup; vendor docs showing the prefix option but omitting that issuer is required.","solutions":["Add the `issuer` option, e.g. issuer = \"https://token.actions.githubusercontent.com\".","Remove list_identity_prefix if you want the policy's default identity constraint.","Switch to a `pubkey` pin if you don't want keyless identity trust at all (but then drop list_identity_prefix)."],"exampleFix":"// before\n\"packslip:foo\" = { version = \"1.0\", identity = \"release@vendor.example\", list_identity_prefix = \"https://github.com/vendor/\" }\n\n// after\n\"packslip:foo\" = { version = \"1.0\", identity = \"release@vendor.example\", issuer = \"https://token.actions.githubusercontent.com\", list_identity_prefix = \"https://github.com/vendor/\" }","handlingStrategy":"validation","validationCode":"function validateIssuer(opts) {\n  if (opts.list_identity_prefix !== undefined && !opts.issuer) {\n    throw new Error('list_identity_prefix requires an issuer');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever you set `identity` for a packslip tool, set `issuer` too.","Use the issuer URL matching your vendor's Sigstore provider (commonly the GitHub Actions OIDC URL).","Lint mise.toml for identity options missing issuer before committing."],"tags":["packslip","sigstore","config","trust"],"backgroundTag":"missing-required-config-field","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}