Codestin Search App

risu729 · 2026-05-09T07:18:20Z

Summary

add github_attestations = "unavailable" as a checksum-backed negative cache for GitHub Artifact Attestations
keep provenance reserved for positive provenance types (github-attestations, slsa, cosign, minisign)
skip only the redundant GitHub attestation probe when the unavailable marker is present
keep SLSA, Cosign, Minisign, checksum verification, and locked_verify_provenance / paranoid re-verification behavior intact
document the marker in the lockfile provenance docs

Previous plan

The project item proposed caching a negative GitHub Artifact Attestations result (404 / empty response) in mise.lock so repeated installs do not keep calling the attestation API for the same checksum-backed artifact, while still running checksum verification and any other configured provenance paths.

This PR keeps that plan, but follows the lockfile provenance policy by storing the negative cache outside provenance as github_attestations = "unavailable". A missing attestation is not provenance, so it should not satisfy provenance downgrade checks or suppress SLSA/Cosign/Minisign.

Policy and history

Discussion `mise install --locked` / `MISE_LOCKED=1` still calls GH API for aqua tools despite lockfile having pre-resolved URLs #8677 reported that mise install --locked still called GitHub APIs despite lockfile URLs and checksums.
fix(install): skip GitHub API calls for aqua tools in --locked mode #8679 fixed the release-asset URL path by trusting lockfile URLs in locked mode.
fix(install): skip redundant provenance verification when lockfile has integrity data #8688 skipped redundant install-time provenance verification when a lockfile already has checksum + provenance, because the checksum is enough for repeated installs after provenance has been established.
fix(install): detect github attestations provenance at lock-time #8781 tried to add GitHub Attestations to lock-time detection, but jdx held it because recording provenance from metadata/API detection alone meant provenance might never be cryptographically verified.
fix(install): add locked_verify_provenance setting and detect github attestations at lock time #8901 resolved that policy gap: current-platform lock entries now verify provenance cryptographically at lock time, cross-platform entries remain detection-only, and locked_verify_provenance / paranoid can force install-time re-verification.

So the current policy is: the lockfile stores the provenance type, not the full attestation bundle. For the current platform it should only record positive provenance after verification. Future installs can trust the checksum by default and skip re-verification unless force verification is enabled.

Can attestations be added later?

Yes. GitHub's docs show binary artifact attestations are generated after the artifact exists by running actions/attest with a subject-path: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations#generating-build-provenance-for-binaries

GitHub's REST API also lists attestations by subject digest, not by a one-time release-asset upload event: https://docs.github.com/en/rest/orgs/attestations#list-attestations

That means a project can upload a release asset first and create an attestation for that same digest later. github_attestations = "unavailable" is only a snapshot of what mise observed when this lockfile entry was written, not a permanent fact about the release.

Tradeoffs

Benefit: locked installs with a URL and checksum avoid repeated GitHub attestation API reads for artifacts that were already observed without attestations, reducing rate-limit failures in CI.
Cost: because those later locked installs intentionally avoid the GitHub attestation API, they cannot discover attestations added after github_attestations = "unavailable" was written.
Refresh path: a later mise lock run is the clear way to re-probe and persist provenance = "github-attestations" if attestations appear later. MISE_LOCKED_VERIFY_PROVENANCE=1 mise install can also re-probe during install, and can persist the replacement when the normal install lockfile update path runs for a newly installed version.

Context

Addresses the project item: https://github.com/users/risu729/projects/3/views/1?pane=issue&itemId=185170127
Related source discussion: #8677
Related PRs: #8679, #8688, #8781, #8901

Tests

cargo check -q
cargo test -q github_attestations_unavailable
cargo test -q test_provenance_
cargo test -q test_verified_attestation_to_provenance_type
mise run lint

This PR was generated by an AI coding assistant.

greptile-apps · 2026-05-09T07:22:12Z

Greptile Summary

This PR adds github_attestations = \"unavailable\" as a checksum-paired negative cache in the lockfile, allowing subsequent locked installs to skip the GitHub Attestation API probe for artifacts that were already confirmed to have no attestations — without suppressing SLSA, Cosign, Minisign, or checksum verification.

