the packslip names an executable {:?}, which is not a plain

Error message

the packslip names an executable {:?}, which is not a plain file name

What it means

When linking installed binaries into the bins directory, mise validates that each executable name declared in the packslip manifest is a plain file name (no path separators, no `..`, etc.). A name like `sub/dir/tool` or `../tool` is rejected because it would create links outside the bins directory. This is a path-traversal safety check on vendor-supplied manifests.

Source

Thrown at src/backend/packslip.rs:929

                "packslip:{project}: {} of {before} version(s) carry a stamp",
                versions.len()
            );
        }
        Ok(versions)
    }

    /// Put every executable the packslip names into the install's bin dir
    /// under the name it should have on PATH.
    fn link_bins(tv: &ToolVersion, artifact: &Artifact) -> Result<()> {
        if artifact.bin.is_empty() {
            return Ok(());
        }
        let install_path = tv.install_path();
        let bins_dir = install_path.join(MISE_BINS_DIR);
        file::create_dir_all(&bins_dir)?;
        for bin in &artifact.bin {
            if !file::is_plain_file_name(&bin.name) {
                bail!(
                    "the packslip names an executable {:?}, which is not a plain file name",
                    bin.name
                );
            }
            let Some(src) = locate_in_install(&install_path, &bin.path) else {
                bail!(
                    "the packslip lists executable {} in {}, but the archive holds no such file",
                    bin.path,
                    artifact.name
                );
            };
            file::make_executable(&src)?;
            let dst = bins_dir.join(&bin.name);
            if dst.exists() || dst.is_symlink() {
                file::remove_all(&dst)?;
            }
            file::make_symlink_or_copy(&src, &dst)?;
        }

View on GitHub (pinned to afd2eddd3a)

Solutions

Fix the packslip manifest so each bin `name` is a bare file name (e.g. `mytool`, not `bin/mytool` or `../mytool`)
Report the manifest to the vendor/packslip author if it's an upstream release
Verify the manifest you trusted hasn't been swapped — check the signature/digests

Example fix

// before (packslip manifest)
[[bin]]
name = "subdir/mytool"
// after
[[bin]]
name = "mytool"

Defensive patterns

Strategy: validation

Validate before calling

fn is_plain_bin_name(name: &str) -> bool {
    !name.is_empty()
        && !name.contains('/')
        && !name.contains('\\')
        && name != "."
        && name != ".."
}

Prevention

When authoring packslips, always use bare file names for bin entries
Review vendor manifests for path-like bin names before adopting them
Treat any bin name with separators as a red flag for tampering

When it happens

Trigger: link_bins during install of a packslip: tool when `artifact.bin[i].name` contains path components, absolute paths, or traversal segments and fails file::is_plain_file_name.

Common situations: A hand-written or malicious packslip manifest declares a bin name with a slash or `..`; a vendor ships a malformed manifest after renaming binaries; typo in a locally-authored packslip.

Understand the failure class

Background: Path traversal blocked: "path escapes the workspace" and "outside site root" errors when a path will not stay inside its allowed directory — this error's family across 26 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/3969102b4aa3eff0. Report an issue: GitHub.