feat(vfox): add provenance metadata to lockfile for tool plugins by malept · Pull Request #8544 · jdx/mise

malept · 2026-03-10T05:00:39Z

Summary

Wire PreInstallAttestation (returned by vfox tool plugin PreInstall hooks) through to PlatformInfo.provenance in mise.lock, covering both mise install and mise lock
Brings vfox tool plugins to parity with aqua and github backends for supply-chain provenance tracking and downgrade-attack detection
Does not apply to vfox backend plugins (they use backend_install, which has no PreInstall hook)

Details

VerifiedAttestation enum in vfox crate: GithubAttestations, Slsa, Cosign — represents the highest-priority attestation that was successfully verified (GitHub > SLSA > Cosign)
verify() return type changed from Result<()> to Result<Option<VerifiedAttestation>>; threaded through InstallResult so callers can inspect what was verified
Provenance recording + enforcement in install_version_(): records ProvenanceType in lockfile after install, and raises a "downgrade attack" error on subsequent installs if the lockfile expected provenance that wasn't verified
resolve_lock_info() override: calls new pre_install_provenance_for_platform() to populate provenance in the lockfile during mise lock. This trusts the plugin's declared attestation fields (e.g. github_owner/github_repo, slsa_provenance_path) to infer provenance type without running actual sigstore/cosign verification — consistent with how mise lock works for other backends (query plugin metadata, don't verify signatures). Actual verification only runs during mise install
SLSA URL handling: uses url: None for vfox SLSA provenance (matching github/aqua backends) since the local filesystem path to the downloaded provenance file is ephemeral
Crate boundary: VerifiedAttestation (attestation verification mechanics) lives in the vfox crate, while ProvenanceType (lockfile schema) lives in mise core. The verified_attestation_to_provenance() bridge in src/backend/vfox.rs maps between the two, keeping the vfox crate independent of mise's lockfile format
Docs: updated vfox.md security bullet and mise-lock.md backend support matrix to note provenance support for aqua, github, vfox (tool plugins only), core:ruby (precompiled), core:zig (install-time)

Test plan

6 unit tests for PreInstallAttestation validation (GitHub owner/repo, cosign key/sig, SLSA min-level/provenance-path)
Snapshot test for attestation plugin fixture
Unit test for verified_attestation_to_provenance() conversion
E2E test: mise lock writes URL for vfox tool, injected provenance triggers downgrade-attack error on mise install
All existing tests pass (cargo test, vfox crate tests, lints)

🤖 Generated with the assistance of OpenCode (claude-sonnet-4.6).

Add VerifiedAttestation enum to represent the type of attestation that was successfully verified (GithubAttestations, Slsa, Cosign). Re-export VerifiedAttestation and InstallResult from vfox crate lib so they are accessible to the main mise backend code. Add test-attestation plugin fixture and snapshot test, plus 5 unit tests for PreInstallAttestation validation helpers. Assisted-By: claude-sonnet-4.6 via OpenCode

…gh InstallResult Change verify() to return Result<Option<VerifiedAttestation>> instead of Result<()>, tracking the highest-priority attestation that was successfully verified (GitHub > SLSA > Cosign). Add verified_attestation field to InstallResult so callers can inspect what was verified. Assisted-By: claude-sonnet-4.6 via OpenCode

After a vfox plugin install, convert the VerifiedAttestation returned by verify() into a ProvenanceType and record it in the tool version's lock_platforms entry. Before install, capture the expected provenance from the lockfile and enforce it afterwards using discriminant comparison, raising a downgrade-attack error if the verification result does not match what was previously locked. Assisted-By: claude-sonnet-4.6 via OpenCode

Add pre_install_provenance_for_platform() to the Vfox crate, which extracts the highest-priority attestation type declared by a plugin for a target platform without performing actual verification. Override resolve_lock_info() in VfoxBackend to call this method and include the provenance type in the PlatformInfo written to the lockfile during `mise lock`. Assisted-By: claude-sonnet-4.6 via OpenCode