GithubAttestationsStatus enum and a custom Deserialize for PlatformInfo are added to lockfile.rs; mutual exclusivity with provenance is enforced in serialization, deserialization, merge, and the new update_tool lockfile-write path.
Both the github and aqua backends' lock-time and install-time paths are refactored to return (Option<ProvenanceType>, Option<GithubAttestationsStatus>) tuples; the negative cache is persisted only when a checksum is present and no verified provenance was established.
The skip_cached_absent_attestations guard correctly respects force_provenance_verify() so MISE_LOCKED_VERIFY_PROVENANCE=1 and mise lock both re-probe the attestation API.

Confidence Score: 5/5

Safe to merge: the negative cache is correctly scoped, mutual exclusivity with verified provenance is enforced at every write site, and force-verify paths re-probe as intended.

The mutual-exclusivity invariant between provenance and github_attestations is consistently maintained across serialization, deserialization, merge, lock-time, and install-time paths in both backends. The skip_cached_absent_attestations guard checks !force_provenance_verify() so the negative cache is never silently honoured when the user explicitly requests re-verification. The new tests cover roundtrip serialization, provenance-wins-over-unavailable scenarios, regression detection, and the is_empty helper. No correctness issues were identified.

No files require special attention.

Important Files Changed

Filename	Overview
src/lockfile.rs	Adds GithubAttestationsStatus enum, custom Deserialize for PlatformInfo, and helper methods; correctly enforces mutual exclusivity between provenance and github_attestations throughout serialization, deserialization, and merge logic.
src/backend/github.rs	Refactors detect_provenance_type and verify_provenance_at_lock_time to return (Option, Option) tuples; correctly records negative cache at lock-time and install-time, with skip_cached_absent_attestations bypassing the API probe when force_verify is false.
src/backend/aqua.rs	Mirrors github.rs changes for the aqua backend; correctly propagates unavailable status through lock-time and install-time paths, with the mutual-exclusivity invariant enforced after all verification steps complete.
docs/dev-tools/mise-lock.md	Documents the new github_attestations = "unavailable" negative-cache field and clarifies it is not provenance; explains the attestation-after-release-asset scenario and the refresh path via mise lock or MISE_LOCKED_VERIFY_PROVENANCE=1.

_{Reviews (6): Last reviewed commit: "Merge branch 'main' into fix/github-atte..." | Re-trigger Greptile}

risu729 · 2026-05-09T07:30:32Z

CI note: the failing checks appear unrelated to this PR.

benchmark failed before benchmarking because installing aqua:sharkdp/hyperfine@latest hit GitHub API rate limiting (403 Forbidden, reset at 2026-05-09 07:53:35 UTC).
windows-e2e failed for the same GitHub API rate limit while installing aqua:tree-sitter/tree-sitter@latest and github:docker/[email protected].
test-ci failed only as the aggregate check because windows-e2e failed.

All code/build/lint/Linux e2e/macOS/Windows unit checks otherwise passed.

This comment was generated by an AI coding assistant.

gemini-code-assist

Code Review

This pull request introduces a negative cache mechanism for GitHub artifact attestations by adding a GithubAttestationsUnavailable provenance type. This state allows the system to record that attestations were checked and found missing, preventing redundant API probes during future installs while maintaining standard verification for other types like SLSA or checksums. The changes affect the lockfile schema, documentation, and the Aqua, GitHub, and vfox backends. Feedback suggests refactoring the verify_github_artifact_attestations method in the Aqua backend to improve clarity by using a more descriptive return type instead of a boolean and separating side effects from the verification logic.

risu729 · 2026-05-09T17:45:47Z

CI note for latest head e71965b80: the failing checks appear unrelated to this PR.

docs failed while installing github:jdx/[email protected]; GitHub artifact attestation verification returned 403 Forbidden for a GitHub API rate limit at 2026-05-09 17:29:43 UTC.
test-tool-0 through test-tool-7 failed while exercising unrelated registry tools; logs show GitHub rate-limit warnings and 403s, for example aqua:nektro/zigmod via https://api.github.com/repos/nektro/zigmod/releases/tags/r99, with reset around 2026-05-09 17:39:41-17:39:45 UTC.
nightly built successfully, then was cancelled inside the shared ./.github/actions/mise-tools setup after wait-for-gh-rate-limit slept for the GitHub core rate limit reset. test-ci and registry-ci are aggregate failures from those jobs.

Passing checks include autofix, benchmark, build, build-ubuntu, build-windows, lint, all Linux e2e shards, windows-e2e, unit-macos, windows-unit, release, and Socket checks.

This comment was generated by an AI coding assistant.

