Mise 中文文档

外观

Paranoid mode ​

Paranoid mode requires your approval before mise loads any project config file, and again whenever that file changes. It also turns off automatic trust, including in CI, and re-verifies provenance on every install. It does not sandbox the commands you approve; see Sandboxing.

Turn it on for one command with MISE_PARANOID=1, or for every command:

sh
mise settings paranoid=true

mise settings paranoid=false turns it off. The paranoid setting is global-only, so a project cannot change it.

配置文件 ​

Paranoid mode changes the normal trust rules in these ways:

  • Every config file outside global and system config needs trust, including files that normally load without it: .tool-versions, idiomatic version files such as .nvmrc, task files, and a mise.toml that only lists tools. The exception is .miserc.toml, which still loads without trust: it can only choose which config files load, and those files need trust.
  • Trust is bound to content. mise trust stores a hash of the file, and any edit makes it untrusted again.
  • Each file is trusted on its own. Trusting mise.toml does not trust mise.local.toml beside it.
  • mise run, mise install, mise exec, mise watch and the mise daemons start, restart and register commands do not trust the config they load.
  • CI does not make config trusted, and --yes, MISE_YES=1 and CI do not answer the trust prompt. In a terminal, mise still asks.
  • Trust is not shared between git worktrees.
  • Trusting a monorepo root trusts only that file. Trust each subproject's config separately.

Read each file, then approve it. mise trust --show lists the config files from the current directory up and whether each is trusted:

sh
mise trust --show
mise trust path/to/mise.toml

For unattended runs, review the config and run mise trust before the job loads it.

These stay trusted by path, without a hash, so editing them needs no new approval:

  • configs under trusted_config_paths
  • global and system config, which is where you turn paranoid mode on

If safe mode is also on, it takes precedence: project config loads without a trust prompt because it cannot run code, and nothing is marked trusted.

Remote includes ​

A remote include must be pinned to a full lowercase commit sha (?ref= followed by 40 or 64 hex digits) or to an OCI digest (@sha256: followed by 64 lowercase hex digits), so that the hash of the trusted file covers what it pulls in. A branch, a tag or a missing ref fails to load:

toml
include = [
  "git::https://github.com/myorg/platform.git//mise.toml?ref=0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c",
]

社区插件 ​

In normal mode, installing a community plugin by short name asks for confirmation. Paranoid mode refuses instead. Unlike config trust, --yes, MISE_YES=1, CI and --force still allow the install.

A short name counts as trusted when its URL matches an asdf or vfox plugin in mise's registry, or when the plugin is in the mise-plugins GitHub organization. To install any other plugin, give its full Git URL on the command line or in [plugins]. Naming the URL is your decision to trust that source:

sh
mise plugins install example https://github.com/example/asdf-example

Provenance re-verification ​

Paranoid mode turns on locked_verify_provenance. Each install runs the backend's provenance checks again, such as SLSA, Cosign, Minisign and GitHub attestations, instead of reusing the result recorded in mise.lock. This can need network access. It adds no check the backend does not support, and it does not re-check a tool that is already installed.

来自 mise-versions 的证明 ​

mise asks mise-versions whether a public GitHub release artifact has GitHub attestations, so installs do not spend your GitHub API rate limit. mise verifies any attestation it returns and requires it to name the artifact's repository, so mise-versions cannot vouch for an artifact. It can, however, answer that an artifact has none. Normal mode accepts that answer, and a lockfile written afterwards records no provenance.

Paranoid mode confirms a "none" answer with GitHub before it skips verification. This costs one GitHub API request per artifact without attestations.

在两种模式下，如果 mise-versions 无法响应（例如超时、连接中断，或返回 429、5xx），mise 都会改为查询 GitHub attestation API，并以相同方式验证 GitHub 返回的结果。如果 GitHub 也失败，则由 provenance_api_failures_fatal 决定后续处理方式。