Update the vfox backend docs to mention GitHub artifact attestation support and provenance recording in the lockfile, noting that this applies to tool plugins only (not backend plugins). Add vfox to the full-support tier in mise-lock.md and note all backends with provenance support (aqua, github, vfox tool plugins, core:ruby, core:zig). Add a sync comment on ProvenanceType pointing to VerifiedAttestation in the vfox crate. Assisted-By: claude-sonnet-4.6 via OpenCode

…ement Add an e2e test that verifies: 1. `mise lock` writes a URL for a vfox tool (vfox:version-fox/vfox-cmake) 2. Injecting provenance into the lockfile and attempting install fails with a downgrade attack error when the plugin does not perform attestation verification The test uses the awk-injection pattern from the aqua provenance test, avoiding any real sigstore verification. Assisted-By: claude-sonnet-4.6 via OpenCode

SLSA provenance_path from vfox plugins is a local filesystem path that is only valid during the install session. Using format!("file://{}", path) produced malformed URIs for relative/Windows paths and stored ephemeral data in the lockfile. Change to url: None to match how the github and aqua backends handle SLSA provenance at lock-time. Also simplify the e2e test AWK script by removing the broken section tracking logic (in_section was set and immediately reset on the same line due to rule ordering). Since we always generate a fresh lockfile before injection, there are no pre-existing provenance lines to remove. Assisted-By: claude-sonnet-4.6 via OpenCode

gemini-code-assist · 2026-03-10T05:01:03Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the supply-chain security of mise by integrating provenance metadata into the lockfile for vfox tool plugins. It enables mise to record and enforce attestation verification during installation, protecting users against potential downgrade attacks. This change brings vfox tool plugins in line with other secure backends, ensuring a more robust and trustworthy dependency management experience.

Highlights

Provenance Metadata for vfox Tool Plugins: Integrated PreInstallAttestation data from vfox tool plugin PreInstall hooks into PlatformInfo.provenance within mise.lock, covering both mise install and mise lock operations.
Supply-Chain Provenance Parity: Achieved parity with aqua and github backends for supply-chain provenance tracking and downgrade-attack detection for vfox tool plugins.
New VerifiedAttestation Enum: Introduced a VerifiedAttestation enum in the vfox crate to represent the highest-priority attestation successfully verified (GitHub > SLSA > Cosign).
Provenance Recording and Enforcement: Implemented provenance recording in the lockfile after installation and added enforcement to detect and prevent 'downgrade attacks' if expected provenance is not verified on subsequent installs.
Lockfile Resolution for Provenance: Overrode resolve_lock_info() to populate provenance in the lockfile during mise lock by inferring attestation types from plugin-declared fields without actual sigstore verification, consistent with other backends.
Documentation Updates: Updated vfox.md and mise-lock.md documentation to reflect the new provenance support for aqua, github, vfox (tool plugins only), core:ruby, and core:zig.

Changelog

crates/vfox/plugins/attestation/hooks/pre_install.lua
- Added a new Lua plugin hook for testing GitHub artifact attestation metadata.
crates/vfox/plugins/attestation/metadata.lua
- Added metadata for the new 'attestation' test plugin.
crates/vfox/src/hooks/pre_install.rs
- Added the VerifiedAttestation enum to represent different types of verified attestations.
- Updated PreInstall tests to include new attestation validation scenarios.
crates/vfox/src/hooks/snapshots/vfox__hooks__pre_install__tests__attestation_plugin.snap
- Added a snapshot test for the attestation plugin's PreInstall hook output.
crates/vfox/src/lib.rs
- Exported VerifiedAttestation and InstallResult from the vfox crate.
crates/vfox/src/vfox.rs
- Modified InstallResult to include an optional verified_attestation field.
- Updated the install method to capture and return VerifiedAttestation.
- Introduced pre_install_provenance_for_platform to retrieve attestation information without full verification.
- Changed the verify method's return type to Result<Option<VerifiedAttestation>> to indicate successful verification.
docs/dev-tools/backends/vfox.md
- Updated the security section to detail attestation verification support for vfox tool plugins, including GitHub artifact attestations, cosign, and SLSA provenance.
docs/dev-tools/mise-lock.md
- Updated the lockfile backend support matrix to include vfox tool plugins for full support and provenance support.
e2e/lockfile/test_lockfile_vfox_provenance_slow
- Added an end-to-end test to verify that mise lock writes URLs for vfox tools and that injected provenance triggers downgrade attack detection during mise install.
src/backend/vfox.rs
- Imported eyre and ProvenanceType for error handling and lockfile integration.
- Modified the install_version_ method to handle lockfile provenance expectations and record verified attestations.
- Implemented resolve_lock_info for the VfoxBackend to populate lockfile provenance based on pre_install_provenance_for_platform.
- Added verified_attestation_to_provenance function to convert vfox attestations to lockfile provenance types.
src/lockfile.rs
- Added a comment to ProvenanceType enum, linking it to VerifiedAttestation in the vfox crate for synchronization.

