{"record":{"id":"fec1f70a86dcea2e","repo":"jdx/mise","slug":"the-release-list-at-url-is-for-not-project","errorCode":null,"errorMessage":"the release list at {url} is for {}, not {project}","messagePattern":"the release list at (.+?) is for (.+?), not (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":736,"sourceCode":"    fn repo(project: &str) -> Option<String> {\n        repository(project).map(|(_, owner, repo)| format!(\"{owner}/{repo}\"))\n    }\n\n    async fn release_list(\n        &self,\n        project: &str,\n        pin: &Pin,\n        opts: &PackslipOptions<'_>,\n    ) -> Result<ReleaseListStatement> {\n        let pin = pin.for_release_list(opts)?;\n        let url = well_known_url(project);\n        let text = HTTP_FETCH.get_text(&url).await.wrap_err_with(|| {\n            format!(\"fetching the release list of packslip:{project} from {url}\")\n        })?;\n        let list = verify_release_list(&text, &pin, !opts.allow_unlogged())\n            .wrap_err_with(|| format!(\"verifying the release list of packslip:{project}\"))?;\n        if list.predicate.project != project {\n            bail!(\n                \"the release list at {url} is for {}, not {project}\",\n                list.predicate.project\n            );\n        }\n        check_sequence(project, &list)?;\n        Ok(list)\n    }\n\n    /// The signed list a github.com repository may keep at `.well-known`\n    /// on its default branch, verified against its list signer (by default,\n    /// the same identity as its packslips). `None` when the repository has\n    /// none, which is the usual case: a vendor writes one only to withdraw\n    /// a release, flag a security fix, or list a release whose tag names no version.\n    async fn github_list(\n        &self,\n        project: &str,\n        repo: &str,\n        pin: &Pin,","sourceCodeStart":718,"sourceCodeEnd":754,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/backend/packslip.rs#L718-L754","documentation":"The signed release list fetched from the configured URL verifies cryptographically, but its predicate.project does not match the packslip project being resolved. mise treats a list signed for a different project as unusable for this one, preventing cross-project list substitution.","triggerScenarios":"release_list (called from vendor_entry, recommendation, vendor_versions) after verify_release_list succeeds but list.predicate.project != project for the fetched URL.","commonSituations":"A misconfigured or templated release-list URL pointing at another project's list; a vendor reusing a list URL across renamed projects; copy-pasting a list_url option from a different tool's config.","solutions":["Fix the release list URL in the tool options so it points to the list for this exact project.","Remove a custom list_url option to use the packslip's default list location.","Verify the project name in mise.toml matches the vendor's packslip project id exactly.","Contact the vendor if their published packslip genuinely points at the wrong project's list."],"exampleFix":"// before\n\"packslip:foo\" = { version = \"1.0\", release_list_url = \"https://vendor.example/other-tool.list.json\" }\n\n// after\n\"packslip:foo\" = { version = \"1.0\", release_list_url = \"https://vendor.example/foo.list.json\" }","handlingStrategy":"validation","validationCode":"// Verify the fetched list belongs to the expected project.\nconst list = JSON.parse(listText);\nif (list.predicate.project !== expectedProject) {\n  throw new Error(`list is for ${list.predicate.project}, expected ${expectedProject}`);\n}","typeGuard":"const isListFor = (list, project) => list?.predicate?.project === project;","tryCatchPattern":null,"preventionTips":["Don't share a release_list_url option between differently named packslip tools.","Verify custom list URLs against the vendor's packslip documentation.","Use the packslip's default list location unless you have a specific reason to override it.","When a vendor renames a project, update both the tool id and any custom list URL together."],"tags":["packslip","release-list","project-mismatch","verification"],"backgroundTag":"unexpected-response-shape","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}