{"record":{"id":"db017b39a8a8529f","repo":"jdx/mise","slug":"bootstrap-firewall-management-is-only-supported-on","errorCode":null,"errorMessage":"bootstrap firewall management is only supported on Linux","messagePattern":"bootstrap firewall management is only supported on Linux","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/firewall_non_linux.rs","lineNumber":48,"sourceCode":"}\n\npub(crate) fn inspect_request(_request: &mut FirewallRequest) -> Result<()> {\n    Ok(())\n}\n\nimpl FirewallRequest {\n    pub(crate) fn plans(&self) -> Vec<ResourcePlan> {\n        vec![ResourcePlan::new(\n            ResourceId::new(\"firewall\", \"linux\"),\n            \"unsupported platform\",\n            \"configured Linux firewall\",\n            ResourceAction::Unknown,\n        )]\n    }\n}\n\npub(crate) fn apply(_request: &FirewallRequest, _dry_run: bool, _yes: bool) -> Result<()> {\n    bail!(\"bootstrap firewall management is only supported on Linux\")\n}\n\npub(crate) fn inspect_privileged_plan_from_stdin() -> Result<()> {\n    bail!(\"bootstrap firewall management is only supported on Linux\")\n}\n\npub(crate) fn apply_privileged_plan_from_stdin() -> Result<()> {\n    bail!(\"bootstrap firewall management is only supported on Linux\")\n}\n\nfn configured(config: &Config) -> bool {\n    config.config_files.values().any(|cf| {\n        cf.bootstrap_config()\n            .and_then(|bootstrap| bootstrap.linux.firewall)\n            .is_some_and(|firewall| {\n                let _ = firewall.values.len();\n                true\n            })","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/firewall_non_linux.rs#L30-L66","documentation":"On non-Linux platforms the firewall module is compiled to a stub that cannot manage any firewall, so apply() unconditionally returns this error. Firewall bootstrap management is implemented only against Linux backends (nftables/ufw/firewalld); the stub exists to keep the crate cross-platform while making unsupported calls explicit.","triggerScenarios":"Calling the firewall apply() entry point (FirewallRequest, dry_run, yes) on macOS, Windows, or any non-Linux target — regardless of request contents or dry_run flag.","commonSituations":"Developing or running the bootstrap command on a macOS laptop; running the tool in a Windows CI job; cross-platform scripts that invoke firewall management without a platform guard.","solutions":["Run the firewall bootstrap on a Linux host (or Linux container/VM).","Guard the call at compile time with #[cfg(target_os = \"linux\")] and skip or no-op elsewhere.","Skip firewall steps in CI on non-Linux runners (conditional job steps).","Use the platform's native firewall tooling (pf on macOS, Windows Firewall) outside this library."],"exampleFix":"// before\napply(&request, dry_run, yes)?; // panics/errors on macOS\n// after\n#[cfg(target_os = \"linux\")]\napply(&request, dry_run, yes)?;\n#[cfg(not(target_os = \"linux\"))]\neprintln!(\"firewall management skipped: only supported on Linux\");","handlingStrategy":"try-catch","validationCode":"#[cfg(target_os = \"linux\")]\nfn firewall_supported() -> bool { true }\n#[cfg(not(target_os = \"linux\"))]\nfn firewall_supported() -> bool { false }","typeGuard":"fn is_linux() -> bool { cfg!(target_os = \"linux\") }","tryCatchPattern":"if !is_linux() {\n    eprintln!(\"firewall bootstrap requires Linux; skipping\");\n} else {\n    apply(&request, dry_run, yes)?;\n}","preventionTips":["Gate firewall steps behind an OS check","Restrict firewall CI jobs to Linux runners","Skip or substitute native firewall tooling on macOS/Windows","Document platform requirements in runbooks"],"tags":["firewall","platform","linux"],"backgroundTag":"unsupported-platform","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}