Activity

The pull request author, malept, provided a comprehensive summary and detailed explanation of the changes, including the motivation, implementation details, and a thorough test plan.
The author utilized OpenCode (claude-sonnet-4.6) to assist in generating the pull request, indicating a modern development workflow.
A detailed test plan was outlined, covering unit tests for PreInstallAttestation validation, a snapshot test, a conversion unit test, and an E2E test for lockfile provenance and downgrade attack detection, ensuring robust coverage.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces comprehensive support for attestation verification in vfox tool plugins, allowing mise to verify GitHub artifact attestations, SLSA provenance, and Cosign signatures. The changes include adding a new VerifiedAttestation enum to represent different verification types, updating the InstallResult to store the verified attestation, and modifying the verify function to return the highest-priority successful attestation. A new pre_install_provenance_for_platform function was added to retrieve attestation information without full installation. The vfox backend now integrates with mise's lockfile system to record and enforce provenance, preventing downgrade attacks by comparing expected lockfile provenance with actual verification results. New Lua plugin files and Rust tests were added to demonstrate and validate the attestation functionality, alongside updates to documentation reflecting the enhanced security features.

greptile-apps · 2026-03-10T05:05:29Z

Greptile Summary

This PR wires PreInstallAttestation (returned by vfox tool plugin PreInstall hooks) through to PlatformInfo.provenance in mise.lock, bringing vfox tool plugins to parity with aqua and github backends for supply-chain provenance tracking and downgrade-attack detection.

Key changes:

VerifiedAttestation enum added to the vfox crate (GithubAttestations, Slsa, Cosign), representing the highest-priority attestation successfully verified. Exported via crates/vfox/src/lib.rs.
verify() return type changed from Result<()> to Result<Option<VerifiedAttestation>> and threaded through InstallResult, enabling callers to inspect what was verified.
Provenance recording + enforcement in install_version_(): records ProvenanceType in the in-memory tv.lock_platforms after install, and raises a downgrade-attack error if the lockfile expected provenance that the current install did not produce. Consistent with the existing aqua/ruby pattern.
resolve_lock_info() override added to VfoxBackend: calls pre_install_provenance_for_platform() to populate url and provenance in the lockfile during mise lock without running actual sigstore/cosign verification — matching how other backends handle mise lock.
to_vfox_platform() helper extracted from the duplicated OS/arch mapping in get_tarball_url and resolve_lock_info.
Backend-plugin guard correctly added to resolve_lock_info() (backend plugins use backend_install and have no PreInstall hook).
Documentation corrected to "Partial support (version + URL + provenance)" for vfox after earlier review feedback — accurate since checksum and size are not populated by mise lock.
Tests: 7 unit tests for PreInstallAttestation validation, a snapshot test for the new attestation plugin fixture, a unit test for verified_attestation_to_provenance(), and a slow E2E test covering both mise lock URL output and downgrade-attack detection.

