Cannot install gleam@latest (and older ones, too) due to github artifact attestation verification failure

[benjaminboruff]

I installed gleam 1.15.2 last week, then a couple of days ago gleam 1.15.3 and 1.15.4 were released, but mise up could not update due to attestation verification failure. I used gh attestation verify --owner gleam-lang --predicate-type "https://spdx.dev/Document/v2.3" ./Downloads/gleam-v1.15.4-x86_64-unknown-linux-musl.tar.gz to successfully verify a downloaded version just fine; but mise itself cannot verify the released binaries. Any info about what to do other than turning off the verification and doing it by hand?
Thanks!

mise_doctor_out.txt
mise_gleam_attestations_error.txt

[jdx]

I also recently saw this happen on an old version of mise with old releases. I think it was a github blip.

[joladev]

I'm having the same issue

➜  mise install
gleam@1.15.4       verify GitHub artifact attestations                                                                                                                                     ◠
mise ERROR Failed to install aqua:gleam-lang/gleam@1.15.4: GitHub artifact attestations verification failed: No attestations found
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

using latest mise

[benjaminboruff]

I'm also using the latest mise as of today: 2026.4.11 linux-x64 (2026-04-13). I've reinstalled mise, but that didn't help.
I wonder if there could be something wrong with the gleam repo, since, for me, only gleam is a problem. Or maybe github could be having an issue ...

[jdx]

github made some api changes. My top priority is fixing this right now.

[jdx]

still working on it, it's a bit of a doozy since my own infra is failing with the old mise binaries. You can use MISE_GITHUB_ATTESTATIONS=0 in the meantime to bypass this

[jdx]

Fixed! Sorry about this one, I'm planning to move to the much better supported sigstore-rust crate by @wolfv soon which should follow the spec much better to avoid future issues like this.