{"record":{"id":"d8c1a58cc4422c94","repo":"jdx/mise","slug":"the-stamp-list-at-url-is-for-not-project","errorCode":null,"errorMessage":"the stamp list at {url} is for {}, not {project}","messagePattern":"the stamp list at (.+?) is for (.+?), not (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/packslip_stamps.rs","lineNumber":302,"sourceCode":"    for stamper in &stampers {\n        let url = stamper.url(project);\n        let text = match HTTP_FETCH.get_text(&url).await {\n            Ok(text) => text,\n            Err(err) if is_not_found(&err) => {\n                missing_list(&stamper.host, project, &url)?;\n                debug!(\"{}: no stamp list for {project} at {url}\", stamper.host);\n                stamps.hosts.push(stamper.host.clone());\n                continue;\n            }\n            Err(err) => {\n                return Err(err)\n                    .wrap_err_with(|| format!(\"fetching the stamp list for {project} from {url}\"));\n            }\n        };\n        let list = verify_release_list(&text, &stamper.pin, true)\n            .wrap_err_with(|| format!(\"verifying the stamp list from {}\", stamper.host))?;\n        if list.predicate.project != project {\n            bail!(\n                \"the stamp list at {url} is for {}, not {project}\",\n                list.predicate.project\n            );\n        }\n        check_sequence(&stamper.host, project, &list)?;\n        stamps.add(&stamper.host, &list);\n    }\n    Ok(Some(stamps))\n}\n\nfn is_not_found(err: &eyre::Report) -> bool {\n    crate::http::error_code(err) == Some(404)\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use packslip::model::{","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/packslip_stamps.rs#L284-L320","documentation":"Raised by packslip_stamps::fetch after verifying a stamp list's signature when the list's predicate.project does not match the project that was requested. This guards against a host serving a validly signed but wrong-project list (e.g. a list for a different tool), which would corrupt stamp state.","triggerScenarios":"Fetching the stamp list for `project` from a stamper's URL where verify_release_list succeeds but list.predicate.project differs — typically a URL template pointing at another project's list or a misconfigured stamper mapping.","commonSituations":"Copy-pasting a stamper/list URL from another project; a host redirect serving a different project's list; typos in the project name or URL path; a publisher re-pointing a URL at a different list without updating clients.","solutions":["Fix the stamper/list URL so it points at the list for the requested project.","Check the project name in your tool request/config for typos vs what the host publishes.","Ask the publisher to correct the URL or re-publish the list under the correct project path if the host misroutes."],"exampleFix":"// before (mise.toml)\nstampers = [\"example.com=https://example.com/lists/other-project/\"]\n// after\nstampers = [\"example.com=https://example.com/lists/my-project/\"]","handlingStrategy":"validation","validationCode":"// confirm the list URL's project segment matches the requested project\nfunction urlMatchesProject(url, project) {\n  return decodeURIComponent(url).includes(`/${project}/`) ||\n         decodeURIComponent(url).endsWith(`/${project}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  fetchStampList(host, project);\n} catch (e) {\n  if (String(e).includes(\"is for\") && String(e).includes(\"not\")) {\n    throw new Error(`Stamper URL serves a different project's list; fix the URL for ${project}.`);\n  } else throw e;\n}","preventionTips":["Copy stamper URLs exactly from the publisher's docs for the specific project.","Don't reuse another project's stamper entry as a template without changing the project path.","Verify redirects: ensure the host serves the requested project's list, not a redirect to another one."],"tags":["packslip","project-mismatch","stamper","configuration"],"backgroundTag":"unexpected-response-shape","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}