Confidence Score: 4/5

This PR is safe to merge — the core provenance recording and downgrade-detection logic is correct, well-tested, and consistent with existing aqua/ruby patterns. The one known limitation (downgrade check fires after download, leaving the tool on disk on error) is pre-existing behavior shared across backends.
Score reflects a well-structured feature addition with comprehensive unit tests, a snapshot test, and an E2E test. All previously raised issues were addressed or explicitly acknowledged with documented limitations. The only remaining items are a style note about a defensive comment on the take() pattern and a minor E2E test comment suggestion — neither is a correctness issue. The e2e test has two acknowledged inherent limitations (network dependency, awk fragility with multi-tool lockfiles) that are low risk for the current single-tool fixture.
No files require special attention — the highest-risk logic (install_version_ downgrade check, resolve_lock_info backend-plugin guard, priority recording in verify) has all been reviewed and is correct.

Important Files Changed

Filename	Overview
src/backend/vfox.rs	Core change: adds provenance recording in `install_version_()` and a new `resolve_lock_info()` override for `mise lock`. The backend-plugin guard, `to_vfox_platform` helper extraction, and downgrade-check logic are all present. The `locked_provenance.take()` pattern (same as aqua/ruby) and the discriminant comparison are intentional design choices consistent with the rest of the codebase.
crates/vfox/src/vfox.rs	Adds `pre_install_provenance_for_platform()` for lock-time provenance inference, changes `verify()` to return `Result<Option<VerifiedAttestation>>`, and adds `attestation_to_verified()` private helper. Priority recording logic (GitHub > SLSA > Cosign) is correct; all-verifications-run-unconditionally behavior is acknowledged as pre-existing and cross-backend.
crates/vfox/src/hooks/pre_install.rs	Adds `VerifiedAttestation` enum and 7 new unit tests (symmetric GitHub owner/repo validation, cosign, SLSA). Doc comment clarifies intentional absence of `Minisign`. All validation paths are exercised.
e2e/lockfile/test_lockfile_vfox_provenance_slow	E2E test validates URL in lockfile and provenance downgrade detection. Two known limitations are documented in comments: the awk injection is fragile with multi-tool lockfiles, and the downgrade check fires after network download, making the test inherently network-dependent.
src/lockfile.rs	Minor doc addition only: cross-reference comment linking `ProvenanceType` to `VerifiedAttestation` in the vfox crate. No behavioral change.

Sequence Diagram

sequenceDiagram
    participant User
    participant MiseCore as mise core
    participant VfoxBackend as VfoxBackend
    participant VfoxCrate as vfox crate
    participant Plugin as Lua Plugin

    Note over User,Plugin: mise install (install_version_)
    User->>MiseCore: mise install
    MiseCore->>VfoxBackend: install_version_(ctx, tv)
    VfoxBackend->>VfoxBackend: extract locked_provenance from tv (take)
    VfoxBackend->>VfoxCrate: install(sdk, version, path)
    VfoxCrate->>Plugin: PreInstall(ctx)
    Plugin-->>VfoxCrate: PreInstall { url, attestation }
    VfoxCrate->>VfoxCrate: download(url)
    VfoxCrate->>VfoxCrate: verify(pre_install, file) → Option<VerifiedAttestation>
    VfoxCrate->>VfoxCrate: extract(file, install_dir)
    VfoxCrate-->>VfoxBackend: InstallResult { sha256, verified_attestation }
    VfoxBackend->>VfoxBackend: verified_attestation_to_provenance()
    VfoxBackend->>VfoxBackend: write provenance to tv.lock_platforms
    VfoxBackend->>VfoxBackend: compare got vs locked_provenance (discriminant check)
    alt Provenance mismatch
        VfoxBackend-->>MiseCore: Err("downgrade attack")
    else Match or no expectation
        VfoxBackend-->>MiseCore: Ok(tv with provenance)
    end

