fix - be able to work with regex in attestation check by monotek · Pull Request #9327 · jdx/mise

monotek · 2026-04-23T18:28:20Z

Fixes failing install if regex is used in github url of aqua registry.
See error below:

mise use updatecli
[email protected]       verify GitHub artifact attestations                                                                                                                                                                                                                                                                 ◞
mise ERROR Failed to install aqua:updatecli/updatecli@latest: GitHub artifact attestations verification failed: Verification failed: Workflow verification failed: expected 'updatecli/updatecli/\.github/workflows/release\.yaml', found certificate: Some("https://github.com/updatecli/updatecli/.github/workflows/release.yaml@refs/tags/v0.116.3"), provenance: Some(".github/workflows/release.yaml")
mise ERROR Run with --verbose or MISE_VERBOSE=1 for more information

gemini-code-assist

Code Review

This pull request introduces a regex unescaping mechanism for signer_workflow strings in the Aqua backend to ensure compatibility with string-based verification tools. The feedback suggests optimizing the unescape_regex_literal function by using Cow<'_, str> to avoid unnecessary string allocations when no backslashes are present in the input.

gemini-code-assist · 2026-04-23T18:31:33Z

+fn unescape_regex_literal(pattern: &str) -> String {
+    let mut out = String::with_capacity(pattern.len());
+    let mut chars = pattern.chars();
+    while let Some(c) = chars.next() {
+        if c == '\\' {
+            if let Some(next) = chars.next() {
+                out.push(next);
+            } else {
+                out.push(c);
+            }
+        } else {
+            out.push(c);
+        }
+    }
+    out
+}


The unescape_regex_literal function can be optimized to avoid unnecessary string allocations when the input pattern does not contain any backslashes. Since many workflow paths may not use regex escapes, returning a Cow<'_, str> allows the function to return a borrowed reference in the common case.

fn unescape_regex_literal(pattern: &str) -> Cow<'_, str> { if !pattern.contains('\\') { return Cow::Borrowed(pattern); } let mut out = String::with_capacity(pattern.len()); let mut chars = pattern.chars(); while let Some(c) = chars.next() { if c == '\\' { if let Some(next) = chars.next() { out.push(next); } else { out.push(c); } } else { out.push(c); } } Cow::Owned(out) }

greptile-apps · 2026-04-23T18:33:44Z

Greptile Summary

This PR fixes attestation verification failures for aqua registry packages (e.g. updatecli) whose signer_workflow field is stored as a regex pattern (\.github/workflows/release\.yaml) rather than a plain path. The fix introduces unescape_regex_literal — with a zero-allocation fast path via Cow::Borrowed — and applies it before passing the value to verify_attestation, which uses str::contains() internally. The previous comment requesting unit tests has been addressed with seven focused test cases covering the fast path, the primary use-case, escaped backslash, trailing backslash, and empty string.

Confidence Score: 5/5

Safe to merge — the fix is narrowly scoped, correctness is confirmed by the new tests, and there are no P0/P1 findings.

The change is a targeted bug fix with a well-reasoned implementation (Cow fast path, correct trailing-backslash handling), comprehensive unit tests that cover all edge cases, and no introduced regressions. The only outstanding concern (raw regex form stored in SecurityFeature) was already flagged as a P2 in a prior review comment and is not a blocker.

No files require special attention.

Important Files Changed

Filename	Overview
src/backend/aqua.rs	Adds `unescape_regex_literal` to strip regex metachar escapes before passing `signer_workflow` to `str::contains()`-based attestation verification; includes comprehensive unit tests

Sequence Diagram

sequenceDiagram
    participant Aqua Registry
    participant AquaBackend
    participant unescape_regex_literal
    participant verify_attestation

    Aqua Registry->>AquaBackend: signer_workflow = "\.github/workflows/release\.yaml" (regex form)
    AquaBackend->>unescape_regex_literal: pattern = "\.github/workflows/release\.yaml"
    Note over unescape_regex_literal: Fast path: no backslash → Cow::Borrowed<br/>Slow path: strip backslashes → Cow::Owned
    unescape_regex_literal-->>AquaBackend: ".github/workflows/release.yaml" (plain string)
    AquaBackend->>verify_attestation: signer_workflow = ".github/workflows/release.yaml"
    Note over verify_attestation: Uses str::contains(), not regex
    verify_attestation-->>AquaBackend: Ok(true) / Err(...)

_{Reviews (3): Last reviewed commit: "fix - be able to work with regex in atte..." | Re-trigger Greptile}

Signed-off-by: André Bauer <[email protected]>

@jdx

monotek force-pushed the be-able-to-use-regex-in-aqua-registry-attestation branch from 84d4b93 to ef73dfa Compare April 23, 2026 18:29

gemini-code-assist Bot reviewed Apr 23, 2026

View reviewed changes

greptile-apps Bot reviewed Apr 23, 2026

View reviewed changes

Comment thread src/backend/aqua.rs Outdated

monotek force-pushed the be-able-to-use-regex-in-aqua-registry-attestation branch from ef73dfa to 7ca6846 Compare April 23, 2026 18:36

fix - be able to work with regex in attestation check

9517160

Signed-off-by: André Bauer <[email protected]>

monotek force-pushed the be-able-to-use-regex-in-aqua-registry-attestation branch from 7ca6846 to 9517160 Compare April 23, 2026 18:49

monotek marked this pull request as ready for review April 23, 2026 19:12

jdx merged commit 21bd622 into jdx:main Apr 23, 2026
34 checks passed

mise-en-dev mentioned this pull request Apr 23, 2026

chore: release 2026.4.20 #9311

Merged

BrewTestBot mentioned this pull request Apr 24, 2026

mise 2026.4.20 Homebrew/homebrew-core#279288

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix - be able to work with regex in attestation check#9327

fix - be able to work with regex in attestation check#9327
jdx merged 1 commit intojdx:mainfrom
monotek:be-able-to-use-regex-in-aqua-registry-attestation

monotek commented Apr 23, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Apr 23, 2026

Uh oh!

greptile-apps Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

monotek commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Apr 23, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

monotek commented Apr 23, 2026 •

edited

Loading

greptile-apps Bot commented Apr 23, 2026 •

edited

Loading