{"record":{"id":"f6748d2ee30e01e8","repo":"jdx/mise","slug":"stdin-piped","errorCode":null,"errorMessage":"stdin piped","messagePattern":"stdin piped","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/oci/auth.rs","lineNumber":256,"sourceCode":"        \"https://index.docker.io/v1/\"\n    } else {\n        registry\n    };\n    debug!(\"running {bin} get for {server}\");\n    let mut command = Command::new(&bin);\n    command\n        .arg(\"get\")\n        .stdin(Stdio::piped())\n        .stdout(Stdio::piped())\n        .stderr(Stdio::piped());\n    prepare_noninteractive_child(&mut command);\n    let mut child = command\n        .spawn()\n        .wrap_err_with(|| format!(\"spawning {bin} (from credHelpers/credsStore)\"))?;\n    let _running_pid = RunningPidGuard::new(Some(child.id()));\n    {\n        use std::io::Write;\n        let mut stdin = child.stdin.take().expect(\"stdin piped\");\n        stdin.write_all(server.as_bytes())?;\n    }\n    let out = child.wait_with_output()?;\n    if !out.status.success() {\n        bail!(\n            \"{bin} get failed for {server}: {}\",\n            String::from_utf8_lossy(&out.stderr).trim()\n        );\n    }\n    #[derive(Deserialize)]\n    struct HelperResponse {\n        #[serde(rename = \"Username\")]\n        username: String,\n        #[serde(rename = \"Secret\")]\n        secret: String,\n    }\n    let resp: HelperResponse = serde_json::from_slice(&out.stdout)\n        .wrap_err_with(|| format!(\"parsing {bin} get output\"))?;","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/oci/auth.rs#L238-L274","documentation":"To read OCI registry credentials, mise spawns a docker credential helper (configured via credHelpers/credsStore in docker config.json) with stdin piped, then takes child.stdin with this expect. After a successful spawn with Stdio::piped, take() cannot return None, so this is an internal stdio-wiring invariant rather than a user-facing condition.","triggerScenarios":"Performing OCI registry authentication that resolves a credential helper, in an exotic environment where the piped stdin handle is somehow absent or already consumed internally — only reachable via a mise bug or unusual stdio tampering.","commonSituations":"Practically never; would show up only in crash reports in sandboxed environments that manipulate file descriptors.","solutions":["Update mise and, if it persists, report with RUST_BACKTRACE=1 and your docker config.json credHelpers/credsStore configuration","As a workaround, remove or simplify the credHelpers/credsStore entry so plain credential files are used"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"Treat this panic as an upstream defect: run mise as a subprocess, capture the 101 exit + backtrace, simplify docker config.json's credHelpers/credsStore as a workaround, and report.","preventionTips":["Keep docker config.json credential helper entries pointed at real, working helper binaries","Pin mise versions in OCI build pipelines"],"tags":["panic","oci","credential-helper","subprocess","invariant"],"backgroundTag":"subprocess-stdio-error","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}