{"record":{"id":"f027e2633c6f4ed4","repo":"jdx/mise","slug":"bin-get-failed-for-server-stderr","errorCode":null,"errorMessage":"{bin} get failed for {server}: {stderr}","messagePattern":"(.+?) get failed for (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/oci/auth.rs","lineNumber":261,"sourceCode":"    let mut command = Command::new(&bin);\n    command\n        .arg(\"get\")\n        .stdin(Stdio::piped())\n        .stdout(Stdio::piped())\n        .stderr(Stdio::piped());\n    prepare_noninteractive_child(&mut command);\n    let mut child = command\n        .spawn()\n        .wrap_err_with(|| format!(\"spawning {bin} (from credHelpers/credsStore)\"))?;\n    let _running_pid = RunningPidGuard::new(Some(child.id()));\n    {\n        use std::io::Write;\n        let mut stdin = child.stdin.take().expect(\"stdin piped\");\n        stdin.write_all(server.as_bytes())?;\n    }\n    let out = child.wait_with_output()?;\n    if !out.status.success() {\n        bail!(\n            \"{bin} get failed for {server}: {}\",\n            String::from_utf8_lossy(&out.stderr).trim()\n        );\n    }\n    #[derive(Deserialize)]\n    struct HelperResponse {\n        #[serde(rename = \"Username\")]\n        username: String,\n        #[serde(rename = \"Secret\")]\n        secret: String,\n    }\n    let resp: HelperResponse = serde_json::from_slice(&out.stdout)\n        .wrap_err_with(|| format!(\"parsing {bin} get output\"))?;\n    Ok(Credential {\n        username: resp.username,\n        secret: resp.secret,\n    })\n}","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/oci/auth.rs#L243-L279","documentation":"mise resolves registry credentials by shelling out to the Docker credential helper configured via `credsStore`/`credHelpers` (`docker-credential-<helper> get`). If the helper process exits with a non-zero status, mise raises this error including the helper's stderr. Note the caller treats helper failures as 'no credentials for this registry' and falls through to other sources, but the error is surfaced in debug output.","triggerScenarios":"Running `docker-credential-<store> get <registry>` where the helper binary fails: the backing store (osxkeychain, secretservice, pass, desktop) is unavailable/locked, the helper can't reach its backend, or the registry server string is rejected by the helper.","commonSituations":"`credsStore\": \"desktop\"` on a machine where Docker Desktop isn't running; Linux without a secretservice/keyring (no gnome-keyring or D-Bus session); `pass` store missing the entry or GPG key unavailable; CI containers where the keychain daemon isn't running.","solutions":["Fix the underlying helper: ensure Docker Desktop is running, or the OS keyring/`pass` backend is available and unlocked.","Change `credsStore` in the docker config to a helper that works in this environment (e.g. use plain `auths` entries or `docker-credential-pass`).","Log in non-interactively with explicit credentials (`docker login -u user -p token`) so `auths` entries are used instead of the helper.","Remove/replace the broken `credHelpers` entry for this registry so mise skips it and falls through to other credential sources."],"exampleFix":"// before (~/.docker/config.json)\n{ \"credsStore\": \"desktop\" }\n// after (headless/CI environment)\n{ \"auths\": { \"ghcr.io\": { \"auth\": \"<base64 user:token>\" } } }","handlingStrategy":"try-catch","validationCode":"if ! command -v \"docker-credential-$STORE\" >/dev/null 2>&1; then\n  echo \"helper docker-credential-$STORE missing\"; fi\n# also verify the backend is reachable, e.g.:\ndocker-credential-desktop list > /dev/null 2>&1 || echo \"credential backend unavailable\"","typeGuard":null,"tryCatchPattern":"match credential_from_file(...) {\n    Ok(cred) => use(cred),\n    Err(e) => { debug!(\"credential helper failed: {e}\"); fall_back_to_next_source(); }\n}","preventionTips":["Ensure the credential backend (Docker Desktop, keyring, pass+GPG) is running and unlocked before builds.","In CI/headless environments, prefer explicit `auths` entries or `docker-credential-pass` over `desktop`/`secretservice`.","Test with `echo <registry> | docker-credential-<store> get` before relying on it.","Keep `credsStore`/`credHelpers` entries limited to registries where the helper actually works."],"tags":["docker","credential-helper","oci","process","network"],"backgroundTag":"credential-helper-failed","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}