Mu-L · pull · Nov 22, 2024 · Nov 22, 2024 · Nov 22, 2024 · Nov 22, 2024
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -195,6 +195,12 @@ jobs:
         with:
           name: mise-ubuntu-latest
           path: target/debug
+      - uses: actions/cache@v4
+        with:
+          key: ${{ runner.os }}-mise-tools-${{ hashFiles('mise.lock') }}
+          path: |
+            ~/.local/share/mise
+            ~/.cache/mise
       - run: echo "$PWD/target/debug" >> "$GITHUB_PATH" && chmod +x target/debug/mise
       - name: Test w/ coverage
         uses: nick-fields/retry@v3
@@ -237,6 +243,9 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 30
     needs: [build-windows]
+    env:
+      MISE_DATA_DIR: ~/.local/share/mise
+      MISE_CACHE_DIR: ~/.cache/mise
     steps:
       - uses: actions/checkout@v4
       - uses: Swatinem/rust-cache@v2
@@ -269,6 +278,9 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 30
     needs: [build-windows]
+    env:
+      MISE_DATA_DIR: ~/.local/share/mise
+      MISE_CACHE_DIR: ~/.cache/mise
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
@@ -304,6 +316,8 @@ jobs:
       TEST_TRANCHE: ${{matrix.tranche}}
       TEST_TRANCHE_COUNT: 4
       TEST_ALL: ${{github.ref_name == 'release' && '1' || '0'}}
+      MISE_DATA_DIR: ~/.local/share/mise
+      MISE_CACHE_DIR: ~/.cache/mise
       MISE_USE_VERSIONS_HOST: 1
       MISE_DISABLE_TOOLS: |
         1password-cli,
@@ -319,4 +333,11 @@ jobs:
       - if: ${{ matrix.os == 'windows-latest' }}
         shell: pwsh
         run: Add-Content $env:GITHUB_PATH "$env:GITHUB_WORKSPACE\target\debug"
+      - uses: actions/cache/restore@v4
+        with:
+          key: ${{ runner.os }}-mise-tools-${{ hashFiles('mise.lock') }}
+          path: |
+            ~/.local/share/mise
+            ~/.cache/mise
+      - run: mise install
       - run: mise test-tool --all
diff --git a/docs/dev-tools/backends/aqua.md b/docs/dev-tools/backends/aqua.md
@@ -25,3 +25,10 @@ The version will be set in `~/.config/mise/config.toml` with the following forma
 
 Some tools will default to use aqua if they're specified in [registry.toml](https://github.com/jdx/mise/blob/main/registry.toml)
 to use the aqua backend. To see these tools, run `mise registry | grep aqua:`.
+
+## Settings
+
+<script setup>
+import Settings from '/components/settings.vue';
+</script>
+<Settings child="aqua" :level="3" />
diff --git a/docs/registry.md b/docs/registry.md
@@ -651,6 +651,7 @@ editLink: false
 | skaffold | [aqua:GoogleContainerTools/skaffold](https://github.com/GoogleContainerTools/skaffold) [asdf:nklmilojevic/asdf-skaffold](https://github.com/nklmilojevic/asdf-skaffold) |
 | skate | [aqua:charmbracelet/skate](https://github.com/charmbracelet/skate) [asdf:chessmango/asdf-skate](https://github.com/chessmango/asdf-skate) |
 | sloth | [aqua:slok/sloth](https://github.com/slok/sloth) [asdf:slok/asdf-sloth](https://github.com/slok/asdf-sloth) |
+| slsa-verifier | [ubi:slsa-framework/slsa-verifier](https://github.com/slsa-framework/slsa-verifier) |
 | smithy | [asdf:aws/asdf-smithy](https://github.com/aws/asdf-smithy) |
 | smlnj | [asdf:samontea/asdf-smlnj](https://github.com/samontea/asdf-smlnj) |
 | snyk | [asdf:nirfuchs/asdf-snyk](https://github.com/nirfuchs/asdf-snyk) |
@@ -723,7 +724,7 @@ editLink: false
 | tfc-agent | [asdf:asdf-community/asdf-hashicorp](https://github.com/asdf-community/asdf-hashicorp) |
 | tfctl | [aqua:flux-iac/tofu-controller/tfctl](https://github.com/flux-iac/tofu-controller/tfctl) [asdf:deas/asdf-tfctl](https://github.com/deas/asdf-tfctl) |
 | tfenv | [aqua:tfutils/tfenv](https://github.com/tfutils/tfenv) [asdf:carlduevel/asdf-tfenv](https://github.com/carlduevel/asdf-tfenv) |
-| tflint | [ubi:terraform-linters/tflint](https://github.com/terraform-linters/tflint) [asdf:skyzyx/asdf-tflint](https://github.com/skyzyx/asdf-tflint) |
+| tflint | [aqua:terraform-linters/tflint](https://github.com/terraform-linters/tflint) [ubi:terraform-linters/tflint](https://github.com/terraform-linters/tflint) [asdf:skyzyx/asdf-tflint](https://github.com/skyzyx/asdf-tflint) |
 | tfmigrate | [aqua:minamijoyo/tfmigrate](https://github.com/minamijoyo/tfmigrate) [asdf:dex4er/asdf-tfmigrate](https://github.com/dex4er/asdf-tfmigrate) |
 | tfnotify | [aqua:mercari/tfnotify](https://github.com/mercari/tfnotify) [asdf:jnavarrof/asdf-tfnotify](https://github.com/jnavarrof/asdf-tfnotify) |
 | tfsec | [aqua:aquasecurity/tfsec](https://github.com/aquasecurity/tfsec) [asdf:woneill/asdf-tfsec](https://github.com/woneill/asdf-tfsec) |

