[jdx]

https://entire.io/gh/jdx/mise/trails/314

mise self-update now verifies the release's signed packslip before replacing the executable. Releases from v2026.9.3 onward must provide a valid manifest: verification checks the archive digest and size, the selected version, the release workflow, and transparency-log evidence. The existing embedded archive signature remains required too.

The trust anchor is mise's immutable GitHub repository ID, 586920414, checked against the signing certificate. The same repository can move between organizations or change its name; a different repository taking over its former name is rejected. Custom mirrors must preserve the original signed manifest and archives rather than supplying their own signer.

The minimum release age also applies to the verified log timestamp, including automatic updates. Explicit version pins bypass the delay. Older releases without a packslip remain installable with the existing signature verification. Missing or invalid manifests for modern releases fail without replacing mise; download progress is retained.

Adds real replacement coverage on Linux, macOS, and Windows: a shared integration test starts each case from a disposable copy of the CI build, installs current, first-packslip, and legacy releases, checks the binary changed, and executes the result. The CI binary itself remains untouched. Offline tests verify a published mise manifest and cover tampering, version/age mismatches, repository renames/transfers, wrong or missing repository IDs, and the legacy boundary.

Stacked on #13783 (native updater), which is stacked on #13782 (release-age policy).

Validation: 26 focused self-update tests, strict workspace/all-feature/all-target Clippy, lint, build, and macOS end-to-end tests for real replacement and release-age selection passed. Linux and Windows replacement runs are wired into CI. The test workflow also runs for stacked PRs targeting codex/** branches.

AI-assisted — Tool: Codex; model: openai/unavailable; version: unavailable.

---

Note

High Risk
Changes the self-update trust path and binary replacement gate for all users on modern releases; misconfiguration or mirror issues could block updates, though failures are designed not to replace the running binary.

Overview
mise self-update now requires a valid packslip (packslip.sigstore.json) for releases v2026.9.3+, in addition to the existing zipsign archive check. Before replacing the running binary, it verifies the manifest against the downloaded archive, the selected version, the release workflow signer, and the Sigstore transparency-log timestamp. Trust is pinned to GitHub repository ID 586920414, so renames/transfers of the real repo still work while a name-squatter cannot substitute releases. Missing or invalid manifests for modern releases abort without touching the install; 2026.9.2 and older can still update with signature-only verification.

Minimum release age now uses the verified log time for unpinned and automatic updates (run_with_age_policy); pinning an explicit version skips that cutoff. Windows mise-shim refresh runs the same packslip check on the release zip.

Testing & CI: shared e2e/fixtures/self_update.py exercises real GitHub downloads against disposable copies (packslip, first packslip, and legacy releases) on Linux/macOS e2e and Windows Pester; macOS unit job runs cli/test_self_update_install. PR workflows also run for codex/** branches. Docs describe packslip behavior and mirror requirements.

^{Reviewed by Cursor Bugbot for commit 8da58f1. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features
  • Self-updates now verify release manifests and signatures for supported releases before replacing the installed version. Automatic updates also enforce the configured minimum release age; installing a specific version bypasses that delay.
  • Invalid or missing required release verification data prevents an update from replacing mise.
• Documentation
  • Updated the installation guide with release verification details, minimum-age behavior, and mirror requirements.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 8e72e691-6817-4a09-949e-a052d609af84

📥 Commits

Reviewing files that changed from the base of the PR and between 78bae8a and 5a44da1.

📒 Files selected for processing (10)

• .github/workflows/test-impl.yml
• .github/workflows/test.yml
• docs/installing-mise.md
• e2e-win/self_update_install.Tests.ps1
• e2e/cli/test_self_update_install
• e2e/fixtures/self_update.py
• src/cli/self_update.rs
• src/cli/self_update/packslip.rs
• test/fixtures/self-update/mise-v2026.9.16.sigstore.json
• test/fixtures/self-update/mise-v2026.9.3.sigstore.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds cryptographic verification to the self-update mechanism.

The PR appears safe to merge based on the current review.

Summary

This PR adds signed-packslip verification to self-update while retaining archive-signature verification.

• Requires packslips for releases from v2026.9.3 and checks repository identity, release workflow, archive, version, and transparency-log evidence.
• Adds replacement tests and documents the verification and mirror requirements.

_{Reviews (3) · Last reviewed commit: "ci: name the self-update integration tes..."}