jdx/mise · error · eyre::Report

remote cache URL must use HTTPS

Error message

remote cache URL must use HTTPS

What it means

RemoteCacheClient::new validates the configured base_url scheme: https passes, plain http gets special handling, and any other scheme (ftp, file, ws, or a malformed URL) is rejected immediately. This is a pure configuration error raised before any network I/O happens.

Source

Thrown at crates/mise-cache-core/src/lib.rs:801

        || url.scheme() == "http"
            && url.host().is_some_and(|host| match host {
                Host::Domain(host) => host.eq_ignore_ascii_case("localhost"),
                Host::Ipv4(address) => address.is_loopback(),
                Host::Ipv6(address) => address.is_loopback(),
            })
    {
        Ok(())
    } else {
        bail!("GitHub Actions OIDC request URL must use HTTPS")
    }
}

fn validate_remote_url(base_url: &Url, authenticated: bool) -> Result<()> {
    if base_url.scheme() == "https" {
        return Ok(());
    }
    if base_url.scheme() != "http" {
        bail!("remote cache URL must use HTTPS");
    }
    let is_loopback = base_url.host().is_some_and(|host| match host {
        Host::Domain(host) => host.eq_ignore_ascii_case("localhost"),
        Host::Ipv4(address) => address.is_loopback(),
        Host::Ipv6(address) => address.is_loopback(),
    });
    if !is_loopback && authenticated {
        bail!("remote cache URL must use HTTPS except for loopback development servers");
    }
    if !is_loopback {
        warn!(
            "using an unauthenticated remote build cache over plain HTTP; cache traffic can be read \
             or modified in transit"
        );
    }
    Ok(())
}

View on GitHub (pinned to 9dcfcaa0dc)

Solutions

1. Set base_url to an https:// URL (or http:// for loopback dev servers)
2. Parse and scheme-check the URL at config-load time and fail with the offending value in the message
3. Log the fully constructed base_url in debug builds to catch templating mistakes

Example fix

// before
let config = RemoteCacheConfig {
    base_url: "ftp://cache.internal".parse()?,
    ..
};

// after
let config = RemoteCacheConfig {
    base_url: "https://cache.internal".parse()?,
    ..
};

fn parse_cache_base_url(raw: &str) -> eyre::Result<url::Url> {
    let url: url::Url = raw.parse()?;
    anyhow::ensure!(
        matches!(url.scheme(), "https" | "http"),
        "remote cache URL must use https (or http for loopback), got {}",
        url.scheme()
    );
    Ok(url)
}

When it happens

Trigger: Passing a RemoteCacheConfig.base_url such as "ftp://cache.internal", "file:///var/cache", one missing its scheme, or a typo like "htps://cache.internal"; config templating that drops or mangles the scheme.

Common situations: Templated configuration where the scheme variable is empty; passing a filesystem path where a URL is expected; environment-specific URL assembly bugs; secrets placeholders leaking into the URL field.

Related errors

• unsupported remote cache digest algorithm
• invalid remote cache digest
• invalid remote action manifest ETag
• remote cache URL must use HTTPS except for loopback developm
• remote bootstrap configuration is invalid for {} target(s):

AI-assisted analysis of jdx/mise@9dcfcaa0dc (2026-08-17). Data as JSON: /api/errors/66e3765bff213e50. Report an issue: GitHub.