bootstrap resource '{resource}' requires group '{group}', bu

Error message

bootstrap resource '{resource}' requires group '{group}', but that group is absent

What it means

The group counterpart to the owner check: when a bootstrap resource declares a group and the planner sees that the group account is managed as Absent, it cannot attach a valid group dependency, so planning fails. Like the owner check, this fires before any changes are made.

Source

Thrown at src/system/resources.rs:651

        return Ok(());
    }
    if let Some(owner) = owner {
        match user_states.get(owner) {
            Some(super::accounts::AccountState::Present) => {
                plan.add_dependency(resource, ResourceId::new("user", owner))?;
            }
            Some(super::accounts::AccountState::Absent) => bail!(
                "bootstrap resource '{resource}' requires owner '{owner}', but that user is absent"
            ),
            None => {}
        }
    }
    if let Some(group) = group {
        match group_states.get(group) {
            Some(super::accounts::AccountState::Present) => {
                plan.add_dependency(resource, ResourceId::new("group", group))?;
            }
            Some(super::accounts::AccountState::Absent) => bail!(
                "bootstrap resource '{resource}' requires group '{group}', but that group is absent"
            ),
            None => {}
        }
    }
    Ok(())
}

fn desired_package(request: &super::packages::PackageRequest) -> String {
    if request.desired == super::packages::PackageDesiredState::Absent {
        return "absent".to_string();
    }
    request
        .version
        .as_ref()
        .map(|version| format!("installed ({version})"))
        .unwrap_or_else(|| "installed (any version)".to_string())
}

View on GitHub (pinned to afd2eddd3a)

Solutions

Set the referenced group's resource to Present, or pick a group that exists in the plan.
Delete the group-removal declaration if the group should remain.
Mark the dependent resource absent too if everything under it is being torn down.
Correct the group name if it is misspelled relative to the declared group resource.

Example fix

// before
group("appsvc", AccountState::Absent);
resource("/srv/app", group: "appsvc");
// after
group("appsvc", AccountState::Present);
resource("/srv/app", group: "appsvc");

Defensive patterns

Strategy: validation

Validate before calling

fn group_ok(group: &str, group_states: &std::collections::HashMap<String, bool>) -> Result<(), String> {
    match group_states.get(group) {
        Some(true) => Ok(()),
        Some(false) => Err(format!("group '{group}' is declared absent")),
        None => Err(format!("group '{group}' is not declared at all")),
    }
}

Prevention

Cross-check group removals against all resources using group: <name>
Name groups via shared constants to avoid drift between declarations
Run plan on a fixture as a pre-apply check
When decommissioning, tear down dependent resources in the same change

When it happens

Trigger: Calling plan (via add_account_dependencies) for a bootstrap resource with a group set, where group_states maps that group to AccountState::Absent — i.e. the same plan removes that group.

Common situations: A shared config section deletes a group (e.g. 'www-data' variants) that file/service resources still reference as their group; renaming groups in user management config without updating resource group fields; cleanup configs that remove groups still used by application resources.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/3f3d33ee506acedf. Report an issue: GitHub.