[jdx]

https://entire.io/gh/jdx/mise/trails/55

Follow-up to #13403, which merged while this case was still under review.

#13398 made sidecar digests cover normalized graph text, and #13403 kept
accepting the raw-CRLF digests older versions recorded on Windows and taught
mise to heal them. One path was left behind: when a sidecar is published to a
new directory — a lockfile moved or renamed, a backend variant, a sidecar
restored after being pruned — SidecarWrites::prepare writes the freshly
normalized bytes there but recorded graph.identity(), the digest the entry
arrived with.

For an entry carrying a legacy CRLF digest, the result pinned bytes that exist
nowhere: the new directory holds LF text, whose normalized digest and raw
digest both differ from what was written to mise.lock. That relocated entry
could not be verified on any platform, and because the returned pointer has an
empty cache cell, no later save could heal it either.

The digest now covers the graph that was just verified and published, so a
relocated sidecar is pinned to the bytes actually on disk. Entries that were
already normalized are unaffected — for them the two values are equal by
definition.

Test

src/lockfile/graph.rs extends the legacy-digest unit test: after the stale
entry heals in place, it saves the lockfile to a different directory and
asserts the republished sidecar is LF, the new entry records the normalized
digest rather than the legacy one, and reading that lockfile back loads the
graph. Reverting the one-line change fails this test.

cargo test --bin mise lockfile (202 tests), mise run lint, and
cargo clippy --workspace --all-features --all-targets -- -D warnings pass.

🤖 Generated with Claude Code

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5; version: 2.1.270.

---

Note

Medium Risk
Touches lockfile sidecar publish and digest pinning; wrong behavior broke verification for relocated entries, but the change is narrow and covered by an extended unit test.

Overview
Fixes dependency sidecar digests when a lockfile is saved to a new path (move, rename, variant, restore). After prepare writes LF-normalized sidecar bytes, the stored digest now comes from digest_text of the published graph instead of reusing graph.identity() from the incoming entry.

That stops legacy CRLF digests from being copied onto relocated sidecars whose on-disk text no longer matches—entries that previously could not be verified and could not self-heal on later saves. In-place saves for already-normalized entries are unchanged.

The legacy CRLF digest test now saves to another directory and asserts the new lockfile records the normalized digest, the sidecar has no \r, and the graph loads.

^{Reviewed by Cursor Bugbot for commit 9fd08e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • Regenerated sidecar entries now use digests based on normalized graph content.
  • Relocated sidecars now publish consistently normalized line endings and record the matching digest.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 5b29b184-76e7-4977-ba86-3bc372022a33

📥 Commits

Reviewing files that changed from the base of the PR and between b8eb2a1 and 9fd08e4.

📒 Files selected for processing (1)

• src/lockfile/graph.rs

Included review availability: Your plan provides up to 10 included reviews per hour; 5 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

Sidecar digest normalization

Layer / File(s)	Summary
Normalized sidecar publication and CRLF validation src/lockfile/graph.rs	SidecarWrites::prepare records the digest of normalized graph text. The legacy CRLF test verifies LF-normalized output, the normalized digest, and successful loading after relocation.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: nettlesh

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: updating relocated dependency sidecar pinning to use the bytes that were written.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge and correctly restores the digest invariant for relocated sidecars.

Summary

This PR corrects relocated lockfile sidecars so their recorded digest covers the normalized graph bytes written to the new location rather than preserving a legacy digest.

• Computes the returned sidecar digest from the graph text being published.
• Adds regression coverage for relocating a sidecar carrying a legacy CRLF digest.
• Verifies the relocated sidecar uses LF bytes, records the normalized digest, and remains loadable.

_{Reviews (1) · Last reviewed commit: "fix(lock): pin republished sidecars to t..."}

[github-actions]

Instruction counts

Nothing was compared, and so nothing was gated. No series appears on both sides: either the base has no measurements recorded, or the two were measured on different runner classes, which are deliberately not comparable — counts shift between machine types by more than a real regression does.

New, nothing to compare against: env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, hook-env on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, ls on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, registry on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143, startup on jdx-perf-v1-ubuntu24.04-x64-mise-rust1.97.1-img5263c143

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{9fd08e45d9a2 vs b8eb2a129d9b · measured on the runner, not pushed to the history.}