{"record":{"id":"8c0df587a9969299","repo":"NousResearch/hermes-agent","slug":"no-install-script-pin-supplied-installer-cannot","errorCode":null,"errorMessage":"no install-script pin supplied — installer cannot resolve a script source","messagePattern":"no install-script pin supplied — installer cannot resolve a script source","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"apps/bootstrap-installer/src-tauri/src/install_script.rs","lineNumber":139,"sourceCode":"    }\n\n    // 2. (Not implemented) bundled fallback.\n\n    // 3. Network. Pin must be a real commit or a branch ref.\n    //\n    // Commit SHAs are immutable — permanent cache reuse is safe.\n    // Branch/tag pins are moving refs: always try to refresh so \"Retry install\"\n    // cannot keep reusing a poisoned install-main.ps1 forever (#67193).\n    let (commit_or_ref, immutable) = match (&pin.commit, &pin.branch) {\n        (Some(c), _) if is_valid_commit(c) => (c.clone(), true),\n        (_, Some(b)) if !b.trim().is_empty() => (b.clone(), false),\n        (Some(other), _) => {\n            return Err(anyhow!(\n                \"install script pin commit `{other}` is not a valid git SHA\"\n            ));\n        }\n        _ => {\n            return Err(anyhow!(\n                \"no install-script pin supplied — installer cannot resolve a script source\"\n            ));\n        }\n    };\n\n    let cached = cached_path(kind, &commit_or_ref);\n    match cache_plan(immutable, cached.exists()) {\n        CachePlan::Reuse => {\n            emit_log(&format!(\n                \"[bootstrap] using cached {} for {}\",\n                kind.filename(),\n                truncate_ref(&commit_or_ref)\n            ));\n            // Immutable pins are cached forever, so a .ps1 cached by a\n            // pre-BOM-fix installer would keep the #67193 encoding bug on\n            // every retry. Upgrade it in place before handing it out.\n            upgrade_cached_script(kind, &cached, emit_log);\n            return Ok(ResolvedScript {","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/NousResearch/hermes-agent/blob/c896c09c42910c584c4c7d2325b58c14713ea42c/apps/bootstrap-installer/src-tauri/src/install_script.rs#L121-L157","documentation":"Raised while resolving the install-script source: neither pin.commit nor pin.branch was supplied, and no bundled fallback exists (the bundled-fallback path is explicitly not implemented). With no pin, the installer cannot decide which install-main.ps1 to fetch or cache, so it refuses rather than guessing a default ref.","triggerScenarios":"Building/running the bootstrap installer without BUILD_PIN_COMMIT and without BUILD_PIN_BRANCH compiled in, and with no pin passed on the command line; both env vars empty at compile time in a dev build (`cargo run` instead of a release build that injects pins).","commonSituations":"A developer runs the Tauri installer via `cargo tauri dev` where the pin env vars are not exported; CI builds the installer matrix job that forgot to pass the pin arguments; option_env_string returns None because the variable name was misspelled.","solutions":["Export at least one pin before building: `BUILD_PIN_COMMIT=$(git rev-parse HEAD) cargo tauri build` (or BUILD_PIN_BRANCH=main).","If invoking the installer binary directly, pass the pin via its command-line arguments instead of env.","Add a build script assertion so unpinned builds fail at compile time with a clearer message."],"exampleFix":"# before\nnpm run tauri build\n\n# after\nexport BUILD_PIN_COMMIT=$(git rev-parse HEAD)\nnpm run tauri build","handlingStrategy":"validation","validationCode":"// build.rs — refuse to produce an unpinned installer.\nfn main() {\n    let commit = option_env!(\"BUILD_PIN_COMMIT\");\n    let branch = option_env!(\"BUILD_PIN_BRANCH\");\n    if commit.is_none() && branch.is_none() {\n        panic!(\"No install-script pin: set BUILD_PIN_COMMIT=$(git rev-parse HEAD) or BUILD_PIN_BRANCH before building\");\n    }\n    println!(\"cargo:rerun-if-env-changed=BUILD_PIN_COMMIT\");\n    println!(\"cargo:rerun-if-env-changed=BUILD_PIN_BRANCH\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make CI pass an explicit pin and fail the build when neither pin env var is set.","Document the required pin env vars next to the tauri build command in the repo README.","Prefer commit pins for release builds (immutable + cacheable) and branch pins only for dev channels."],"tags":["build-config","pinning","bootstrap-installer","git"],"backgroundTag":null,"analyzedSha":"c896c09c42910c584c4c7d2325b58c14713ea42c","analyzedAt":"2026-08-14T17:18:01.089Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}