{"record":{"id":"ff9536576f903628","repo":"lima-vm/lima","slug":"field-provision-d-permissions-can-only-be-set","errorCode":null,"errorMessage":"field `provision[%d].permissions` can only be set when mode is %#q, or %#q","messagePattern":"field `provision\\[(.+?)\\]\\.permissions` can only be set when mode is %#q, or %#q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/limayaml/validate.go","lineNumber":252,"sourceCode":"\t\t\t}\n\t\tdefault:\n\t\t\tif (p.Script == nil || *p.Script == \"\") && p.Mode != limatype.ProvisionModeAnsible {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].script` must not be empty\", i))\n\t\t\t}\n\t\t\tif p.Content != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].content` can only be set when mode is %#q\", i, limatype.ProvisionModeData))\n\t\t\t}\n\t\t\tif p.Overwrite != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].overwrite` can only be set when mode is %#q\", i, limatype.ProvisionModeData))\n\t\t\t}\n\t\t\tif p.Owner != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].owner` can only be set when mode is %#q\", i, limatype.ProvisionModeData))\n\t\t\t}\n\t\t\tif p.Path != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].path` can only be set when mode is %#q, or %#q\", i, limatype.ProvisionModeData, limatype.ProvisionModeYQ))\n\t\t\t}\n\t\t\tif p.Permissions != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].permissions` can only be set when mode is %#q, or %#q\", i, limatype.ProvisionModeData, limatype.ProvisionModeYQ))\n\t\t\t}\n\t\t\tif p.Format != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].format` can only be set when mode is %#q\", i, limatype.ProvisionModeYQ))\n\t\t\t}\n\t\t}\n\t\tif p.Playbook != \"\" {\n\t\t\tif p.Mode != limatype.ProvisionModeAnsible {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].playbook can only be set when mode is %#q\", i, limatype.ProvisionModeAnsible))\n\t\t\t}\n\t\t\tif p.Script != nil && *p.Script != \"\" {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].script must be empty if playbook is set\", i))\n\t\t\t}\n\t\t\tplaybook := p.Playbook\n\t\t\tif _, err := os.Stat(playbook); err != nil {\n\t\t\t\terrs = errors.Join(errs, fmt.Errorf(\"field `provision[%d].playbook` refers to an inaccessible path: %#q: %w\", i, playbook, err))\n\t\t\t}\n\t\t\tlogrus.Warnf(\"provision mode %#q is deprecated, use `ansible-playbook %#q` instead\", limatype.ProvisionModeAnsible, playbook)\n\t\t}","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/lima-vm/lima/blob/dd909d0973cd84fa35f9e1693181b4585ea616c1/pkg/limayaml/validate.go#L234-L270","documentation":"`permissions` is an octal mode applied to files written by data-mode or edited by yq-mode provision entries. Validate() rejects it on all other modes (system/user/boot/dependency/ansible) since scripts set their own file modes. The rendered message lists `\"data\"` and `\"yq\"` as the allowed modes.","triggerScenarios":"A provision entry with a mode other than data/yq that sets `permissions`, during create/start/restart/edit/apply/template validation.","commonSituations":"Copy-pasted data-entry field sets applied to script entries; template generators emitting permissions unconditionally; converting a data entry to dependency mode and keeping permissions.","solutions":["Set `mode: data` or `mode: yq` (with `path`) if permissions are intended","Delete the `permissions` field from the script entry","Use `chmod` inside the `script` instead"],"exampleFix":"# before\nprovision:\n  - mode: dependency\n    permissions: \"0755\"\n    script: dep install\n# after\nprovision:\n  - mode: dependency\n    script: dep install && chmod 755 /usr/local/bin/dep","handlingStrategy":"validation","validationCode":"// Go: permissions requires data or yq mode\nfor i, p := range cfg.Provision {\n    mode := limatype.ProvisionModeSystem\n    if p.Mode != nil { mode = *p.Mode }\n    if p.Permissions != nil && mode != limatype.ProvisionModeData && mode != limatype.ProvisionModeYQ {\n        return fmt.Errorf(\"provision[%d]: permissions requires mode data or yq\", i)\n    }\n}","typeGuard":"func permissionsAllowed(p limatype.Provision) bool {\n    if p.Permissions == nil { return true }\n    return p.Mode != nil && (*p.Mode == limatype.ProvisionModeData || *p.Mode == limatype.ProvisionModeYQ)\n}","tryCatchPattern":null,"preventionTips":["Use chmod in scripts for script-mode file permissions","Keep permissions quoted and octal (\"0644\")","Pair permissions with path+content (data) or path+expression (yq)"],"tags":["lima","config-validation","provision","mode-mismatch"],"backgroundTag":"invalid-field-combination","analyzedSha":"dd909d0973cd84fa35f9e1693181b4585ea616c1","analyzedAt":"2026-09-01T14:24:59.842Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}