{"record":{"id":"fbb3facb3a8f9cee","repo":"jdx/mise","slug":"brew-cask-binary-target-must-be-under-fbb3fa","errorCode":null,"errorMessage":"brew-cask: binary target '{}' must be under {}","messagePattern":"brew-cask: binary target '(.+?)' must be under (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/packages/brew/cask/paths.rs","lineNumber":305,"sourceCode":"    let target = if path.is_absolute() {\n        path\n    } else if target_name.contains('/') {\n        prefix.join(path)\n    } else {\n        prefix.join(\"bin\").join(path)\n    };\n    if target\n        .components()\n        .any(|component| matches!(component, Component::ParentDir))\n    {\n        bail!(\n            \"brew-cask: binary target '{}' must not contain '..'\",\n            target.display()\n        );\n    }\n    let roots = allowed_binary_target_roots();\n    if !roots.iter().any(|root| target.starts_with(root)) {\n        bail!(\n            \"brew-cask: binary target '{}' must be under {}\",\n            target.display(),\n            allowed_binary_target_roots_display(&roots)\n        );\n    }\n    Ok(target)\n}\n","sourceCodeStart":287,"sourceCodeEnd":313,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/packages/brew/cask/paths.rs#L287-L313","documentation":"This error is thrown by `binary_target_path` in src/system/packages/brew/cask/paths.rs when a resolved binary target path is not under any of the allowed binary target roots (`allowed_binary_target_roots()`, e.g. Homebrew prefix trees and /usr/local). After passing the `..` check, the library requires every cask binary to be linked inside one of these sanctioned trees, and the error message lists the acceptable roots.","triggerScenarios":"Calling `binary_target_path(target_name, appdir)` with an absolute target (or one expanded from `$HOMEBREW_PREFIX`) that does not `starts_with` any allowed root — e.g. an absolute path like `/opt/tools/foo`, or a `$HOMEBREW_PREFIX` substitution pointing outside the expected prefix when the configured prefix differs from the actual install location. Reached via `target_path` or `binary_targets_must_stay_under_an_allowed_root`.","commonSituations":"A cask formula hardcodes an absolute install path outside Homebrew's trees; the user's Homebrew is installed in a non-standard prefix while the formula assumed the default; a hand-edited stanza points at `/usr/bin` or `/Applications` binaries; moving Homebrew between machines with stale absolute paths.","solutions":["Check the allowed roots listed in the error message and rewrite the target under one of them (typically `$(brew --prefix)/...`)","Use `$HOMEBREW_PREFIX` instead of a hardcoded absolute path so the target tracks the real prefix","If Homebrew's actual prefix differs from the configured one, fix the prefix configuration so `prefix::prefix()` matches the real install","Symlink the external binary into an allowed tree and reference that link instead"],"exampleFix":"// before\nbinary_target_path(\"/opt/mytools/tool\", &appdir)\n// error: binary target '/opt/mytools/tool' must be under ...\n\n// after\nbinary_target_path(\"$HOMEBREW_PREFIX/opt/mytools/bin/tool\", &appdir)","handlingStrategy":"validation","validationCode":"fn target_is_under_allowed_roots(target: &std::path::Path) -> bool {\n    allowed_binary_target_roots().iter().any(|root| target.starts_with(root))\n}","typeGuard":"fn confined_target(t: &str) -> Option<std::path::PathBuf> {\n    binary_target_path(t, appdir).ok().filter(|p| target_is_under_allowed_roots(p))\n}","tryCatchPattern":"match binary_target_path(target_name, &appdir) {\n    Ok(path) => use(path),\n    Err(e) if e.to_string().contains(\"must be under\") => relocate_target_under_allowed_root(target_name),\n    Err(e) => return Err(e),\n}","preventionTips":["Prefer `$HOMEBREW_PREFIX` over hardcoded absolute paths in target stanzas","Confirm Homebrew's real prefix matches the configured one (`brew --prefix`)","Keep cask binaries under the Homebrew prefix or /usr/local trees"],"tags":["path-validation","brew-cask","invalid-config-value"],"backgroundTag":"invalid-config-value","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}