    Note over User,Plugin: mise lock (resolve_lock_info)
    User->>MiseCore: mise lock
    MiseCore->>VfoxBackend: resolve_lock_info(tv, target)
    VfoxBackend->>VfoxCrate: pre_install_provenance_for_platform(sdk, version, os, arch)
    VfoxCrate->>Plugin: PreInstallForPlatform(ctx)
    Plugin-->>VfoxCrate: PreInstall { url, attestation }
    VfoxCrate->>VfoxCrate: attestation_to_verified(attestation)
    VfoxCrate-->>VfoxBackend: (url, Option<VerifiedAttestation>)
    VfoxBackend->>VfoxBackend: verified_attestation_to_provenance()
    VfoxBackend-->>MiseCore: PlatformInfo { url, provenance }
    MiseCore-->>User: writes mise.lock

_{Last reviewed commit: 28a5456}

src/backend/vfox.rs

crates/vfox/src/hooks/pre_install.rs

src/backend/vfox.rs

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Backend plugins use backend_install and have no PreInstall hook. Calling pre_install_provenance_for_platform on one would fail with a Lua error. Add an early return with PlatformInfo::default(), matching the is_backend_plugin() guard already present in install_version_(). Note: get_tarball_url has the same pre-existing issue but is not addressed here to keep this PR scoped. Assisted-By: claude-sonnet-4.6 via OpenCode

src/backend/vfox.rs

crates/vfox/src/vfox.rs

e2e/lockfile/test_lockfile_vfox_provenance_slow

src/backend/vfox.rs

crates/vfox/src/vfox.rs

e2e/lockfile/test_lockfile_vfox_provenance_slow

Assisted-By: claude-sonnet-4.6 via OpenCode

crates/vfox/src/vfox.rs

src/backend/vfox.rs

docs/dev-tools/mise-lock.md

vfox tool plugins provide version + URL + provenance in the lockfile but do not populate checksum or size fields. Move from Full support to its own Partial support line to accurately reflect this. Assisted-By: claude-sonnet-4.6 via OpenCode

Assisted-By: claude-sonnet-4.6 via OpenCode

…nce_for_platform Assisted-By: claude-sonnet-4.6 via OpenCode

Minisign is intentionally absent (not just 'excluded') because vfox plugins do not produce Minisign signatures. The updated comment explains why the subset exists and gives clear guidance for extending both enums. Assisted-By: claude-sonnet-4.6 via OpenCode

…mments All three attestation verifications always execute — none short-circuits the others. The priority ordering only controls which variant is recorded in 'verified'. Updated inline comments to make this distinction explicit so readers aren't misled into thinking early verification prevents later ones from running. Assisted-By: claude-sonnet-4.6 via OpenCode

…ping The same mise→vfox OS/arch name mapping was duplicated in get_tarball_url and resolve_lock_info. Extracted into a private to_vfox_platform() helper on VfoxBackend. Assisted-By: claude-sonnet-4.6 via OpenCode

crates/vfox/src/hooks/pre_install.rs

src/backend/vfox.rs

validate_github_artifact_attestation_params handles both directions but only the owner-without-repo direction was tested. Add the mirror case. Assisted-By: claude-sonnet-4.6 via OpenCode

The previous message said 'Enable the corresponding verification setting' which is guidance for aqua/github backends where the user controls attestation flags. For vfox, attestation is declared entirely by the plugin — there is no user-facing setting. The updated message directs the user to update the lockfile or investigate the plugin change. Assisted-By: claude-sonnet-4.6 via OpenCode

crates/vfox/src/vfox.rs

src/backend/vfox.rs

e2e/lockfile/test_lockfile_vfox_provenance_slow

…sult The SLSA guard condition only exempts GithubAttestations, so a prior Cosign result is intentionally overwritten. Make this explicit. Assisted-By: claude-sonnet-4.6 via OpenCode

e2e/lockfile/test_lockfile_vfox_provenance_slow

src/backend/vfox.rs

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

If install fails, tv is discarded via ?, so the taken value is never observed. A future refactor that recovers from install errors would need to restore locked_provenance to tv before retrying. Assisted-By: claude-sonnet-4.6 via OpenCode

