{"record":{"id":"868fbb5a654e252f","repo":"jdx/mise","slug":"evaluating-third-party-tap-definitions-is-only-sup","errorCode":null,"errorMessage":"evaluating third-party tap definitions is only supported inside the Linux or macOS process sandbox","messagePattern":"evaluating third-party tap definitions is only supported inside the Linux or macOS process sandbox","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/tap.rs","lineNumber":157,"sourceCode":"    Ok(cask)\n}\n\n#[cfg(any(target_os = \"linux\", target_os = \"macos\"))]\nfn metadata_sandbox() -> Result<SandboxConfig> {\n    Ok(SandboxConfig {\n        deny_read: true,\n        deny_write: true,\n        deny_net: true,\n        deny_env: true,\n        deny_process: true,\n        deny_temp_write: true,\n        ..Default::default()\n    })\n}\n\n#[cfg(not(any(target_os = \"linux\", target_os = \"macos\")))]\nfn metadata_sandbox() -> Result<SandboxConfig> {\n    bail!(\n        \"evaluating third-party tap definitions is only supported inside the Linux or macOS process sandbox\"\n    )\n}\n\nfn macos_version() -> String {\n    if cfg!(target_os = \"macos\") {\n        crate::cmd::cmd(\"sw_vers\", [\"-productVersion\"])\n            .read()\n            .map(|version| version.trim().to_string())\n            .unwrap_or_default()\n    } else {\n        \"0\".to_string()\n    }\n}\n\nasync fn resolve_tap_source(owner: &str, tap: &str, tap_url: Option<&str>) -> Result<TapSource> {\n    let raw_base = api::tap_raw_base(owner, tap, tap_url)\n        .ok_or_else(|| eyre::eyre!(\"only GitHub tap URLs can be fetched directly\"))?;","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/packages/brew/tap.rs#L139-L175","documentation":"Evaluating third-party tap Ruby definitions is only permitted inside mise's Linux/macOS process sandbox, because running arbitrary Ruby from a tap is untrusted. On other platforms (e.g. Windows) `metadata_sandbox` has no sandbox implementation and unconditionally bails with this message.","triggerScenarios":"Installing any formula from a third-party tap that requires Ruby metadata evaluation on a platform other than Linux or macOS (e.g. Windows), where the `#[cfg(not(linux|macos))] metadata_sandbox()` variant always errors.","commonSituations":"Using mise on Windows and adding a third-party brew tap; core formulas with bottles work because they skip tap evaluation, but direct-source third-party formulas hit this wall.","solutions":["Install the tool via a platform-supported mise backend (github:, cargo:, npm:, aqua:)","Use a Windows-native tool variant instead of the Homebrew tap formula","Run mise under WSL (Linux) so the sandbox path is available","Install via real Homebrew outside mise if a Windows Homebrew setup exists"],"exampleFix":"// before: mise.toml (Windows)\n\"brew:thirdparty-tool\" = \"latest\"\n// after\n\"github:org/thirdparty-tool\" = \"latest\"","handlingStrategy":"fallback","validationCode":"if !(cfg!(target_os = \"linux\") || cfg!(target_os = \"macos\")) {\n    eprintln!(\"third-party tap evaluation unsupported here; use another backend\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["On Windows, use github:/npm:/cargo: backends instead of third-party brew taps","Run mise under WSL when Homebrew tap evaluation is required","Stick to core bottled formulas on non-Unix platforms"],"tags":["homebrew","sandbox","platform","windows"],"backgroundTag":"unsupported-platform","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}