diff --git a/mise.lock b/mise.lock
@@ -4,6 +4,7 @@ version = "1.7.4"
 [tools.actionlint.checksums]
 actionlint-linux-x86_64 = "sha256:39cae525cdb54af5d91dcf27f55e040d37ecea01dd4153490c4dc84f5d251d46"
 actionlint-macos-aarch64 = "sha256:f381afca13b39e095e4cee25e2b2abbb39ae8b2848f5ccd2564bf86192c1b661"
+"actionlint.exe-windows-aarch64" = "sha256:88c33950ccbd3ba6854d14ffa14071673b8f427d5a5711d9ca68d6e97b8a523f"
 
 [tools.bun]
 version = "1.1.36"
@@ -18,6 +19,7 @@ version = "1.10.13"
 [tools.cargo-binstall.checksums]
 cargo-binstall-linux-x86_64 = "sha256:53a7157f56e1698d42d3cd50b1d08f02159638e3a73edf362e14215337942e86"
 cargo-binstall-macos-aarch64 = "sha256:f67dd4fc8ea01b4c55fe041a0fbd6d81a361947f1dbf2bd226490c641cc167b3"
+"cargo-binstall.exe-windows-aarch64" = "sha256:78d3289aee231c1ddaeb520c82576f622a7e202a3a4884ad9f8c206b6c17b25c"
 
 [tools."cargo:cargo-edit"]
 version = "0.13.0"
@@ -34,12 +36,21 @@ version = "2.7.0"
 [tools."cargo:usage-cli"]
 version = "1.3.3"
 
+[tools.cosign]
+version = "2.4.1"
+
+[tools.cosign.checksums]
+cosign-darwin-arm64 = "sha256:13343856b69f70388c4fe0b986a31dde5958e444b41be22d785d3dc5e1a9cc62"
+cosign-linux-amd64 = "sha256:8b24b946dd5809c6bd93de08033bcf6bc0ed7d336b7785787c080f574b89249b"
+"cosign-windows-amd64.exe" = "sha256:8d57f8a42a981d27290c4227271fa9f0f62ca6630eb4a21d316bd6b01405b87c"
+
 [tools.jq]
 version = "1.7.1"
 
 [tools.jq.checksums]
 jq-linux-amd64 = "sha256:5942c9b0934e510ee61eb3e30273f1b3fe2590df93933a93d7c58b81d19c8ff5"
 jq-macos-arm64 = "sha256:0bbe619e663e0de2c550be2fe0d240d076799d6f8a652b70fa04aea8a8362e8a"
+"jq-windows-amd64.exe" = "sha256:7451fbbf37feffb9bf262bd97c54f0da558c63f0748e64152dd87b0a07b6d6ab"
 
 [tools."npm:markdownlint-cli"]
 version = "0.42.0"
@@ -55,6 +66,7 @@ version = "14.1.1"
 
