Replying to @0xSheetal
neither, the pin should be part of the install instructions, e.g.: packslip install jdx/mise --pin ps1_nlhmwtfeufglxv5myvwvronk7a
of course that does mean the initial pin needs to be sent over TLS but unlike a checksum this works for future releases without changing the pin
Replying to @DarkSmith
if the tool you're installing has a packslip manifest then yes
This week’s eMudhra CA compromise is a reminder: if your release binaries are only protected by TLS (e.g.: `curl | sh`), anyone with a forged cert can swap them.
I am working to get the packslip cli into Linux distros for bootstrapping package managers. Spread the word, if this gets popular enough we'll all eventually be able to stop using `curl | sh` for anything.
mise also understands packslip and in addition to hardened supply chains, users can also get agent skills and completions tied to tool versions.
packslip.dev/
Replying to @Capyvara @scrollingentity
do my precompiled binaries not work with those?
Replying to @TheAlexLichter @kurtextrem
especially true when you have agents running since you're probably never going to see the warnings unless the agent happens to mention them
it's coming to more pages soon but you can play with it here: mise.jdx.dev/configuration/p…
Replying to @just_be_dev @Marc_van_Sax
icymi i improved the integration of fnox/mise: mise.jdx.dev/environments/se…
Replying to @nateberkopec @TimHaines
sonnet must be a lot cheaper though right? with my sub it seems like i can use sonnet all day and it uses like 1%



