jdx/mise · error

the release list at {url} is for {}, not {project}

Error message

the release list at {url} is for {}, not {project}

What it means

A packslip release list is bound to a specific project name in its predicate. After fetching and verifying the list from the configured URL, mise compares `list.predicate.project` with the requested project and bails if they differ — this guards against a misconfigured URL serving another project's list that would otherwise pass signature verification under the wrong pin.

Source

Thrown at src/backend/packslip.rs:631

    fn repo(project: &str) -> Option<String> {
        repository(project).map(|(_, owner, repo)| format!("{owner}/{repo}"))
    }

    async fn release_list(
        &self,
        project: &str,
        pin: &Pin,
        opts: &PackslipOptions<'_>,
    ) -> Result<ReleaseListStatement> {
        let pin = pin.for_release_list(opts)?;
        let url = well_known_url(project);
        let text = HTTP_FETCH.get_text(&url).await.wrap_err_with(|| {
            format!("fetching the release list of packslip:{project} from {url}")
        })?;
        let list = verify_release_list(&text, &pin, !opts.allow_unlogged())
            .wrap_err_with(|| format!("verifying the release list of packslip:{project}"))?;
        if list.predicate.project != project {
            bail!(
                "the release list at {url} is for {}, not {project}",
                list.predicate.project
            );
        }
        check_sequence(project, &list)?;
        Ok(list)
    }

    /// The signed list a github.com repository may keep at `.well-known`
    /// on its default branch, verified against its list signer (by default,
    /// the same identity as its packslips). `None` when the repository has
    /// none, which is the usual case: a vendor writes one only to withdraw
    /// a release, flag a security fix, or list a release whose tag names no version.
    async fn github_list(
        &self,
        project: &str,
        repo: &str,
        pin: &Pin,

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Correct the release-list URL in the packslip pin so it points at the list for the requested project
2. Fix the project name in your mise.toml to match the list's actual subject project
3. Ask the vendor to publish a list with the correct project name if they renamed the project

Example fix

// before
[tools."packslip:acme-cli"]
release_list_url = "https://example.com/acme-lib.releaselist.json"
// after
[tools."packslip:acme-cli"]
release_list_url = "https://example.com/acme-cli.releaselist.json"

const expected = `packslip:${project}`;
if (!releaseListUrl.includes(project)) {
  console.warn(`release list URL may not match project ${project}`);
}

When it happens

Trigger: Calling `release_list` (from `vendor_entry`, `recommendation`, or `vendor_versions`) when the fetched and verified list's `predicate.project` does not equal the requested packslip project name.

Common situations: A user points the release-list URL at another project's list (copy-paste error); a vendor reorganizes and the URL now hosts a renamed project's list; a typo in the project slug makes the requested name differ from the list's subject.

Related errors

• packslip:{tool_name} is not a project name; use github.com/o
• packslip: list_identity_prefix must be a non-empty string
• packslip: list_identity_prefix cannot be combined with pubke
• packslip: list_identity_prefix requires an issuer
• the release list in github.com/{repo} is for {}, not {projec

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/fec1f70a86dcea2e. Report an issue: GitHub.