@risu729

### 🚀 Features - **(cli)** add minimum release age flag to lock and ls-remote by @risu729 in [#9269](#9269) - **(config)** add run field for hooks by @risu729 in [#9718](#9718) - **(github)** add native oauth token source by @jdx in [#9654](#9654) - **(oci)** scope build to project config by default by @jdx in [#9766](#9766) - add support for prefixed latest version queries in outdated checks by @roele in [#9767](#9767) ### 🐛 Bug Fixes - **(activate)** guard bash chpwd hook under nounset by @risu729 in [#9716](#9716) - **(backend)** date-check latest stable fast path by @risu729 in [#9650](#9650) - **(config)** parse core tool options consistently by @risu729 in [#9742](#9742) - **(exec)** propagate __MISE_DIFF so nested mise recovers pristine PATH by @jdx in [#9765](#9765) - **(forgejo)** include prereleases when opted in by @risu729 in [#9717](#9717) - **(github)** avoid caching empty release assets by @risu729 in [#9616](#9616) - **(java)** resolve lockfile URLs from metadata by @risu729 in [#9719](#9719) - **(lock)** cache unavailable github attestations by @risu729 in [#9741](#9741) - **(pipx)** preserve options when reinstalling tools by @risu729 in [#9663](#9663) - **(python)** skip redundant lockfile provenance verification by @risu729 in [#9739](#9739) - **(vfox)** run pre_uninstall hook by @risu729 in [#9662](#9662) ### 🚜 Refactor - **(schema)** extract tool options definition by @risu729 in [#9649](#9649) ### ⚡ Performance - **(aqua)** bake rkyv aqua package blobs by @risu729 in [#9535](#9535) ### 📦️ Dependency Updates - lock file maintenance by @renovate[bot] in [#9773](#9773) ### 📦 Registry - add vector ([github:vectordotdev/vector](https://github.com/vectordotdev/vector)) by @kquinsland in [#9761](#9761) - add oc and openshift-install (http backend) by @konono in [#9669](#9669) ### New Contributors - @konono made their first contribution in [#9669](#9669) - @kquinsland made their first contribution in [#9761](#9761)

fix(lock): cache unavailable github attestations

07adfc3

gemini-code-assist Bot reviewed May 9, 2026

View reviewed changes

Comment thread src/backend/aqua.rs Outdated

fix(lock): separate unavailable github attestations

a50c81e

risu729 mentioned this pull request May 9, 2026

fix(python): skip redundant lockfile provenance verification #9739

Merged

autofix-ci Bot and others added 4 commits May 9, 2026 17:03

[autofix.ci] apply automated fixes

6b7147b

fix(lock): clarify aqua attestation status handling

0cf2563

[autofix.ci] apply automated fixes

f8dcf6d

[autofix.ci] apply automated fixes (attempt 2/3)

e71965b

risu729 added 2 commits May 10, 2026 05:47

fix(lock): clear unavailable attestations with provenance

f715656

fix(lock): normalize parsed platform info

bc28c8e

This comment was marked as outdated.

Sign in to view

risu729 marked this pull request as ready for review May 10, 2026 09:13

Merge branch 'main' into fix/github-attestations-unavailable-lock

b8176b3

jdx merged commit 6826866 into jdx:main May 10, 2026
34 checks passed

mise-en-dev mentioned this pull request May 10, 2026

chore: release 2026.5.6 #9764

Merged

risu729 deleted the fix/github-attestations-unavailable-lock branch May 10, 2026 12:13

BrewTestBot mentioned this pull request May 11, 2026

mise 2026.5.6 Homebrew/homebrew-core#282048

Merged

risu729 mentioned this pull request May 14, 2026

mise.lock format updates changing git status jdx/mise-action#472

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(lock): cache unavailable github attestations#9741

fix(lock): cache unavailable github attestations#9741
jdx merged 9 commits into
jdx:mainfrom
risu729:fix/github-attestations-unavailable-lock

risu729 commented May 9, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented May 9, 2026 •

edited

Loading

Uh oh!

risu729 commented May 9, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

risu729 commented May 9, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

risu729 commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Previous plan

Policy and history

Can attestations be added later?

Tradeoffs

Context

Tests

Uh oh!

greptile-apps Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

risu729 commented May 9, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

risu729 commented May 9, 2026

Uh oh!

This comment was marked as outdated.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

risu729 commented May 9, 2026 •

edited

Loading

greptile-apps Bot commented May 9, 2026 •

edited

Loading