 [tools.ripgrep.checksums]
 "ripgrep-14.1.1-aarch64-apple-darwin.tar.gz" = "sha256:24ad76777745fbff131c8fbc466742b011f925bfa4fffa2ded6def23b5b937be"
+"ripgrep-14.1.1-x86_64-pc-windows-msvc.zip" = "sha256:d0f534024c42afd6cb4d38907c25cd2b249b79bbe6cc1dbee8e3e37c2b6e25a1"
 "ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz" = "sha256:4cf9f2741e6c465ffdb7c26f38056a59e2a2544b51f7cc128ef28337eeae4d8e"
 
 [tools.shellcheck]
@@ -66,3 +78,11 @@ shellcheck-macos-aarch64 = "sha256:b9e420df8c78ec7d261d66277d5767cbd4cf6da4e4a9f
 
 [tools.shfmt]
 version = "3.10.0"
+
+[tools.slsa-verifier]
+version = "2.6.0"
+
+[tools.slsa-verifier.checksums]
+slsa-verifier-linux-x86_64 = "sha256:1c9c0d6a272063f3def6d233fa3372adbaff1f5a3480611a07c744e73246b62d"
+slsa-verifier-macos-aarch64 = "sha256:8740e66832fd48bbaa479acd5310986b876ff545460add0cb4a087aec056189c"
+"slsa-verifier.exe-windows-aarch64" = "sha256:6235daec8037a2e8f6aa11c583eed6b09b2cd36b61b43b9e5898281b39416d2f"
diff --git a/mise.toml b/mise.toml
@@ -5,22 +5,24 @@ min_version = "2024.1.1"
 _.path = ["./target/debug", "./node_modules/.bin"]
 
 [tools]
-shellcheck = "0.10"
-shfmt = "3"
-jq = "latest"
-cargo-binstall = "latest"
+"actionlint" = "latest"
+"bun" = "latest"
+"cargo-binstall" = "latest"
 "cargo:cargo-edit" = "latest"
-"cargo:cargo-show" = { version = "latest", os = ["linux", "macos"] }
 "cargo:cargo-insta" = "latest"
+"cargo:cargo-show" = { version = "latest", os = ["linux", "macos"] }
 "cargo:git-cliff" = "latest"
+"cargo:usage-cli" = { version = "latest", os = ["linux", "macos"] }
+cosign = "latest"
+"jq" = "latest"
 "npm:markdownlint-cli" = "latest"
 "npm:prettier" = "3"
-actionlint = "latest"
-ripgrep = "latest"
 "pipx:toml-sort" = "latest"
-"cargo:usage-cli" = { version = "latest", os = ["linux", "macos"] }
-bun = "latest"
-#python = { version = "latest", virtualenv = "{{env.HOME}}/.cache/venv" }
+#"python" = { version = "latest", virtualenv = "{{env.HOME}}/.cache/venv" }
+"ripgrep" = "latest"
+"shellcheck" = "0.10"
+"shfmt" = "3"
+slsa-verifier = "latest"
 
