Greptile Summary

This PR fixes a Windows CI failure caused by pkg.hexops.org (the redirect target of pkg.machengine.org) dropping TLS 1.2 support around 2026-03-27. The fix has two parts: switching the build-windows CI job to build with rustls-native-roots instead of the default native-tls, and correcting the vfox crate to prevent sigstore-verification from silently pulling in native-tls regardless of the chosen TLS backend.

• .github/workflows/test.yml: build-windows now passes --no-default-features --features rustls-native-roots,vfox/vendored-lua,self_update, which mirrors the release build in scripts/build-tarball.ps1 and routes all TLS through rustls (capable of TLS 1.3) instead of SChannel (which fails on the broken TLS 1.2 handshake).
• crates/vfox/Cargo.toml: sigstore-verification is changed to default-features = false, and each of the three TLS feature variants (native-tls, rustls, rustls-native-roots) now explicitly activates the matching feature on sigstore-verification. Previously, even when building vfox with rustls-native-roots, the sigstore-verification crate would still link in its default native-tls backend due to the missing default-features = false.
• The mise-shim crate is unaffected — it has zero external dependencies and makes no network requests, so the separate cargo build -p mise-shim without --no-default-features is safe.

Confidence Score: 5/5

Safe to merge — targeted, minimal changes that align the CI build with the existing release configuration.

Both changes are correct and well-contained. The workflow change exactly mirrors what release builds already use, and the Cargo.toml fix is the standard pattern for opting out of a dependency's default TLS features. No logic, APIs, or user-facing behaviour are altered. The mise-shim crate has zero external dependencies so it is unaffected by the feature flag change. No P0 or P1 findings.

No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph Before["Before (cargo build - default native-tls)"]
        A1[mise crate\nnative-tls feature] --> B1[reqwest/native-tls]
        A1 --> C1[vfox/native-tls]
        C1 --> D1[sigstore-verification\ndefault = native-tls ALWAYS]
        D1 -->|SChannel TLS 1.2| E1[pkg.hexops.org\nBROKEN TLS 1.2]
        E1 -->|SEC_E_ILLEGAL_MESSAGE| F1[CI Failure]
    end

    subgraph After["After (--no-default-features --features rustls-native-roots,...)"]
        A2[mise crate\nrustls-native-roots feature] --> B2[reqwest/rustls-tls-native-roots]
        A2 --> C2[vfox/rustls-native-roots]
        C2 --> D2[sigstore-verification\ndefault-features=false\n+ rustls-native-roots]
        D2 -->|rustls TLS 1.3| E2[pkg.hexops.org]
        E2 -->|200 OK| F2[CI Passes]
    end

_{Reviews (3): Last reviewed commit: "[autofix.ci] apply automated fixes" | Re-trigger Greptile}

Hyperfine Performance

mise x -- echo

mise env

mise hook-env

mise ls

xtasks/test/perf