jdx/mise · error

packslip: list_identity_prefix requires an issuer

Error message

packslip: list_identity_prefix requires an issuer

What it means

When applying the `list_identity_prefix` override, the identity policy must carry an issuer, because a prefix is only meaningful relative to a trusted certificate issuer. If the policy has no issuer (or an empty one), mise cannot scope the prefix and bails with this error instead of performing unverifiable trust narrowing.

Source

Thrown at src/backend/packslip.rs:468

        ),
    }
}

impl Pin {
    /// A vendor may publish its index from a different workflow than its bundles.
    /// The override replaces only the list's subject constraint, retaining the issuer.
    fn for_release_list(&self, opts: &PackslipOptions<'_>) -> Result<Self> {
        let Some(value) = opts.raw.opts.get("list_identity_prefix") else {
            return Ok(self.clone());
        };
        let Some(prefix) = value.as_str().filter(|prefix| !prefix.trim().is_empty()) else {
            bail!("packslip: list_identity_prefix must be a non-empty string");
        };
        let Self::Identity(policy) = self else {
            bail!("packslip: list_identity_prefix cannot be combined with pubkey");
        };
        if policy.issuer.as_deref().is_none_or(str::is_empty) {
            bail!("packslip: list_identity_prefix requires an issuer");
        }
        Ok(Self::Identity(Policy {
            issuer: policy.issuer.clone(),
            identity: None,
            identity_prefix: Some(prefix.to_string()),
        }))
    }

    fn trust(&self) -> Trust<'_> {
        match self {
            Pin::Identity(policy) => Trust::Identity(policy),
            Pin::Key(key) => Trust::Key(key),
        }
    }
}

/// Verify a bundle and, for each artifact path given, its digest and size.
/// Blocks: packslip drives sigstore on a runtime of its own.

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Add the required `issuer` to the identity policy alongside `list_identity_prefix`
2. Verify the issuer value isn't being rendered as an empty string by templating
3. Drop `list_identity_prefix` if you intend to trust the whole identity policy without prefix narrowing

Example fix

// before
[tools."packslip:acme"]
list_identity_prefix = "acme"
// after
[tools."packslip:acme"]
issuer = "https://fulcio.example.com"
list_identity_prefix = "acme"

if cfg.list_identity_prefix != null && (cfg.issuer == null || cfg.issuer == "") {
    throw new Error("list_identity_prefix requires an issuer");
}

fn has_issuer(policy: &Policy) -> bool {
    matches!(policy, Policy::Identity { issuer: Some(i), .. } if !i.is_empty())
}

When it happens

Trigger: Calling `release_list`/`github_list` where the policy is `Policy::Identity` but `policy.issuer` is `None` or an empty string, and the options set `list_identity_prefix`.

Common situations: A config specifies an identity prefix without the `issuer` field (e.g. the vendor's docs only give the prefix and the user omits the issuer); an issuer set via a template/env var resolves to empty.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• packslip: list_identity_prefix must be a non-empty string
• managed path '{}' notifies unconfigured bootstrap service '{
• managed path '{}' notifies unconfigured bootstrap service '{
• cask uses `#{feature}`, which mise's cask shim does not supp
• formula uses `#{feature}`, which mise's source-build shim do

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/49d0f21f3286f9e7. Report an issue: GitHub.