{"record":{"id":"f0f1418df04b60f2","repo":"jdx/mise","slug":"invalid-bootstrap-secret-name-name-use-ascii","errorCode":null,"errorMessage":"invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'","messagePattern":"invalid bootstrap secret name '(.+?)': use ASCII letters, digits, '\\.', '_' or '-'","errorType":"validation","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/system/secrets.rs","lineNumber":299,"sourceCode":"        None if prompt => prompt_value(declaration).map_err(|error| error.to_string())?,\n        None => return Err(format!(\"{} ({})\", declaration.name, declaration.env)),\n    };\n    if value.is_empty() && !declaration.allow_empty {\n        return Err(format!(\n            \"{} ({}) must not be empty\",\n            declaration.name, declaration.env\n        ));\n    }\n    Ok(value)\n}\n\nfn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {\n    if name.is_empty()\n        || !name\n            .chars()\n            .all(|character| character.is_ascii_alphanumeric() || \"_.-\".contains(character))\n    {\n        bail!(\"invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'\");\n    }\n    let (env, description, allow_empty) = match declaration {\n        SecretTomlConfig::Env(env) => (env, None, false),\n        SecretTomlConfig::Options(options) => {\n            (options.env, options.description, options.allow_empty)\n        }\n    };\n    if !valid_env_name(&env) {\n        bail!(\"bootstrap secret '{name}' has invalid environment variable name '{env}'\");\n    }\n    Ok(SecretDeclaration {\n        name,\n        env,\n        description,\n        allow_empty,\n    })\n}\n","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/system/secrets.rs#L281-L317","documentation":"Secret declarations under [bootstrap.secrets] are TOML table keys, and declaration_from_toml validates each key: it must be non-empty and contain only ASCII letters, digits, '.', '_' or '-'. The key is the secret name used in prompts and references; the environment variable it maps to is validated separately (error 887).","triggerScenarios":"A TOML key like 'cache token' (space), 'café' (non-ASCII), 'key$1', or an explicitly empty quoted key under [bootstrap.secrets].","commonSituations":"Human-readable names with spaces pasted from docs or tickets; unicode names; template-generated configs; renaming secrets with characters the validator rejects.","solutions":["Rename the secret key to use only ASCII letters, digits, '.', '_' or '-'","Use dots for namespacing, e.g. 'cache.token' instead of 'cache token'"],"exampleFix":"# before\n[bootstrap.secrets]\n\"cache token\" = \"CACHE_TOKEN\"\n# after\n[bootstrap.secrets]\ncache.token = \"CACHE_TOKEN\"","handlingStrategy":"validation","validationCode":"// Validate secret names before running bootstrap\nfn valid_secret_name(name: &str) -> bool {\n    !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || \"_.-\".contains(c))\n}\nassert!(secrets.keys().all(|k| valid_secret_name(k)));","typeGuard":"fn is_valid_secret_name(name: &str) -> bool {\n    !name.is_empty() && name.chars().all(|c| c.is_ascii_alphanumeric() || \"_.-\".contains(c))\n}","tryCatchPattern":null,"preventionTips":["Use dot-namespacing (cache.token) instead of spaces for multi-word secret names","Generate configs from templates that pass names through the same character whitelist"],"tags":["bootstrap","secrets","validation","toml"],"backgroundTag":"identifier-validation-failed","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}