feat(python): add GitHub provenance verification for prebuilt binaries

[malept]

Problem

Precompiled Python binaries from astral-sh/python-build-standalone lack provenance verification. Unlike Ruby (which already supports GitHub Artifact Attestations), Python installs have no mechanism to verify that downloaded binaries were actually produced by the expected CI workflow in the expected repository.

Additionally, there is no downgrade protection: if a lockfile records that provenance was previously verified, nothing prevents an attacker from stripping that metadata and serving unverified binaries.

Solution

Add GitHub Artifact Attestations support for precompiled Python binaries, following the same pattern already established for Ruby:

1. New setting: python.github_attestations (env: MISE_PYTHON_GITHUB_ATTESTATIONS) overrides the global github_attestations setting specifically for Python. Defaults to the global value (which is true).

2. Lockfile provenance recording: mise lock now records provenance = "github-attestations" in Python platform entries when the setting is enabled.

3. Install-time verification: mise install verifies downloaded tarballs against GitHub Artifact Attestations using the sigstore verification crate, with owner/repo hardcoded to astral-sh/python-build-standalone.

4. Downgrade protection: If the lockfile records provenance but verification is disabled at install time, the install fails with a "downgrade attack" error, preventing provenance stripping attacks.

Test plan

• mise run test:e2e test_lockfile_python — all tests pass
• Tests verify: provenance recorded when enabled, not recorded when disabled, downgrade attack detected when lockfile has provenance but verification is off
• mise run build and mise run lint pass

🤖 Generated with the assistance of OpenCode (claude-opus-4.6).

[gemini-code-assist]

Code Review

This pull request implements GitHub artifact attestation verification for precompiled Python binaries. Key changes include adding a github_attestations setting to the Python tool configuration, updating the Python plugin to perform verification during installation, and recording provenance in the lockfile to prevent downgrade attacks. Comprehensive E2E tests were also added to verify these behaviors. Feedback suggests refactoring the logic for checking if attestations are enabled into a helper function to eliminate code duplication between the detection and verification methods.

[greptile-apps]

Greptile Summary

This PR adds GitHub Artifact Attestations support for precompiled Python binaries from astral-sh/python-build-standalone, following the existing Ruby implementation pattern. It introduces a new python.github_attestations setting (env: MISE_PYTHON_GITHUB_ATTESTATIONS) that overrides the global github_attestations setting, records provenance = \"github-attestations\" in the lockfile, verifies attestations at install time using sigstore, and enforces downgrade protection when the lockfile carries provenance.

Key changes:

• New python.github_attestations optional Bool setting in settings.toml and schema/mise.json, defaulting to the global github_attestations value (true)
• detect_precompiled_provenance() helper determines whether to record/check provenance based on compile mode and the setting
• verify_github_artifact_attestations() mirrors the Ruby implementation: returns Ok(true) on success, Ok(false) when disabled, Err on any failure including NoAttestations for old releases
• Downgrade protection: if tv.lock_platforms carries a provenance entry but verification was skipped, installation is aborted
• security_info() override now advertises SecurityFeature::GithubAttestations when applicable, closing the parity gap with Ruby
• All existing Python e2e tests add MISE_PYTHON_GITHUB_ATTESTATIONS=0 for older versions that predate attestation support

Minor gaps: downgrade protection is not enforced when compile = true is set after lockfile generation; security_info may advertise attestations for versions that fall back to compiled-from-source.

Confidence Score: 4/5

Safe to merge with minor open questions around the compile=true bypass and security_info accuracy

All findings are P2 edge-case concerns. The core verification flow, lockfile recording, and downgrade protection for the primary use case are correct. Prior P1 concern about missing security_info was already fixed.

src/plugins/core/python.rs — install_version_ branching and detect_precompiled_provenance logic

Important Files Changed

Filename	Overview
src/plugins/core/python.rs	Core implementation: adds GitHub Artifact Attestations support for precompiled Python binaries. Correctly follows Ruby pattern. Minor gap: compile=true bypasses downgrade check; detect_precompiled_provenance condition slightly inconsistent with install_precompiled fallback logic.
e2e/lockfile/test_lockfile_python	New test sections cover provenance recording, disabled case, and downgrade detection. awk injection is correct but redundant when global attestations default is true.
e2e/core/test_python_github_attestations	New e2e test for live attestation verification using python@3.13.5. Depends on GitHub APIs (noted in comments). Correctly asserts progress messages and installed version.
settings.toml	Adds python.github_attestations optional Bool setting with MISE_PYTHON_GITHUB_ATTESTATIONS env var. Correct placement and documentation.
schema/mise.json	Adds github_attestations boolean field to python settings schema. Consistent with settings.toml addition.
e2e-win/python.Tests.ps1	Disables GitHub attestations for Windows e2e tests using older Python versions. Correct safety measure.
e2e/backend/test_pipx_deep_dependencies_slow	Adds MISE_PYTHON_GITHUB_ATTESTATIONS=0 for e2e test using Python 3.12.3, which predates attestation support. Correct fix.
docs/dev-tools/mise-lock.md	Adds core:python to the provenance support list in lockfile documentation. Accurate and complete.

Sequence Diagram

sequenceDiagram
    participant User
    participant mise as mise install
    participant Lock as Lockfile
    participant PBS as python-build-standalone
    participant Sigstore

    User->>mise: mise install python@3.13.5
    mise->>Lock: read lock_platforms[platform].provenance
    Note over mise,Lock: locked_provenance = Some("github-attestations") or None
    mise->>PBS: download tarball
    PBS-->>mise: cpython-3.13.5-*.tar.gz
    mise->>mise: verify_checksum (SHA256SUMS)
    alt github_attestations enabled
        mise->>Sigstore: verify_github_attestation(tarball, "astral-sh", "python-build-standalone")
        Sigstore-->>mise: Ok(true)
        mise->>Lock: set pi.provenance = GithubAttestations
    else attestations disabled
        mise->>mise: verified = false
    end
    alt locked_provenance is Some AND verified == false
        mise-->>User: Error: downgrade attack detected
    else provenance matches or no provenance in lockfile
        mise->>mise: untar + sysconfig patch
        mise-->>User: python@3.13.5 installed
    end

Loading

_{Reviews (4): Last reviewed commit: "fix(python): guard detect_precompiled_pr..." | Re-trigger Greptile}