{"record":{"id":"69cc6dc1d1a711cb","repo":"jdx/mise","slug":"packslip-project-is-not-on-a-forge-mise-knows-s","errorCode":null,"errorMessage":"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options","messagePattern":"packslip:(.+?) is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":448,"sourceCode":"            file::read_to_string(&pubkey)?\n        } else {\n            pubkey\n        };\n        let key = packslip::minisign::PublicKey::parse(&text)\n            .map_err(|e| eyre!(\"packslip:{project}: pubkey: {e}\"))?;\n        return Ok(Pin::Key(key));\n    }\n    let explicit = Policy {\n        issuer: opts.issuer(),\n        identity: opts.identity(),\n        identity_prefix: opts.identity_prefix(),\n    };\n    if !explicit.is_empty() {\n        return Ok(Pin::Identity(explicit));\n    }\n    match Policy::for_project(project) {\n        Some(policy) => Ok(Pin::Identity(policy)),\n        None => bail!(\n            \"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options\"\n        ),\n    }\n}\n\nimpl Pin {\n    /// A vendor may publish its index from a different workflow than its bundles.\n    /// The override replaces only the list's subject constraint, retaining the issuer.\n    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {\n        let Some(value) = opts.raw.opts.get(\"list_identity_prefix\") else {\n            return Ok(self.clone());\n        };\n        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {\n            bail!(\"packslip: list_identity_prefix must be a non-empty string\");\n        };\n        let Self::Identity(policy) = self else {\n            bail!(\"packslip: list_identity_prefix cannot be combined with pubkey\");\n        };","sourceCodeStart":430,"sourceCodeEnd":466,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L430-L466","documentation":"Packslip verifies release signatures, so mise must pin a signer: either explicit user options (`pubkey`, or `identity`+`issuer`) or a built-in trust policy for a known forge. `pin` bails when the project is on an unknown host — no built-in policy exists and the user supplied no explicit signer material — so verification would be meaningless.","triggerScenarios":"Using a `packslip:tool.example.com/owner/repo`-style tool on a self-hosted or niche forge without setting `pubkey` or `identity`/`issuer` tool options.","commonSituations":"Self-hosted Gitea/Forgejo or corporate artifact hosts publishing packslip manifests; migrating a tool from github.com to a private host without updating its options.","solutions":["Add a `pubkey` tool option with the project's signing public key.","Alternatively set `identity` and `issuer` options for signature identity verification.","Host the tool on a forge mise knows (github.com/gitlab.com) so the built-in policy applies."],"exampleFix":"// before\n[tools]\n\"packslip:releases.corp.example/infra/tool\" = \"1.4\"\n// after\n[tools]\n\"packslip:releases.corp.example/infra/tool\" = { version = \"1.4\", pubkey = \"<minisign public key>\" }","handlingStrategy":"validation","validationCode":"const KNOWN_FORGES = [\"github.com\", \"gitlab.com\"];\nconst host = new URL(\"https://\" + project.split(\"/\")[0]).hostname;\nconst hasSigner = opts.pubkey || (opts.identity && opts.issuer);\nif (!KNOWN_FORGES.includes(host) && !hasSigner)\n  throw new Error(`set pubkey (or identity+issuer) for packslip:${project}`);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always ship a `pubkey` (or `identity`+`issuer`) option for custom-host packslip tools.","Keep signing keys in versioned, reviewed config rather than ad-hoc installs.","Prefer known forges so mise's built-in trust policies apply automatically."],"tags":["packslip","signing","trust"],"backgroundTag":"authentication-required","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}