jdx/mise · error · eyre::Report

bootstrap secret '{name}' has invalid environment variable n

Error message

bootstrap secret '{name}' has invalid environment variable name '{env}'

What it means

The environment variable a secret maps to (the string form of the declaration or options.env) must satisfy valid_env_name: the first character is a letter or '_', and every following character is a letter, digit or '_'. Dashes, spaces and leading digits are rejected at config parse time, matching shell identifier rules.

Source

Thrown at src/system/secrets.rs:308

    Ok(value)
}

fn declaration_from_toml(name: String, declaration: SecretTomlConfig) -> Result<SecretDeclaration> {
    if name.is_empty()
        || !name
            .chars()
            .all(|character| character.is_ascii_alphanumeric() || "_.-".contains(character))
    {
        bail!("invalid bootstrap secret name '{name}': use ASCII letters, digits, '.', '_' or '-'");
    }
    let (env, description, allow_empty) = match declaration {
        SecretTomlConfig::Env(env) => (env, None, false),
        SecretTomlConfig::Options(options) => {
            (options.env, options.description, options.allow_empty)
        }
    };
    if !valid_env_name(&env) {
        bail!("bootstrap secret '{name}' has invalid environment variable name '{env}'");
    }
    Ok(SecretDeclaration {
        name,
        env,
        description,
        allow_empty,
    })
}

fn valid_env_name(name: &str) -> bool {
    let mut characters = name.chars();
    characters
        .next()
        .is_some_and(|first| first == '_' || first.is_ascii_alphabetic())
        && characters.all(|character| character == '_' || character.is_ascii_alphanumeric())
}

fn env_state(declaration: &SecretDeclaration) -> SecretState {

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Rename the variable to shell-identifier form: uppercase with underscores, e.g. CACHE_TOKEN
2. If a tool genuinely needs a dashed variable name, have a task or wrapper script export it from the underscore-named secret value

Example fix

# before
[bootstrap.secrets]
token = "CACHE-TOKEN"
# after
[bootstrap.secrets]
token = "CACHE_TOKEN"

// Validate env var names before running bootstrap
fn valid_env_name(name: &str) -> bool {
    let mut chars = name.chars();
    chars.next().is_some_and(|c| c == '_' || c.is_ascii_alphabetic())
        && chars.all(|c| c == '_' || c.is_ascii_alphanumeric())
}
assert!(declarations.iter().all(|d| valid_env_name(&d.env)));

fn is_valid_env_name(name: &str) -> bool {
    let mut chars = name.chars();
    chars.next().is_some_and(|c| c == '_' || c.is_ascii_alphabetic())
        && chars.all(|c| c == '_' || c.is_ascii_alphanumeric())
}

When it happens

Trigger: env values like "CACHE-TOKEN", "7ZIP_HOME" or "CACHE TOKEN" in a [bootstrap.secrets] declaration.

Common situations: Copying env var names that contain dashes from other ecosystems; machine-generated names; typos inserting spaces.

Related errors

• invalid bootstrap secret name '{name}': use ASCII letters, d
• --connect-timeout must be greater than zero
• remote bootstrap configuration is invalid for {} target(s):
• bootstrap compose project names cannot be empty
• bootstrap compose project '{name}' wait_timeout requires wai

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/0d8948189b94411b. Report an issue: GitHub.