bootstrap user '{name}' comment must not contain ':', CR, or

Error message

bootstrap user '{name}' comment must not contain ':', CR, or LF

What it means

UserRequest::from_toml validates the GECOS comment field: it must not contain ':', CR (\r), or LF (\n). The comment is written to the colon-delimited /etc/passwd GECOS field, where ':' would shift subsequent fields and newlines would corrupt the passwd database; parsing fails with the user's name instead of producing a broken account file.

Source

Thrown at src/system/accounts.rs:372

        }
        if config.move_home && config.home.is_none() {
            bail!("bootstrap user '{name}' sets move_home without home");
        }
        if let Some(group) = &config.group {
            validate_name("group", group)?;
        }
        if let Some(path) = &config.home {
            validate_account_path(&name, "home", path)?;
        }
        if let Some(path) = &config.shell {
            validate_account_path(&name, "shell", path)?;
        }
        if config
            .comment
            .as_ref()
            .is_some_and(|comment| comment.contains([':', '\n', '\r']))
        {
            bail!("bootstrap user '{name}' comment must not contain ':', CR, or LF");
        }
        let mut groups = config
            .groups
            .map(|groups| {
                groups
                    .into_iter()
                    .map(|group| {
                        validate_name("group", &group)?;
                        Ok(group)
                    })
                    .collect::<Result<BTreeSet<_>>>()
            })
            .transpose()?;
        if let (Some(groups), Some(primary_group)) = (&mut groups, &config.group) {
            groups.remove(primary_group);
        }
        let inspection = inspect_user(&name, config.uid)?;
        Ok(Self {

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

Replace ':' with '-' or ';' in the comment (e.g. "CI user - build agents").
Strip CR/LF: keep the comment a single line.
If you need structured contact data, encode it without delimiters (e.g. 'build (x1234)') following GECOS conventions.

Example fix

# before
[bootstrap.users.ci]
state = "present"
group = "ci"
comment = "CI user: build agents"
# after
[bootstrap.users.ci]
state = "present"
group = "ci"
comment = "CI user - build agents"

Defensive patterns

Strategy: type-guard

Validate before calling

python3 - <<'EOF'
import sys, tomllib
cfg = tomllib.load(open('mise.toml','rb'))
for name, u in cfg.get('bootstrap', {}).get('users', {}).items():
    c = u.get('comment')
    if c and any(ch in c for ch in ':\r\n'):
        sys.exit(f"user '{name}' comment contains ':', CR, or LF")
EOF

Type guard

def valid_gecos_comment(c: str) -> bool:
    return not any(ch in c for ch in ':\r\n')

Prevention

Use '-' or ';' instead of ':' in account comments.
Keep comments to a single line; strip newlines in any config generator.
Remember the comment lands in the colon-delimited /etc/passwd GECOS field.

When it happens

Trigger: A [bootstrap.users.<name>] entry whose comment = "..." value contains a colon (e.g. comment = "CI user: build agents") or an embedded newline from a multi-line TOML string, loaded during bootstrap parsing.

Common situations: Free-text descriptions with colons; comments copied from /etc/passwd-style strings that already include fields like 'Work Phone:'; multi-line TOML literals in generated configs.

Understand the failure class

Background: Config validation failed: what "invalid value for {key}" and settings-rejection errors mean across 19 open-source libraries — this error's family across 19 libraries.

Related errors

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/e300c62f71aeaa9b. Report an issue: GitHub.