Trusted configs don't stay trusted when `mise trust` is run on another config #4499

cj-wong · 2025-02-23T08:20:52Z

cj-wong
Feb 23, 2025

All my formerly trusted configs are now untrusted.

Steps:

mise trust in one directory
cd somewhere else
mise trust here
cd -
I need to use mise trust again.

Might be helpful info?: I use stow to manage my dotfiles. This includes the global mise config file, read from ~/.config/mise/config.toml as a sym-link to my dotfiles directory.

mise doctor:

version: 2025.2.7 linux-x64 (2025-02-19)
activated: yes
shims_on_path: no

build_info:
  Target: x86_64-unknown-linux-gnu
  Features: DEFAULT, NATIVE_TLS, OPENSSL, SELF_UPDATE
  Built: Wed, 19 Feb 2025 21:09:41 +0000
  Rust Version: rustc 1.84.1 (e71f9a9a9 2025-01-27)
  Profile: release

shell:
  /bin/bash
  GNU bash, version 5.2.15(1)-release (x86_64-pc-linux-gnu)
  Copyright (C) 2022 Free Software Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

  This is free software; you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.

dirs:
  cache: ~/.cache/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  ~/.config/mise/config.toml
  ~/workspace/dotfiles/.mise/config.toml

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  core
  dotnet
  gem
  go
  npm
  pipx
  spm
  ubi
  vfox

plugins:
  poetry  https://github.com/mise-plugins/mise-poetry.git#80d807b

toolset:
  aqua:astral-sh/[email protected]
  asdf:[email protected]
  core:[email protected]
  core:[email protected]
  core:[email protected]
  go:github.com/caddyserver/xcaddy/cmd/[email protected]
  ubi:charmbracelet/[email protected]
  ubi:cheat/[email protected]
  ubi:houseabsolute/[email protected]

path:
  ~/.cache/pypoetry/virtualenvs/dotfiles-ktEfzE9F-py3.10/bin
  ~/.local/share/mise/installs/poetry/1.8.5/bin
  ~/.local/share/mise/installs/python/3.10.14/bin
  ~/.local/share/mise/installs/go/1.23.4/bin
  ~/.local/share/mise/installs/go-github-com-caddyserver-xcaddy-cmd-xcaddy/0.4.4/bin
  ~/.local/share/mise/installs/ubi-charmbracelet-glow/2.0.0/bin
  ~/.local/share/mise/installs/ubi-cheat-cheat/4.4.2/bin
  ~/.local/share/mise/installs/node/20.18.1/bin
  ~/.local/share/mise/installs/ubi/0.2.4/bin
  ~/.local/share/mise/installs/uv/0.5.26/uv-x86_64-unknown-linux-musl
  ~/.local/bin
  ~/bin
  /usr/local/sbin
  /usr/local/bin
  /usr/sbin
  /usr/bin
  /sbin
  /bin
  /usr/games
  /usr/local/games
  ~/.local/bin

env_vars:
  MISE_SHELL=bash
  MISE_POETRY_AUTO_INSTALL=1

settings:
  experimental    true ~/.config/mise/config.toml
  paranoid        true ~/.config/mise/config.toml
  python_compile  true ~/.config/mise/config.toml

No problems found

Answered by tdragon

Mar 17, 2026

there is a PR with proposed fix: #8628

View full answer

blackmad-cradle · 2025-05-14T07:36:55Z

blackmad-cradle
May 14, 2025

For me this seems like mise trust doesn't work at all, even without changing dirs

╰─ cd ~/
mise WARN  Config files in /Users/blackmad/.config/mise/config.toml are not trusted.
Trust them with `mise trust`. See https://mise.jdx.dev/cli/trust.html for more information.
╭─ ~                                                                    ✔  at 09:36:19 AM 
╰─ mise trust /Users/blackmad/.config/mise/config.toml
mise trusted /Users/blackmad
╭─ ~                                                                    ✔  at 09:36:23 AM 
╰─ mise trust --show
mise No trusted config files found.

