refactor(security): switch to sigstore-rust verification

[jdx]

Summary

Replace the external sigstore-verification 0.2.x dependency with a local mise-sigstore adapter built on sigstore-verify 0.7.0 from sigstore-rust. mise's call sites are unchanged — the wrapper at src/github/sigstore.rs and the vfox crate are rerouted to the new adapter, which preserves the existing helper-style API (verify_github_attestation, verify_cosign_signature, verify_slsa_provenance, detect_attestations).

Why a local adapter rather than sigstore-verify directly

sigstore-verify 0.7.x exposes a different (and richer) API surface than the legacy crate. The adapter keeps mise's existing helper-style API stable, layers in GitHub-API attestation fetching (including bundle_url resolution + Snappy decompression), and adds the two paths sigstore-verify itself does not cover:

• Legacy cosign v1 bundles ({base64Signature, cert, rekorBundle}) — emitted by cosign sign-blob --bundle 2.x and still produced by goreleaser-signed releases (envsense, etc.). sigstore-verify's Bundle::from_json rejects this shape, so we chain-validate the embedded Fulcio cert ourselves and ECDSA-verify base64Signature over the artifact bytes.
• Raw DSSE envelopes (*.intoto.jsonl from slsa-github-generator / goreleaser) — no verificationMaterial, so sigstore-verify rejects them. We verify the DSSE signature against the Fulcio cert in the envelope (chain-validated), then enforce the artifact's SHA-256 is present in the in-toto subject list.

What sigstore-verify 0.7.0 buys us over 0.6.x

0.7.0 (and the matching sigstore-trust-root 0.7.0) lets us drop every local workaround the original adapter shipped:

• The embedded Sigstore TUF root is gone — upstream ships TUF v14 directly, so TrustedRoot::production() walks the live TUF CDN with no custom bootstrap root from us.
• The embedded github_trusted_root.json is gone — TrustedRoot::from_embedded(SigstoreInstance::GitHub) provides it (byte-identical content), same fallback rationale: tough doesn't yet validate GitHub's TUF spec version.
• The manual webpki chain validation for GitHub-internal certs is gone — VerificationPolicy::skip_sct() (new in 0.7.0) lets us turn off just the SCT check (which GitHub doesn't issue) while keeping full sigstore-verify-driven chain validation. We still use verify_cert_chain for raw DSSE envelopes, since those don't go through sigstore_verify::verify at all.

Net delta vs. the previous iteration of this PR: ~1,150 lines deleted from mise-sigstore, plus the legacy cosign v1 path added.

Verified

• cargo check, cargo clippy --all-targets -- -D warnings, cargo fmt --all -- --check, taplo fmt
• cargo test --bin mise — 924 tests pass
• cargo test -p mise-sigstore — 8 tests pass
• e2e (locally): test_aqua_github_attestations, test_aqua_cosign, test_lockfile_cosign_top_level_binary, test_lockfile_cosign_opts_only, test_python_github_attestations, test_ruby_github_attestations all pass — including the new legacy-bundle path against envsense 0.3.4 and the modern bundle path against goreleaser 2.14.1.

This PR was generated by an AI coding assistant.

---

Note

High Risk
Replaces the core artifact attestation/cosign/SLSA verification dependency and logic, including new certificate-chain and DSSE/legacy bundle handling, which could incorrectly accept or reject releases if any edge case is missed.

Overview
Swaps out the sigstore-verification dependency for a new workspace crate, mise-sigstore, built on sigstore-verify v0.7, and reroutes mise and vfox verification call sites to it.

The new adapter adds GitHub attestation fetching (including bundle_url resolution and Snappy decompression), updates verification policy handling (e.g., skipping tlog or SCT checks when bundles lack those proofs), and expands support to legacy cosign v1 bundles and raw DSSE *.intoto.jsonl provenance by manually chain-validating embedded Fulcio certs and verifying signatures + subject digests.

Also updates error classification in the GitHub backend to treat more sigstore-verify parse/format failures as non-fatal format issues, adjusts TLS feature wiring, adds release automation for publishing mise-sigstore, and updates deny.toml ignores for transitive rustls-webpki advisories.

^{Reviewed by Cursor Bugbot for commit 29fa282. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request replaces the sigstore-verification dependency with a new internal crate, mise-sigstore, which leverages sigstore-verify v0.6.4. The transition involves updating various backends and plugins to use the new verification helpers. Several issues were identified in the new implementation, including the use of unstable Rust features like the 2024 edition and let_chains syntax. Additionally, feedback was provided regarding potential performance bottlenecks from synchronous I/O in asynchronous contexts and redundant loading of the production trust root within loops. Logic errors in error matching for SLSA fallback and unused variables in URL construction were also noted.