 [task_config]
 includes = ["tasks.toml", "tasks"]
diff --git a/registry.toml b/registry.toml
@@ -162,6 +162,7 @@ copper.backends = ["asdf:vladlosev/asdf-copper"]
 coq.backends = ["asdf:gingerhot/asdf-coq"]
 coredns.backends = ["asdf:s3than/asdf-coredns"]
 cosign.backends = ["aqua:sigstore/cosign", "asdf:https://gitlab.com/wt0f/asdf-cosign"]
+cosign.test = ["cosign version", "v{{version}}"]
 coursier.backends = ["asdf:jiahuili430/asdf-coursier"]
 crane.backends = ["asdf:dmpe/asdf-crane"]
 crc.backends = ["asdf:sqtran/asdf-crc"]
@@ -426,6 +427,7 @@ kind.backends = ["ubi:kubernetes-sigs/kind", "asdf:johnlayton/asdf-kind"]
 kiota.backends = ["aqua:microsoft/kiota", "asdf:asdf-community/asdf-kiota"]
 kn.backends = ["asdf:joke/asdf-kn"]
 ko.backends = ["aqua:ko-build/ko", "asdf:zasdaym/asdf-ko"]
+ko.test = ["ko version", "{{version}}"]
 koka.backends = ["asdf:susurri/asdf-koka"]
 kompose.backends = ["ubi:kubernetes/kompose", "asdf:technikhil314/asdf-kompose"]
 kops.backends = ["aqua:kubernetes/kops", "asdf:Antiarchitect/asdf-kops"]
@@ -709,6 +711,8 @@ sinker.backends = ["aqua:plexsystems/sinker", "asdf:elementalvoid/asdf-sinker"]
 skaffold.backends = ["aqua:GoogleContainerTools/skaffold", "asdf:nklmilojevic/asdf-skaffold"]
 skate.backends = ["aqua:charmbracelet/skate", "asdf:chessmango/asdf-skate"]
 sloth.backends = ["aqua:slok/sloth", "asdf:slok/asdf-sloth"]
+slsa-verifier.backends = ["ubi:slsa-framework/slsa-verifier"]
+slsa-verifier.test = ["slsa-verifier version", "{{version}}"]
 smithy.backends = ["asdf:aws/asdf-smithy"]
 smlnj.backends = ["asdf:samontea/asdf-smlnj"]
 snyk.backends = ["asdf:nirfuchs/asdf-snyk"]
@@ -783,7 +787,8 @@ tf-summarize.backends = ["aqua:dineshba/tf-summarize", "asdf:adamcrews/asdf-tf-s
 tfc-agent.backends = ["asdf:asdf-community/asdf-hashicorp"]
 tfctl.backends = ["aqua:flux-iac/tofu-controller/tfctl", "asdf:deas/asdf-tfctl"]
 tfenv.backends = ["aqua:tfutils/tfenv", "asdf:carlduevel/asdf-tfenv"]
-tflint.backends = ["ubi:terraform-linters/tflint", "asdf:skyzyx/asdf-tflint"]
+tflint.backends = ["aqua:terraform-linters/tflint", "ubi:terraform-linters/tflint", "asdf:skyzyx/asdf-tflint"]
+tflint.test = ["tflint --version", "TFLint version {{version}}"]
 tfmigrate.backends = ["aqua:minamijoyo/tfmigrate", "asdf:dex4er/asdf-tfmigrate"]
 tfnotify.backends = ["aqua:mercari/tfnotify", "asdf:jnavarrof/asdf-tfnotify"]
 tfsec.backends = ["aqua:aquasecurity/tfsec", "asdf:woneill/asdf-tfsec"]

diff --git a/schema/mise.json b/schema/mise.json
@@ -127,9 +127,24 @@
           "description": "should mise keep install files after installation even if the installation fails",
           "type": "boolean"
         },
-        "aqua_registry_url": {
-          "description": "URL to fetch aqua registry from.",
-          "type": "string"
+        "aqua": {
+          "additionalProperties": false,
+          "properties": {
+            "cosign": {
+              "default": true,
+              "description": "Use cosign to verify aqua tool signatures.",
+              "type": "boolean"
+            },
+            "registry_url": {
+              "description": "URL to fetch aqua registry from.",
+              "type": "string"
+            },
+            "slsa": {
+              "default": true,
+              "description": "Use SLSA to verify aqua tool signatures.",
+              "type": "boolean"
+            }
+          }
         },
         "asdf": {
           "description": "use asdf as a default plugin backend",

diff --git a/settings.toml b/settings.toml
@@ -55,7 +55,13 @@ env = "MISE_ALWAYS_KEEP_INSTALL"
 type = "Bool"
 description = "should mise keep install files after installation even if the installation fails"
 
-[aqua_registry_url]
+[aqua.cosign]
+env = "MISE_AQUA_COSIGN"
+type = "Bool"
+default = true
+description = "Use cosign to verify aqua tool signatures."
+
+[aqua.registry_url]
 env = "MISE_AQUA_REGISTRY_URL"
 type = "Url"
 optional = true
@@ -69,6 +75,12 @@ However when this is not specified, instead of cloning the entire registry each
 via HTTP individually.
 """
 
+[aqua.slsa]
+env = "MISE_AQUA_SLSA"
+type = "Bool"
+default = true
+description = "Use SLSA to verify aqua tool signatures."
+
 [asdf]
 env = "MISE_ASDF"
 type = "Bool"