jdx/mise · error

trust the configuration before using its encryption…

Error message

trust the configuration before using its encryption recipients: {}

What it means

file_recipients collects encryption recipients from history config layers. Before using a layer's [history.encryption].recipients, it requires the config file to be trusted (mise trust). Untrusted config files are treated as untrusted input, so their recipient list is refused to prevent an attacker-controlled config from silently redirecting encrypted data.

Solutions

1. Run `mise trust <path-to-config>` for the config file named in the error, then retry
2. Check `mise trust list` / trust status to confirm which files are untrusted
3. In CI, provision trust non-interactively (trust the checked-out config path as a setup step) before commands that use encryption

Example fix

# before
$ mise run build
# trust the configuration before using its encryption recipients: /repo/mise.toml

# after
$ mise trust /repo/mise.toml
$ mise run build

mise trust list 2>/dev/null | grep -q "$(pwd)/mise.toml" || mise trust "$(pwd)/mise.toml"

When it happens

Trigger: Any operation that resolves encryption recipients (e.g. encrypted history capture) while a config file defining history.encryption.recipients has not been marked trusted via `mise trust`.

Common situations: Cloning a repo with a mise.toml containing encryption recipients and running a history command before trusting it; mise prompting for trust after a config file changed; fresh CI checkouts where trust was never granted.

Related errors

• cannot publish: encrypted path
• cannot publish: encrypted path
• --changed requires trusted configuration
• cli feature is not enabled
• dotfiles: cannot enroll encrypted paths while history is…

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/6f9ffb066b5e1ee7. Report an issue: GitHub.

Appendix: source

Thrown at src/system/history/config.rs:45

    pub origin: Option<OriginTomlConfig>,
    #[serde(default)]
    pub encryption: Option<FileEncryptionConfig>,
}

/// Public recipients shared by every encrypted dotfile.
#[derive(Debug, Clone, Deserialize, Default)]
#[serde(deny_unknown_fields)]
pub(crate) struct FileEncryptionConfig {
    #[serde(default)]
    pub recipients: Vec<String>,
}

pub(crate) fn file_recipients() -> Result<Vec<String>> {
    let mut recipients = Vec::new();
    for (path, layer) in layers()? {
        if let Some(encryption) = layer.encryption {
            if !crate::config::config_file::is_trusted(&path) {
                eyre::bail!(
                    "trust the configuration before using its encryption recipients: {}",
                    display_path(&path)
                );
            }
            recipients = encryption.recipients;
            if recipients.is_empty() {
                eyre::bail!(
                    "[history.encryption].recipients must not be empty; configure recipients before capturing encrypted files"
                );
            }
        }
    }
    Ok(recipients)
}

/// `[history.origin]`.
#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
#[serde(deny_unknown_fields)]

View on GitHub (pinned to 533346cc37)