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

@roele

### 🚀 Features - **(github)** use release latest endpoint to get latest release by @roele in [#8516](#8516) - **(install)** add shared and system install directories by @jdx in [#8581](#8581) - **(vfox)** add provenance metadata to lockfile for tool plugins by @malept in [#8544](#8544) ### 🐛 Bug Fixes - **(aqua)** expose main binary when files field is empty and symlink_bins is enabled by @AlexanderTheGrey in [#8550](#8550) - **(env)** redact secrets in `mise set` listing and task-specific env by @jdx in [#8583](#8583) - **(prepare)** install config tools before running prepare steps by @jdx in [#8582](#8582) - **(task)** allow ctrl-c to interrupt tool downloads during `mise run` by @jdx in [#8571](#8571) - **(tasks)** add file task header parser support for spaces around = by @roele in [#8574](#8574) ### 📚 Documentation - **(task)** add property description for interactive by @roele in [#8562](#8562) - add missing `</bold>` closing tag by @muzimuzhi in [#8564](#8564) - rebrand site with new chef logo and warm culinary palette by @jdx in [#8587](#8587) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to de4657e by @renovate[bot] in [#8577](#8577) - update ghcr.io/jdx/mise:copr docker digest to eef29a2 by @renovate[bot] in [#8578](#8578) - update ghcr.io/jdx/mise:rpm docker digest to 5a96587 by @renovate[bot] in [#8580](#8580) - update ghcr.io/jdx/mise:deb docker digest to 464cf7c by @renovate[bot] in [#8579](#8579) ### 📦 Registry - fix flatc version test mismatch by @jdx in [#8588](#8588) ### Chore - **(registry)** skip spark test-tool by @jdx in [#8572](#8572) ### New Contributors - @AlexanderTheGrey made their first contribution in [#8550](#8550) ## 📦 Aqua Registry Updates #### New Packages (6) - [`bahdotsh/mdterm`](https://github.com/bahdotsh/mdterm) - [`callumalpass/mdbase-lsp`](https://github.com/callumalpass/mdbase-lsp) - [`facebook/ktfmt`](https://github.com/facebook/ktfmt) - [`gurgeous/tennis`](https://github.com/gurgeous/tennis) - [`tektoncd/pipelines-as-code`](https://github.com/tektoncd/pipelines-as-code) - [`weedonandscott/trolley`](https://github.com/weedonandscott/trolley) #### Updated Packages (2) - [`apple/container`](https://github.com/apple/container) - [`cocogitto/cocogitto`](https://github.com/cocogitto/cocogitto)

…#8544) # Summary - Wire `PreInstallAttestation` (returned by vfox tool plugin `PreInstall` hooks) through to `PlatformInfo.provenance` in `mise.lock`, covering both `mise install` and `mise lock` - Brings vfox tool plugins to parity with aqua and github backends for supply-chain provenance tracking and downgrade-attack detection - Does not apply to vfox backend plugins (they use `backend_install`, which has no `PreInstall` hook) ## Details - **`VerifiedAttestation` enum** in vfox crate: `GithubAttestations`, `Slsa`, `Cosign` — represents the highest-priority attestation that was successfully verified (GitHub > SLSA > Cosign) - **`verify()` return type** changed from `Result<()>` to `Result<Option<VerifiedAttestation>>`; threaded through `InstallResult` so callers can inspect what was verified - **Provenance recording + enforcement** in `install_version_()`: records `ProvenanceType` in lockfile after install, and raises a "downgrade attack" error on subsequent installs if the lockfile expected provenance that wasn't verified - **`resolve_lock_info()` override**: calls new `pre_install_provenance_for_platform()` to populate provenance in the lockfile during `mise lock`. This trusts the plugin's declared attestation fields (e.g. `github_owner`/`github_repo`, `slsa_provenance_path`) to infer provenance type without running actual sigstore/cosign verification — consistent with how `mise lock` works for other backends (query plugin metadata, don't verify signatures). Actual verification only runs during `mise install` - **SLSA URL handling**: uses `url: None` for vfox SLSA provenance (matching github/aqua backends) since the local filesystem path to the downloaded provenance file is ephemeral - **Crate boundary**: `VerifiedAttestation` (attestation verification mechanics) lives in the `vfox` crate, while `ProvenanceType` (lockfile schema) lives in `mise` core. The `verified_attestation_to_provenance()` bridge in `src/backend/vfox.rs` maps between the two, keeping the vfox crate independent of mise's lockfile format - **Docs**: updated vfox.md security bullet and mise-lock.md backend support matrix to note provenance support for `aqua`, `github`, `vfox` (tool plugins only), `core:ruby` (precompiled), `core:zig` (install-time) ## Test plan - [x] 6 unit tests for `PreInstallAttestation` validation (GitHub owner/repo, cosign key/sig, SLSA min-level/provenance-path) - [x] Snapshot test for `attestation` plugin fixture - [x] Unit test for `verified_attestation_to_provenance()` conversion - [x] E2E test: `mise lock` writes URL for vfox tool, injected provenance triggers downgrade-attack error on `mise install` - [x] All existing tests pass (`cargo test`, vfox crate tests, lints) 🤖 Generated with the assistance of OpenCode (claude-sonnet-4.6). --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

