missing {} in Flow env store. Set it with `f release signing

Error message

missing {} in Flow env store. Set it with `f release signing store ...` (or `f env set {}`) first.

What it means

During `f release signing sync`, the tool verifies that every key in SIGNING_KEYS exists in the Flow env store before pushing them to GitHub secrets. If any required signing variable is missing from the store, sync aborts with this message naming the key.

Source

Thrown at src/release_signing.rs:199

            } else {
                println!("  - {} (missing in env store)", key);
            }
        }
        if let Some(repo) = opts.repo.as_deref() {
            println!("Repo: {}", repo);
        } else {
            println!("Repo: (from current directory)");
        }
        if SIGNING_KEYS.iter().any(|k| !vars.contains_key(*k)) {
            println!();
            println!("Next: set missing keys with `f release signing store ...`.");
        }
        return Ok(());
    }

    for key in SIGNING_KEYS {
        if !vars.contains_key(key) {
            bail!(
                "missing {} in Flow env store. Set it with `f release signing store ...` (or `f env set {}`) first.",
                key,
                key
            );
        }
    }

    ensure_gh_available()?;
    for key in SIGNING_KEYS {
        let value = vars.get(key).expect("checked above");
        gh_secret_set(opts.repo.as_deref(), key, value)?;
        println!("✓ Set GitHub secret: {}", key);
    }

    Ok(())
}

fn ensure_gh_available() -> Result<()> {

View on GitHub (pinned to a747e741ae)

Solutions

Run `f release signing store ...` to import the .p12 and populate the keys
Set the missing key manually: `f env set <key> <value>`, then re-run sync
List current env vars (`f env list` or similar) to see which key is missing

Example fix

// before
f release signing sync  // fails: missing MACOS_CERTIFICATE_PASSWORD
// after
f release signing store --p12 cert.p12 --password ...
f release signing sync

Defensive patterns

Strategy: validation

Validate before calling

const REQUIRED = [/* SIGNING_KEYS, e.g. MACOS_CERTIFICATE, MACOS_CERTIFICATE_PASSWORD */];
const missing = REQUIRED.filter((k) => !hasEnvKey(k));
if (missing.length) throw new Error(`missing signing keys: ${missing.join(", ")}`);

Try / catch

try {
  run(["f", "release", "signing", "sync"]);
} catch (e) {
  const m = String(e).match(/missing (\S+) in Flow env store/);
  if (m) console.error(`Run: f env set ${m[1]} <value> then retry.`);
  else throw e;
}

Prevention

Run the one-time `f release signing store` import before any sync
Keep a checklist of required signing keys for your release pipeline
Verify all SIGNING_KEYS exist with `f env list` as a preflight step

When it happens

Trigger: Running `f release signing sync` when one or more of the SIGNING_KEYS variables (e.g. certificate password, p12 data) were never stored via `f release signing store` or `f env set`.

Common situations: Fresh machine after switching laptops; team member running sync before doing the one-time `store` import; key deleted from the env store.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/570b7c3c49daaf0b. Report an issue: GitHub.