Output of mise doctor

version: 2025.5.3 macos-arm64 (2025-05-09)
activated: yes
shims_on_path: no

build_info:
  Target: aarch64-apple-darwin
  Features: DEFAULT, NATIVE_TLS, OPENSSL, SELF_UPDATE
  Built: Fri, 9 May 2025 21:43:09 +0000
  Rust Version: rustc 1.86.0 (05f9846f8 2025-03-31)
  Profile: release

shell:
  /bin/zsh
  zsh 5.9 (arm64-apple-darwin24.0)

dirs:
  cache: ~/Library/Caches/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  ~/.config/mise/config.toml

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  core
  dotnet
  gem
  go
  npm
  pipx
  spm
  ubi
  vfox

plugins:
  pre-commit  https://github.com/jonathanmorley/asdf-pre-commit.git#26bfc42
  terraform   https://github.com/mise-plugins/mise-hashicorp.git#22eb1c4

toolset:
  core:[email protected]

path:
  ~/.local/share/mise/installs/node/22.15.0/bin
  /opt/homebrew/bin
  /opt/homebrew/sbin
  /usr/local/bin
  /System/Cryptexes/App/usr/bin
  /usr/bin
  /bin
  /usr/sbin
  /sbin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin
  ~/.local/bin
  ~/.vscode/extensions/ms-python.debugpy-2025.8.0-darwin-arm64/bundled/scripts/noConfigScripts
  ~/Library/Application Support/Code/User/globalStorage/github.copilot-chat/debugCommand

env_vars:
  MISE_SHELL=zsh

settings:
  experimental  true ~/.config/mise/config.toml

No problems found

0 replies

tikhdm · 2026-03-16T11:22:39Z

tikhdm
Mar 16, 2026

I think I tracked down the root cause of this issue. It's a bug in paranoid mode's hash file naming.

The bug is in config_file/mod.rs in the trust() function:

let trust_hash_path = hashed_path.with_extension("hash");

The trust symlink filename is unique per config file — e.g., mydir-mise.toml-a1b2c3d4e5f67890 (the suffix is a SipHash of the full canonicalized path). However, PathBuf::with_extension("hash") treats .toml-a1b2c3d4e5f67890 as the extension and replaces it all with .hash, producing just mydir-mise.hash.

This means all config files whose parent directory shares the same leaf name collide on a single hash file. For example, given a monorepo with multiple subdirectories named infra/:

projects/
  service-a/infra/mise.toml
  service-b/infra/mise.toml
  service-c/infra/mise.toml

The trust symlinks are correctly unique:

infra-mise.toml-a1b2c3d4e5f67890 -> .../service-a/infra/mise.toml
infra-mise.toml-1234abcd5678ef90 -> .../service-b/infra/mise.toml
infra-mise.toml-deadbeef12345678 -> .../service-c/infra/mise.toml

But there's only one infra-mise.hash file. Trusting any one of these overwrites the SHA256 hash for all the others, making them appear untrusted.

Suggested fix: append .hash instead of replacing the extension, so the hash filename preserves the unique SipHash suffix:

// Before (broken):
let trust_hash_path = hashed_path.with_extension("hash");

// After (fixed):
let mut hash_name = hashed_path.file_name().unwrap().to_os_string();
hash_name.push(".hash");
let trust_hash_path = hashed_path.with_file_name(hash_name);

This would produce infra-mise.toml-a1b2c3d4e5f67890.hash instead of infra-mise.hash, keeping each config's hash file unique.

The is_trusted() check would need the same change where it reads the hash file.

Repro: enable paranoid = true, have two+ directories with the same leaf name (e.g., infra/) each containing a mise.toml with different content, trust one, cd to the other — it will show as untrusted.

1 reply

tdragon Mar 17, 2026

there is a PR with proposed fix: #8628

Answer selected by cj-wong

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Trusted configs don't stay trusted when `mise trust` is run on another config #4499

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Trusted configs don't stay trusted when mise trust is run on another config #4499

Uh oh!

cj-wong Feb 23, 2025

Replies: 2 comments · 1 reply

Uh oh!

blackmad-cradle May 14, 2025

Uh oh!

tikhdm Mar 16, 2026

Uh oh!

tdragon Mar 17, 2026

Trusted configs don't stay trusted when `mise trust` is run on another config #4499

cj-wong
Feb 23, 2025

Replies: 2 comments 1 reply

blackmad-cradle
May 14, 2025

tikhdm
Mar 16, 2026