aqua / gh attestation verify support

[scop]

aqua-registry has had support for GitHub artifact attestations for a while, but there have been no entries with that included yet.

That's going to change once aquaproj/aqua-registry#32470 is merged, probably in a few months (see aquaproj/aqua-registry#32470 (comment) and aquaproj/aqua#3157 for reasoning for the delay). I'm sure there will be more coming up once the first ones are out.

Would be nice to have support for verifying those attestations in mise, like there is for slsa-verifier and cosign.

Ref

• https://github.com/aquaproj/aqua/blob/fa86daed182397900e71c097f310b9e96742490f/json-schema/registry.json#L252-L263 (note that signer-workflow with the dash is the deprecated spelling, already slated for removal in a future version, signer_workflow is the preferred one)
• https://github.com/aquaproj/aqua/blob/fa86daed182397900e71c097f310b9e96742490f/json-schema/registry.json#L547-L549

[scop]

GH artifact attestation support is now in aqua (well has been for a while already), and an increasing number of packages with that data are being added in the registry.

[risu729]

GitHub now has immutable releases too,
https://github.blog/changelog/2025-08-26-releases-now-support-immutability-in-public-preview/

[scop]

jdx/sigstore-verification#4

[risu729]

#6332 added support for it.

[efussi]

I am getting an error when updating uv with mise 2025.9.14:

$ mise up -y
mise ERROR Failed to install aqua:astral-sh/uv@latest: 
   0: GitHub attestations verification failed for aqua:astral-sh/uv@0.8.19: API error: GitHub API returned 401 Unauthorized: {
        "message": "Bad credentials",
        "documentation_url": "https://docs.github.com/rest",
        "status": "401"
      }

Location:
   src/backend/aqua.rs:697

My token should be ok, though:

$ curl -sS https://${MISE_GITHUB_TOKEN}@api.github.com/user | jq -r .login
efussi

Do I need to set something else besides MISE_GITHUB_TOKEN?

[risu729]

It should be fixed with #6351, which will be released in the next 2025.9.15.