{"record":{"id":"9af9cdf192a81362","repo":"jdx/mise","slug":"encrypted-dotfile-target-requires-an-external-so","errorCode":null,"errorMessage":"encrypted dotfile {target} requires an external source, not inline content or edits","messagePattern":"encrypted dotfile (.+?) requires an external source, not inline content or edits","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/files.rs","lineNumber":543,"sourceCode":"pub(crate) fn validate_incoming_files(config_files: &ConfigMap) -> Result<()> {\n    for (path, config) in config_files {\n        let Some(dotfiles) = config.dotfiles_config() else {\n            continue;\n        };\n        for (target, value) in dotfiles.0 {\n            if value.as_table().is_some_and(|t| {\n                t.contains_key(\"encrypt\")\n                    && t.get(\"encrypt\").and_then(toml::Value::as_bool).is_none()\n            }) {\n                bail!(\"dotfile {target}: encrypt must be a boolean\");\n            }\n            if value.as_table().is_some_and(|t| {\n                t.get(\"encrypt\").and_then(toml::Value::as_bool) == Some(true)\n                    && [\"content\", \"block\", \"line\", \"template\"]\n                        .iter()\n                        .any(|key| t.contains_key(*key))\n            }) {\n                bail!(\n                    \"encrypted dotfile {target} requires an external source, not inline content or edits\"\n                );\n            }\n            let Some(entry) = file_entry_from_toml(&target, value.clone()) else {\n                // Managed line/block edits are handled by the edit engine,\n                // not by this whole-file declaration parser.\n                if value.as_table().is_some_and(|table| {\n                    [\"block\", \"line\", \"template\", \"comment\", \"position\"]\n                        .iter()\n                        .any(|key| table.contains_key(*key))\n                }) {\n                    continue;\n                }\n                bail!(\"invalid dotfile declaration {target} in {}\", path.display());\n            };\n            if let Some(table) = value.as_table() {\n                for key in table.keys() {\n                    if !matches!(","sourceCodeStart":525,"sourceCodeEnd":561,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/system/files.rs#L525-L561","documentation":"An encrypted dotfile's plaintext is fetched from an external source (mise decrypts it before applying), so it cannot also declare inline `content`, edits (`block`, `line`), or a `template` — there is no way to combine encryption with inline body definitions. validate_incoming_files rejects any entry with encrypt = true that contains any of those keys.","triggerScenarios":"A [dotfiles.\"<target>\"] entry with encrypt = true that also declares one of content, block, line, or template; the validator's key scan matches and it bails immediately.","commonSituations":"The user wants to encrypt a file but wrote the body inline in mise.toml (content = \"...\") or layered managed edits on an encrypted file; converting a previously inline dotfile to encrypt = true without moving the content to an external encrypted file.","solutions":["Move the file's body into an external file, encrypt it (e.g. with age/sops/gpg), and reference it via source; keep encrypt = true.","Remove encrypt = true if the content truly is inline (and encrypt the file some other way).","Remove the content/block/line/template keys — encrypted entries must not carry inline bodies or managed edits; manage edits in the decrypted source workflow instead."],"exampleFix":"# before\n[dotfiles.\"~/.aws/credentials\"]\nencrypt = true\ncontent = \"[default]\\naws_access_key_id=...\"\n\n# after\n[dotfiles.\"~/.aws/credentials\"]\nencrypt = true\nsource = \"~/secrets/aws-credentials.age\"","handlingStrategy":"validation","validationCode":"# reject encrypted entries carrying inline bodies\nawk '/encrypt = true/{e=1} e && /^(content|block|line|template) *=/{print \"conflict\"; exit}' mise.toml","typeGuard":"const encryptedEntryIsValid = (t: Record<string, unknown>) =>\n  t.encrypt !== true || ![\"content\",\"block\",\"line\",\"template\"].some(k => k in t);","tryCatchPattern":null,"preventionTips":["Store encrypted dotfile bodies in external encrypted files referenced via source","Never mix encrypt = true with content/template/managed-edit keys","Encrypt the source file itself, not the config entry"],"tags":["rust","dotfiles","config","encryption"],"backgroundTag":"conflicting-config-options","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}