{"record":{"id":"d7a44d93f5ad21cc","repo":"jdx/mise","slug":"vfox-plugin-artifacts-must-not-declare-host-requir","errorCode":null,"errorMessage":"vfox plugin artifacts must not declare host requirements","messagePattern":"vfox plugin artifacts must not declare host requirements","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/plugins/packslip.rs","lineNumber":194,"sourceCode":"pub(crate) fn validate_artifact(artifact: &packslip::model::Artifact) -> Result<()> {\n    ensure!(\n        artifact\n            .extensions\n            .get(\"mise\")\n            .and_then(|v| v.get(\"plugin\"))\n            .and_then(|v| v.as_str())\n            == Some(\"vfox\"),\n        \"packslip artifact must declare extensions.mise.plugin = vfox\"\n    );\n    ensure!(\n        artifact.bin.is_empty(),\n        \"vfox plugin artifacts must not declare executables\"\n    );\n    ensure!(\n        artifact.os.is_none() && artifact.arch.is_none() && artifact.libc.is_none(),\n        \"vfox plugin artifact must be portable\"\n    );\n    ensure!(\n        artifact.requires.is_none(),\n        \"vfox plugin artifacts must not declare host requirements\"\n    );\n    ensure!(\n        matches!(artifact.format.as_deref(), Some(\"tar.gz\" | \"tgz\")),\n        \"vfox plugin artifacts currently require tar.gz format\"\n    );\n    Ok(())\n}\n\n/// Reject links and special files before extraction, including links whose\n/// targets might otherwise be resolved while unpacking a later archive entry.\npub(crate) fn validate_archive(path: &Path) -> Result<()> {\n    let reader = flate2::read::GzDecoder::new(std::fs::File::open(path)?);\n    let mut archive = jdx_tar::Archive::new(reader);\n    for entry in archive.entries()? {\n        let entry = entry?;\n        ensure!(","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/plugins/packslip.rs#L176-L212","documentation":"The vfox plugin contract rejects artifacts whose manifest declares a `requires` section (host requirements such as minimum vfox/mise versions or runtime features). `validate_artifact` in src/plugins/packslip.rs enforces `artifact.requires.is_none()` because mise embeds vfox and manages compatibility itself.","triggerScenarios":"A packslip artifact manifest contains a `requires` object/table (e.g. requires.vfox = \">=0.3\" or host requirement entries) while the artifact is being validated as a vfox plugin.","commonSituations":"Author copied a manifest shape from another plugin ecosystem (asdf/vfox upstream metadata) that declares host requirements; a release generator emits requires blocks unconditionally.","solutions":["Delete the `requires` section from the plugin artifact's manifest and republish.","Document any minimum-version constraints in the plugin README or repository metadata instead of the artifact manifest.","If version-gated behavior is needed, implement a runtime check inside the plugin's Lua code."],"exampleFix":"// before (manifest)\n[artifacts.plugin.requires]\nvfox = \">=0.3\"\n\n// after (manifest)\n[artifacts.plugin]\n# requires section removed\n","handlingStrategy":"validation","validationCode":"jq -e '.artifacts[] | select(.extensions.mise.plugin == \"vfox\" and (.requires == null))' manifest.json \\\n  || { echo \"vfox plugin artifact must not declare requires\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Omit any requires/host-requirement sections from plugin manifests.","Express minimum-version needs as runtime checks in the plugin's Lua code.","Review manifests copied from other ecosystems for leftover requires blocks."],"tags":["packslip","vfox","manifest","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}