registry: pin packslip release and index workflows

[jdx]

Configure the existing Packslip registry entry with packslip.dev and separate pins for release bundles (release.yml@) and the signed index (packslip-releases.yml@). Users can install with mise use -g packslip or [tools] packslip = "latest" without supplying signer options. This restricts the broad workflow trust reported on #12839, excluding CI signing jobs.

Add list_identity_prefix to select the vendor index signer separately while retaining the bundle policy's OIDC issuer. Include the option in listing cache keys and persisted installation options, reject invalid combinations, and update the CLI example, TOML configuration, documentation, and registry-shorthand smoke test. Configured stampers keep their own policies.

Workflow identities contain @, so also fix CLI argument parsing to distinguish that character inside backend options from the version separator. Regression cases cover scoped package names, quoted brackets, nested arrays, and version paths containing brackets.

Validation:

• 11 Packslip unit tests and 20 CLI argument tests passed.
• mise run test:e2e 'e2e/backend/test_packslip$' 'e2e/backend/test_packslip_resources$' passed, including live 1.1.1 resolution and installation with mise use -g packslip, 0.2.0 installation/lockfile fixture checks, rejection of CI signer pins, and rejection of the index signer for release bundles.
• cargo clippy --workspace --all-features --all-targets -- -D warnings passed.
• Scoped hk checks passed: Rust formatting, shellcheck, shfmt, Taplo, Markdown lint, and Prettier. Documentation TOML examples parse successfully.

Local mbx 1.5.0 emitted target-path cache mapping warnings; equivalent Cargo validation passed after resetting generated CMake state from a compiler-wrapper switch. No repository build configuration changes.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.

---

Note

High Risk
Changes Packslip signer verification and registry trust policy; a parsing or policy bug could reject valid installs or weaken which workflows are accepted.

Overview
Tightens Packslip trust so release bundles and the signed release index can use different GitHub Actions workflow identities, closing the gap where a CI job could satisfy the same pin as release publishing.

Adds list_identity_prefix, applied only when verifying vendor release lists (well-known and GitHub .well-known lists) while bundle verification keeps identity / identity_prefix. The option is wired into install/listing cache keys, validated (non-empty, requires issuer, incompatible with pubkey), and documented.

The packslip registry entry now resolves via packslip:packslip.dev with registry-supplied pins: release.yml@ for bundles and packslip-releases.yml@ for the index, so users can run mise use -g packslip without hand-configuring signers. Docs and e2e cover the canonical quickstart and that wrong pins fail even with a warm version cache.

CLI parsing is updated so @ inside bracketed backend options (common in workflow URLs) is not treated as a version separator; nested brackets and quoted values are handled when splitting options from an optional @version suffix.

^{Reviewed by Cursor Bugbot for commit 6911073. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• New Features

  • Added support for configuring a separate signing identity prefix for verified release lists.
  • Packslip registry entries now use the canonical project name and support signer and issuer verification policies.
  • Verification rejects invalid or conflicting signing-policy combinations.

• Bug Fixes

  • Improved parsing of tool references with bracketed options, URLs, scoped names, nested brackets, and @ characters.

• Documentation

  • Updated Packslip installation and version-listing examples.
  • Documented release-list signing identity configuration.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 871f207d-9055-4ffa-baae-bd0eb630c642

📥 Commits

Reviewing files that changed from the base of the PR and between 3786950 and 6911073.

📒 Files selected for processing (6)

• docs/dev-tools/backends/packslip.md
• e2e/backend/test_packslip
• registry/packslip.toml
• src/backend/packslip.rs
• src/cli/args/backend_arg.rs
• src/cli/args/tool_arg.rs

---

📝 Walkthrough

Walkthrough

The PR adds separate Packslip release-list signer policies, supports canonical registry resolution, improves bracketed backend option parsing, updates documentation, and expands unit and end-to-end coverage.

Changes

Packslip identity and parsing

Layer / File(s)	Summary
Bracketed option suffix parsing src/cli/args/tool_arg.rs	Backend options now preserve embedded @ characters and parse only a trailing version suffix after the closing bracket. Tests cover nested brackets, URLs, identities, scoped packages, and path versions.
Release-list identity policy src/backend/packslip.rs	Packslip derives a separate release-list identity policy while preserving the issuer. Invalid, key-based, issuer-less, empty, and non-string configurations are rejected.
Canonical Packslip workflow registry/packslip.toml, docs/dev-tools/backends/packslip.md, e2e/backend/test_packslip	The registry uses packslip:packslip.dev. Documentation and end-to-end tests use the canonical packslip name and validate signer policy behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant PackslipBackend
  participant PinForReleaseList
  participant ReleaseListVerifier
  CLI->>PackslipBackend: resolve packslip options
  PackslipBackend->>PinForReleaseList: derive release-list policy
  PinForReleaseList-->>PackslipBackend: return issuer and identity prefix
  PackslipBackend->>ReleaseListVerifier: verify signed release list
  ReleaseListVerifier-->>CLI: return verified versions

Loading

Poem

A rabbit parsed brackets with care
Keeping each at-sign in air
Packslip signed lists
With trusted prefixes
And canonical names everywhere

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR separates Packslip release-list signer trust from release-bundle signer trust and updates the canonical Packslip registry entry accordingly.

• Adds and validates list_identity_prefix, retaining the bundle policy’s OIDC issuer.
• Includes the new policy option in version-list cache identity and persisted installation options.
• Updates tool-argument parsing so @ inside nested or quoted backend options is not mistaken for a version separator.
• Updates documentation, registry metadata, unit coverage, and the Packslip end-to-end workflow.

Confidence Score: 5/5

The PR appears safe to merge, with signer separation, cache partitioning, registry option propagation, and parser behavior covered by focused tests.

No actionable failures remain: release lists and bundles use distinct intended policies, configured stampers remain isolated, changed list policies do not share local cache entries, and bracket-aware parsing preserves valid option values and version suffixes.

Important Files Changed

Filename	Overview
src/backend/packslip.rs	Adds a separately derived release-list verification policy, validates incompatible configurations, and incorporates the option into listing and installation identities.
src/cli/args/backend_arg.rs	Adds balanced, quote-aware inline-option splitting that can preserve a following version suffix.
src/cli/args/tool_arg.rs	Uses the bracket-aware split before ordinary @ parsing and adds regression coverage for scoped names, nested arrays, quotes, and bracketed version paths.
registry/packslip.toml	Makes packslip.dev the canonical Packslip backend and assigns distinct workflow identities to release bundles and the signed index.
e2e/backend/test_packslip	Exercises bare-name installation, persisted project identity, cache-policy separation, and rejection of unauthorized workflow signers.
docs/dev-tools/backends/packslip.md	Documents the registry-backed quickstart and the constraints and scope of list_identity_prefix.

_{Reviews (1): Last reviewed commit: "registry: pin packslip release and index..." | Re-trigger Greptile}