What causes "the stamp list at {url} is for {}, not {project}" in jdx/mise?

Point the stamper URL at the correct project's stamp list

the stamp list at {url} is for {}, not {project}

Error message

the stamp list at {url} is for {}, not {project}

What it means

After verifying a stamp list's signature, mise checks that the list's embedded project identifier matches the project actually being resolved. A list signed for a different project is rejected to prevent cross-project stamp substitution.

Source

Thrown at src/packslip_stamps.rs:302

    for stamper in &stampers {
        let url = stamper.url(project);
        let text = match HTTP_FETCH.get_text(&url).await {
            Ok(text) => text,
            Err(err) if is_not_found(&err) => {
                missing_list(&stamper.host, project, &url)?;
                debug!("{}: no stamp list for {project} at {url}", stamper.host);
                stamps.hosts.push(stamper.host.clone());
                continue;
            }
            Err(err) => {
                return Err(err)
                    .wrap_err_with(|| format!("fetching the stamp list for {project} from {url}"));
            }
        };
        let list = verify_release_list(&text, &stamper.pin, true)
            .wrap_err_with(|| format!("verifying the stamp list from {}", stamper.host))?;
        if list.predicate.project != project {
            bail!(
                "the stamp list at {url} is for {}, not {project}",
                list.predicate.project
            );
        }
        check_sequence(&stamper.host, project, &list)?;
        stamps.add(&stamper.host, &list);
    }
    Ok(Some(stamps))
}

fn is_not_found(err: &eyre::Report) -> bool {
    crate::http::error_code(err) == Some(404)
}

#[cfg(test)]
mod tests {
    use super::*;
    use packslip::model::{

View on GitHub (pinned to afd2eddd3a)

Solutions

Point the stamper URL at the correct project's stamp list
Fix the stamper host's URL template so {project} resolves correctly
Verify the host publishes a dedicated list per project

Example fix

// before: URL template missing project substitution
url = "https://stamps.example.com/lists/latest"
// after
url = "https://stamps.example.com/lists/{project}/latest"

Defensive patterns

Strategy: validation

Validate before calling

let list = fetch_stamp_list_raw(stamper, project)?;
if list.predicate.project != project {
    return Err(format!("stamper URL serves list for {}, wanted {project}", list.predicate.project));
}

Try / catch

match result {
    Err(e) if e.to_string().contains("is for") && e.to_string().contains("not") => fix_stamper_url_template(stamper)?,
    other => other?,
}

Prevention

Ensure stamper URL templates substitute the project correctly
Verify host serves one list file per project
Test new stamper hosts with a known project before rollout
Don't share a single list URL across multiple projects

When it happens

Trigger: fetch (via get_or_try_init_async / refresh_async) retrieves and verifies a stamp list from a stamper whose list.predicate.project differs from the requested project parameter.

Common situations: Misconfigured stamper host serving a shared or wrong list file; URL points at another project's list; host template expanded incorrectly so the list for project A is fetched when project B was requested.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/d8c1a58cc4422c94. Report an issue: GitHub.