mise use -g aube fails with GitHub artifact attestation verification failed

[zzJinux]

❯ mise use -g aube

mise WARN  mise-versions endpoint=github_release repo=endevco/aube tag=latest outcome=invalid_asset_urls fallback=true
mise WARN  mise-versions endpoint=github_release repo=endevco/aube tag=v1.18.2 outcome=invalid_asset_urls fallback=true
aube@1.18.2            verify GitHub artifact attestations                                                                                                                         ◠
mise ERROR Failed to install aqua:endevco/aube@latest: GitHub artifact attestations verification failed: Verification failed: Verification failed: Workflow verification failed: expected 'endevco/aube/.github/workflows/release.yml', found certificate identity: "https://dotcom.releases.github.com"; Verification failed: Workflow verification failed: expected 'endevco/aube/.github/workflows/release.yml', found certificate identity: "https://github.com/jdx/aube/.github/workflows/release.yml@refs/heads/main"
mise ERROR Version: 2026.6.1 macos-arm64 (2026-06-06)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

Seems like due to the repo migration

[methbkts]

Failed to install aqua:endevco/aube@latest

I assume it will work when jdx/mise-versions will be updated from aqua:endevco/aube@latest to aqua:jdx/aube@latest

Refs:

• versions: migrate aube from @endevco to @jdx jdx/mise-versions#229
• versions: migrate pitchfork from @endevco to @jdx jdx/mise-versions#230

[jdx]

this is wrong, it's failing because of attestations which this has nothing to do with

[methbkts]

jdx/mise#10285 fixed the issue

[jdx]

I moved the repo from endevco to jdx and for some reason that deleted all of the attestation info. It should work if you install the latest aube version.

[methbkts]

As I said, mise-versions need to be updated #852 (comment)

[jdx]

I doubt that will fix anything

[jdx]

you may need to update to 2026.6.2 and run mise uninstall --all aube because the aqua formula has a fix for the attestations

[tomocrafter]

running mise uninstall --all aube and then mise use -g aube fixed this. thank you @jdx! (I didn't know --all was the option, good to know)
maybe it is better to defaulting to all if no version is specified like aube@1.x.x?

[iki]

mise install -f aube solved that for me with current mise 2026.6.2

[iki]

@jdx Today with aube@2.2.9 update via mise up returned:

aqua:jdx/aube@latest: GitHub artifact attestations verification failed: Verification failed: Workflow verification failed: expected 'jdx/aube/.github/workflows/release.yml', found certificate identity: "https://dotcom.releases.github.com"; Workflow verification failed: expected 'jdx/aube/.github/workflows/release.yml', found certificate identity: "https://github.com/aubepkg/aube/.github/workflows/release.yml@refs/heads/main"

⚠️ Btw, do not try to fix it with mise install -f aube above, it needs fixing the attestations and the command will only uninstall all aube-dependent tools and then fail to install aube, like for me:

uninstall npm:@fission-ai/openspec@1.11.0 remove C:\Users\iki\AppData\Local\Temp\mise\openspec\1.11.0                                                          ✔
uninstall aqua:protocolbuffers/protobuf/protoc@36.0 remove C:\Users\iki\AppData\Local\Temp\mise\protobuf\36.0                                                  ✔
uninstall pipx:hyperextract@0.4.0 remove C:\Users\iki\AppData\Local\Temp\mise\hyperextract\0.4.0                                                               ✔
uninstall github:aquaproj/registry-tool@0.5.7 remove C:\_\.mise\aqua-registry-tool\0.5.7                                                                       ✔
uninstall npm:@gmickel/gno@1.38.0 remove C:\Users\iki\AppData\Local\Temp\mise\gno\1.38.0                                                                       ✔
uninstall github:gmickel/gno@1.38.0 remove C:\Users\iki\AppData\Local\Temp\mise\gno-desktop\1.38.0                                                             ✔
uninstall aqua:anomalyco/opencode@1.18.26 remove C:\Users\iki\AppData\Local\Temp\mise\opencode\1.18.26                                                         ✔
uninstall npm:agent-browser@0.35.2 remove C:\Users\iki\AppData\Local\Temp\mise\agent-browser\0.35.2                                                            ✔
uninstall aqua:google-antigravity/antigravity-cli@1.1.24 remove C:\Users\iki\AppData\Local\Temp\mise\antigravity-cli\1.1.24                                    ✔
uninstall npm:@yc-software/qm@0.1.5 remove C:\Users\iki\AppData\Local\Temp\mise\qm\0.1.5                                                                       ✔
uninstall npm:hyperframes@0.8.26 remove C:\Users\iki\AppData\Local\Temp\mise\hyperframes\0.8.26                                                                ✔
uninstall github:Azure/azure-cli@2.89.1 remove C:\Users\iki\AppData\Local\Temp\mise\azure-cli\2.89.1                                                           ✔
uninstall aqua:anthropics/claude-code@2.1.258 remove C:\Users\iki\AppData\Local\Temp\mise\claude-code\2.1.258                                                  ✔
mise WARN  mise-versions endpoint=github_release repo=jdx/aube tag=latest outcome=invalid_asset_urls fallback=true
mise WARN  mise-versions endpoint=github_release repo=jdx/aube tag=v2.2.9 outcome=invalid_asset_urls fallback=true
aube@2.2.9          verify GitHub artifact attestations                                                                                                        ◠
mise ERROR Failed to install aqua:jdx/aube@latest: GitHub artifact attestations verification failed: Verification failed: Workflow verification failed: expected 'jdx/aube/.github/workflows/release.yml', found certificate identity: "https://dotcom.releases.github.com"; Workflow verification failed: expected 'jdx/aube/.github/workflows/release.yml', found certificate identity: "https://github.com/aubepkg/aube/.github/workflows/release.yml@refs/heads/main"
mise ERROR Version: 2026.9.1 windows-x64 (2026-09-02)
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

[iki]

@jdx any idea how to install the dependent tools when mise still has the non-latest aube@2.2.4?

Or even be able to update existing aube-dependent tools without getting Skipped due to failed dependency?

[jdx]

Fixed in jdx/mise#12766. mise now asks GitHub for the canonical repository name after an attestation failure caused by a transfer, rebases only the repository prefix in the existing workflow policy, and retries verification. I verified the fix end-to-end using the still-stale aqua:jdx/aube@2.2.9 entry; attestation verification, installation, and aube --version all succeeded.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.