{"record":{"id":"fec1f70a86dcea2e","repo":"jdx/mise","slug":"the-release-list-at-url-is-for-not-project","errorCode":null,"errorMessage":"the release list at {url} is for {}, not {project}","messagePattern":"the release list at (.+?) is for (.+?), not (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/backend/packslip.rs","lineNumber":631,"sourceCode":"    fn repo(project: &str) -> Option<String> {\n        repository(project).map(|(_, owner, repo)| format!(\"{owner}/{repo}\"))\n    }\n\n    async fn release_list(\n        &self,\n        project: &str,\n        pin: &Pin,\n        opts: &PackslipOptions<'_>,\n    ) -> Result<ReleaseListStatement> {\n        let pin = pin.for_release_list(opts)?;\n        let url = well_known_url(project);\n        let text = HTTP_FETCH.get_text(&url).await.wrap_err_with(|| {\n            format!(\"fetching the release list of packslip:{project} from {url}\")\n        })?;\n        let list = verify_release_list(&text, &pin, !opts.allow_unlogged())\n            .wrap_err_with(|| format!(\"verifying the release list of packslip:{project}\"))?;\n        if list.predicate.project != project {\n            bail!(\n                \"the release list at {url} is for {}, not {project}\",\n                list.predicate.project\n            );\n        }\n        check_sequence(project, &list)?;\n        Ok(list)\n    }\n\n    /// The signed list a github.com repository may keep at `.well-known`\n    /// on its default branch, verified against its list signer (by default,\n    /// the same identity as its packslips). `None` when the repository has\n    /// none, which is the usual case: a vendor writes one only to withdraw\n    /// a release, flag a security fix, or list a release whose tag names no version.\n    async fn github_list(\n        &self,\n        project: &str,\n        repo: &str,\n        pin: &Pin,","sourceCodeStart":613,"sourceCodeEnd":649,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/backend/packslip.rs#L613-L649","documentation":"A packslip release list is bound to a specific project name in its predicate. After fetching and verifying the list from the configured URL, mise compares `list.predicate.project` with the requested project and bails if they differ — this guards against a misconfigured URL serving another project's list that would otherwise pass signature verification under the wrong pin.","triggerScenarios":"Calling `release_list` (from `vendor_entry`, `recommendation`, or `vendor_versions`) when the fetched and verified list's `predicate.project` does not equal the requested packslip project name.","commonSituations":"A user points the release-list URL at another project's list (copy-paste error); a vendor reorganizes and the URL now hosts a renamed project's list; a typo in the project slug makes the requested name differ from the list's subject.","solutions":["Correct the release-list URL in the packslip pin so it points at the list for the requested project","Fix the project name in your mise.toml to match the list's actual subject project","Ask the vendor to publish a list with the correct project name if they renamed the project"],"exampleFix":"// before\n[tools.\"packslip:acme-cli\"]\nrelease_list_url = \"https://example.com/acme-lib.releaselist.json\"\n// after\n[tools.\"packslip:acme-cli\"]\nrelease_list_url = \"https://example.com/acme-cli.releaselist.json\"","handlingStrategy":"validation","validationCode":"const expected = `packslip:${project}`;\nif (!releaseListUrl.includes(project)) {\n  console.warn(`release list URL may not match project ${project}`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the release-list URL from the vendor's official docs, not from another project's config","Check the project slug spelling matches the vendor's list subject","Re-check URLs after a vendor reorganization or project rename"],"tags":["packslip","config","mismatch"],"backgroundTag":"unexpected-response-shape","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}