{"record":{"id":"69cc6dc1d1a711cb","repo":"jdx/mise","slug":"packslip-project-is-not-on-a-forge-mise-knows-s","errorCode":null,"errorMessage":"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options","messagePattern":"packslip:(.+?) is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":552,"sourceCode":"            file::read_to_string(&pubkey)?\n        } else {\n            pubkey\n        };\n        let key = packslip::minisign::PublicKey::parse(&text)\n            .map_err(|e| eyre!(\"packslip:{project}: pubkey: {e}\"))?;\n        return Ok(Pin::Key(key));\n    }\n    let explicit = Policy {\n        issuer: opts.issuer(),\n        identity: opts.identity(),\n        identity_prefix: opts.identity_prefix(),\n    };\n    if !explicit.is_empty() {\n        return Ok(Pin::Identity(explicit));\n    }\n    match Policy::for_project(project) {\n        Some(policy) => Ok(Pin::Identity(policy)),\n        None => bail!(\n            \"packslip:{project} is not on a forge mise knows, so nothing pins its signer; set `pubkey`, or `identity` and `issuer`, in its tool options\"\n        ),\n    }\n}\n\nimpl Pin {\n    /// A vendor may publish its index from a different workflow than its bundles.\n    /// The override replaces only the list's subject constraint, retaining the issuer.\n    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {\n        let Some(value) = opts.raw.opts.get(\"list_identity_prefix\") else {\n            return Ok(self.clone());\n        };\n        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {\n            bail!(\"packslip: list_identity_prefix must be a non-empty string\");\n        };\n        let Self::Identity(policy) = self else {\n            bail!(\"packslip: list_identity_prefix cannot be combined with pubkey\");\n        };","sourceCodeStart":534,"sourceCodeEnd":570,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L534-L570","documentation":"Packslip verifies artifacts against a signer pinned by a Sigstore identity. If the project is not on a forge mise knows (so no built-in trust policy applies) and the user supplied no `pubkey` or `identity`/`issuer` tool options, nothing pins the signer, so mise refuses to trust any artifact rather than accepting arbitrary signers.","triggerScenarios":"Installing a packslip:project tool where Policy::for_project returns None and neither `pubkey` nor `identity`+`issuer` options were configured; hit from vendor_versions, install_payload, latest_version, or lock resolution.","commonSituations":"Using a packslip for a self-hosted or niche project not in mise's known-forge policy list; typo'd project name so the policy lookup misses; a new vendor not yet added to mise's policy table.","solutions":["Add trust options in mise.toml: \"packslip:foo\" = { version = \"x\", pubkey = \"-----BEGIN PUBLIC KEY-----...\" }.","Or pin a Sigstore identity: identity = \"release@vendor.example\" and issuer = \"https://token.actions.githubusercontent.com\".","Verify the project name is spelled exactly as the vendor's packslip project id.","Check for a mise update — the vendor may have been added to the built-in policy list."],"exampleFix":"// before\n[tools]\n\"packslip:foo\" = \"1.2.0\"\n\n// after\n[tools]\n\"packslip:foo\" = { version = \"1.2.0\", identity = \"release@vendor.example\", issuer = \"https://token.actions.githubusercontent.com\" }","handlingStrategy":"validation","validationCode":"// Ensure trust options exist before installing an unknown packslip project.\nconst KNOWN_FORGES = ['github.com', 'gitlab.com'];\nfunction hasTrustOption(opts) {\n  return Boolean(opts.pubkey || (opts.identity && opts.issuer));\n}\nif (!KNOWN_FORGES.some(f => projectUrl.startsWith(f)) && !hasTrustOption(toolOpts)) {\n  throw new Error('configure pubkey or identity+issuer for this packslip project');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure `pubkey` or `identity`+`issuer` for projects not hosted on a mainstream forge.","Copy trust options from the vendor's official install docs.","Spell the project id exactly as the vendor publishes it.","Keep mise updated so new vendor trust policies are picked up automatically."],"tags":["packslip","trust","sigstore","signer-pinning"],"backgroundTag":"missing-credentials","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}