fix(aqua): support cosign public-key bundles

[jdx]

Summary

• honor aqua cosign bundle configs that provide a public key through cosign.opts
• verify Sigstore public-key bundles locally instead of routing them through the unsupported sigstore-verify public-key path
• add aqua:stackrox/kube-linter@0.8.3 to the aqua cosign e2e coverage

Root Cause

stackrox/kube-linter@0.8.3 declares a Sigstore bundle plus a long-lived cosign public key. mise downloaded the bundle but treated it as keyless because the key lives in aqua opts, then sigstore-verify 0.7.0 rejected verificationMaterial.publicKey with public key verification not yet supported.

Validation

• cargo check -p mise-sigstore
• cargo build
• ./target/debug/mise install aqua:stackrox/kube-linter@0.8.3 with clean temp MISE_* dirs
• ./target/debug/mise run test:e2e e2e/backend/test_aqua_cosign

---

Note

Medium Risk
Changes signature verification paths for Aqua cosign bundles by adding a new local verification flow for verificationMaterial.publicKey, which could cause false accept/reject if bundle parsing or signature checks are incorrect.

Overview
Adds support for Aqua cosign bundle configurations that supply a public key via cosign.opts --key, downloading that key and using verify_cosign_signature_with_key when verifying bundles.

Updates mise-sigstore to locally verify Sigstore bundles whose verificationMaterial is a public key (including message-signature and DSSE forms) instead of routing them through sigstore-verify’s unsupported public-key bundle path.

Extends the Aqua cosign E2E test to cover a real public-key bundle case (aqua:stackrox/kube-linter@0.8.3).

^{Reviewed by Cursor Bugbot for commit e9aefc4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes aqua cosign verification for packages like stackrox/kube-linter@0.8.3 that declare a Sigstore bundle alongside a long-lived public key in cosign.opts. Previously, the bundle was handled as keyless and rejected by sigstore-verify 0.7.0 because verificationMaterial.publicKey is unsupported there.

• aqua.rs: The bundle download path now inspects cosign.opts for a --key <url> value; if found, it downloads the key and routes verification through verify_cosign_signature_with_key instead of the keyless verify_cosign_signature.
• mise-sigstore/lib.rs: verify_cosign_signature_with_key gains a VerificationMaterialContent::PublicKey early-return branch that calls a new verify_public_key_bundle helper; this helper runs validate_bundle_with_options, detects the key type (Ed25519 / ECDSA-P256), then verifies the signature via the appropriate verify_signature / verify_signature_prehashed path.
• test_aqua_cosign: Adds an e2e test case for kube-linter@0.8.3 that installs the tool and asserts "Cosign verified" appears in the output.

Confidence Score: 4/5

Safe to merge for the intended use case; the new local-verification path is isolated and well-guarded by the VerificationMaterialContent::PublicKey check.

The new verify_public_key_bundle function introduces hand-rolled crypto verification logic in a security-sensitive path. The MessageSignature arm correctly binds the artifact, but the DsseEnvelope arm and require_inclusion_proof strictness have open questions from prior review rounds not yet resolved.

crates/mise-sigstore/src/lib.rs — the new verify_public_key_bundle function, particularly the DsseEnvelope arm and the validate_bundle_with_options call.

Important Files Changed

Filename	Overview
crates/mise-sigstore/src/lib.rs	Adds verify_public_key_bundle to handle Sigstore bundles with verificationMaterial.PublicKey; routes detection before the existing tlog path. Crypto logic in MessageSignature arm correctly binds artifact via prehashed or raw-bytes verification. DsseEnvelope arm and inclusion-proof strictness have open concerns noted in prior review threads.
src/backend/aqua.rs	New cosign_opt_value helper correctly extracts --key from opts using windows(2); bundle path now downloads the key and delegates to verify_cosign_signature_with_key when a key URL is present. Clean, minimal change.
e2e/backend/test_aqua_cosign	Extends existing aqua cosign e2e test with kube-linter@0.8.3 to exercise the new public-key bundle path; follows the same pattern as the existing envsense test, checking for Cosign verified in output.

_{Reviews (2): Last reviewed commit: "fix(aqua): support cosign public-key bun..." | Re-trigger Greptile}

[gemini-code-assist]

Code Review

This pull request adds native Sigstore verification for public key bundles by introducing the verify_public_key_bundle function in the mise-sigstore crate and updating the Aqua backend to handle public key downloads. The implementation supports both message signatures and DSSE envelopes. Reviewer feedback suggests making the inclusion proof requirement conditional based on the bundle content and improving the CLI option parsing to support the --flag=value format.

I am having trouble creating individual review comments. Click here to see my feedback.

crates/mise-sigstore/src/lib.rs (458)

Hardcoding require_inclusion_proof: true might be too restrictive for some valid Sigstore bundles that do not include transparency log entries (e.g., those created with --tlog=false). To maintain consistency with the keyless verification path in verify_bundle, consider checking if the bundle actually contains an inclusion proof before requiring it.

require_inclusion_proof: bundle.has_inclusion_proof(),

src/backend/aqua.rs (2528-2532)

The current implementation of cosign_opt_value only handles flags and values as separate elements in the options list (e.g., ["--key", "val"]). It will fail to find options provided in the --flag=value format (e.g., ["--key=val"]), which is also common in CLI usage. Consider updating the helper to support both formats for better compatibility with various aqua registry configurations.

fn cosign_opt_value<'a>(opts: &'a [String], flag: &str) -> Option<&'a str> {
    opts.iter()
        .find_map(|opt| opt.strip_prefix(flag)?.strip_prefix('='))
        .or_else(|| {
            opts.windows(2)
                .find(|pair| pair[0] == flag)
                .map(|pair| pair[1].as_str())
        })
}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.11 x -- echo	21.7 ± 0.8	19.5	25.6	1.00
mise x -- echo	22.1 ± 1.0	20.2	27.7	1.02 ± 0.06

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.11 env	21.1 ± 0.7	19.7	23.6	1.00
mise env	21.2 ± 0.8	19.7	25.5	1.01 ± 0.05

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.11 hook-env	22.2 ± 0.7	20.8	26.3	1.00
mise hook-env	22.4 ± 0.7	20.9	25.0	1.01 ± 0.05

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.5.11 ls	17.9 ± 0.7	16.2	21.1	1.00
mise ls	18.4 ± 0.7	16.8	21.0	1.03 ± 0.06

xtasks/test/perf

Command	mise-2026.5.11	mise	Variance
install (cached)	140ms	142ms	-1%
ls (cached)	64ms	65ms	-1%
bin-paths (cached)	67ms	67ms	+0%
task-ls (cached)	130ms	130ms	+0%