@roele

### 🚀 Features - **(github)** use release latest endpoint to get latest release by @roele in [jdx#8516](jdx#8516) - **(install)** add shared and system install directories by @jdx in [jdx#8581](jdx#8581) - **(vfox)** add provenance metadata to lockfile for tool plugins by @malept in [jdx#8544](jdx#8544) ### 🐛 Bug Fixes - **(aqua)** expose main binary when files field is empty and symlink_bins is enabled by @AlexanderTheGrey in [jdx#8550](jdx#8550) - **(env)** redact secrets in `mise set` listing and task-specific env by @jdx in [jdx#8583](jdx#8583) - **(prepare)** install config tools before running prepare steps by @jdx in [jdx#8582](jdx#8582) - **(task)** allow ctrl-c to interrupt tool downloads during `mise run` by @jdx in [jdx#8571](jdx#8571) - **(tasks)** add file task header parser support for spaces around = by @roele in [jdx#8574](jdx#8574) ### 📚 Documentation - **(task)** add property description for interactive by @roele in [jdx#8562](jdx#8562) - add missing `</bold>` closing tag by @muzimuzhi in [jdx#8564](jdx#8564) - rebrand site with new chef logo and warm culinary palette by @jdx in [jdx#8587](jdx#8587) ### 📦️ Dependency Updates - update ghcr.io/jdx/mise:alpine docker digest to de4657e by @renovate[bot] in [jdx#8577](jdx#8577) - update ghcr.io/jdx/mise:copr docker digest to eef29a2 by @renovate[bot] in [jdx#8578](jdx#8578) - update ghcr.io/jdx/mise:rpm docker digest to 5a96587 by @renovate[bot] in [jdx#8580](jdx#8580) - update ghcr.io/jdx/mise:deb docker digest to 464cf7c by @renovate[bot] in [jdx#8579](jdx#8579) ### 📦 Registry - fix flatc version test mismatch by @jdx in [jdx#8588](jdx#8588) ### Chore - **(registry)** skip spark test-tool by @jdx in [jdx#8572](jdx#8572) ### New Contributors - @AlexanderTheGrey made their first contribution in [jdx#8550](jdx#8550) ## 📦 Aqua Registry Updates #### New Packages (6) - [`bahdotsh/mdterm`](https://github.com/bahdotsh/mdterm) - [`callumalpass/mdbase-lsp`](https://github.com/callumalpass/mdbase-lsp) - [`facebook/ktfmt`](https://github.com/facebook/ktfmt) - [`gurgeous/tennis`](https://github.com/gurgeous/tennis) - [`tektoncd/pipelines-as-code`](https://github.com/tektoncd/pipelines-as-code) - [`weedonandscott/trolley`](https://github.com/weedonandscott/trolley) #### Updated Packages (2) - [`apple/container`](https://github.com/apple/container) - [`cocogitto/cocogitto`](https://github.com/cocogitto/cocogitto)

malept added 7 commits March 9, 2026 21:21

gemini-code-assist bot reviewed Mar 10, 2026

View reviewed changes