[greptile-apps]

Greptile Summary

This PR replaces the external sigstore-verification 0.2.x dependency with a local mise-sigstore adapter built on sigstore-verify 0.7.0, keeping mise's existing helper-style API (verify_github_attestation, verify_cosign_signature, verify_slsa_provenance) unchanged at call sites while adding support for legacy cosign v1 bundles and raw DSSE SLSA envelopes.

• crates/mise-sigstore — New workspace crate that handles GitHub attestation fetching (with bundle_url/Snappy support), modern sigstore bundle verification via sigstore_verify::verify, legacy cosign v1 bundle verification (cert chain validation + ECDSA over artifact bytes), and raw DSSE envelope verification (verify_dsse_signature + verify_cert_chain + PAE signature check).
• src/github/sigstore.rs — New bridge module that centralises GitHub token resolution via the full resolve_token_for_api_url chain, preventing the unauthenticated-attestation regression that hit rate limits.
• src/backend/github.rs — Adds is_slsa_format_issue to distinguish format/parse failures from cryptographic failures; deny.toml acknowledges four rustls-webpki 0.102.x advisories pulled transitively via sigstore-tsa 0.7.0.

Confidence Score: 4/5

Safe to merge after reviewing the one inline comment; the security-critical verification paths are substantially improved over the previous iteration.

The new verify_dsse_signature + verify_cert_chain path for raw DSSE envelopes now performs full cryptographic chain validation and PAE signature verification, closing the gaps flagged in earlier review rounds. The one fresh concern is in is_slsa_format_issue: it matches a broad substring (missing field) inside Verification/Sigstore error messages, and a future upstream message-text change could silently misclassify a cryptographic failure as a format issue.

src/backend/github.rs — the is_slsa_format_issue error-message pattern matching warrants a closer look.

Important Files Changed

Filename	Overview
crates/mise-sigstore/src/lib.rs	New core crate implementing all verification paths. The major security issues from the previous review are addressed: DSSE signatures are now cryptographically verified via verify_dsse_signature + verify_cert_chain, skip_tlog is conditional on bundle.has_inclusion_proof(), the signer identity check properly rejects empty/absent identities, and verify_cosign_signature_with_key propagates verification failures as Err.
src/github/sigstore.rs	Clean bridge module that centralises token resolution via resolve_token_for_api_url and prevents unauthenticated attestation requests. Dispatches correctly between default and enterprise API URLs. New tests cover all token source precedences.
src/backend/github.rs	Adds is_slsa_format_issue to distinguish format mismatches from verification failures. Relies on fragile upstream error-message substrings — see inline comment.
crates/vfox/src/vfox.rs	Call sites updated from sigstore-verification to mise-sigstore. All await?/propagation patterns correct.
deny.toml	Four new RUSTSEC ignores for rustls-webpki 0.102.x advisories transitively pulled by sigstore-tsa 0.7.0. Rationale is plausible and matches the code.
xtasks/release-plz	mise-sigstore is published before vfox so the version dep is available when vfox is bumped. cargo add --no-default-features correctly leaves workspace-level feature re-exports intact.

_{Reviews (24): Last reviewed commit: "chore(deps): ignore rustls-webpki 0.102 ..." | Re-trigger Greptile}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.7 x -- echo	24.1 ± 2.4	19.8	31.6	1.00
mise x -- echo	24.3 ± 2.3	20.0	30.4	1.01 ± 0.14

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.7 env	24.0 ± 2.0	19.9	30.6	1.03 ± 0.14
mise env	23.2 ± 2.4	18.8	29.5	1.00

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.7 hook-env	24.8 ± 2.2	20.2	30.9	1.00
mise hook-env	25.1 ± 2.3	20.3	31.1	1.01 ± 0.13

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.7 ls	20.0 ± 1.9	16.4	25.2	1.00
mise ls	20.7 ± 2.0	16.5	27.4	1.03 ± 0.14

xtasks/test/perf

Command	mise-2026.5.7	mise	Variance
install (cached)	146ms	150ms	-2%
ls (cached)	68ms	71ms	-4%
bin-paths (cached)	73ms	76ms	-3%
task-ls (cached)	582ms	577ms	+0%

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f614169. Configure here.}