Paranoid mode: How to redirect from "unsafe" asdf: community plugin to safe ubi: alternative

[powerman]

Let's say I'm trying to use paranoid mode and need to work on some (not mine own) project which already uses tool "mage" (which is a shorthand in registry for "asdf:mathew-fleisch/asdf-mage").

Is it possible in my local.toml or my global config to somehow redirect tool name "mage" to safer "ubi:magefile/mage"? I mean I can't just replace tool name in that project's .mise.toml because it'll be complicated to make sure this change won't be occasionally pushed to other developers.

[jdx]

If it works in ubi it should be the default for everyone, not just when paranoid is enabled

[RafalSkolasinski]

Is there some simple command that would allow to drop asdf plugins in favour of ubi whenever possible?

[jdx]

that is the default behavior

[RafalSkolasinski]

So if I had in example kind installed through asdf-vm plugin, it will automatically be replaced by binaries coming from ubi?

[jdx]

if it's in registry.toml, yes, otherwise mise would have no idea how to map asdf:kind -> ubi:kubernetes-sigs/kind

[RafalSkolasinski]

I guess that's kind of what I was asking. I have setup migrated some time ago from asdf with quite a few plugins installed.
Now I just became aware about ubi / aqua backends and they seem much more secure to community written asdf plugins.

Maybe I should RTFM on changes in latest versions ;) - but first search lead me here...

I just dropped all my plugins and removed tools

mise plugins remove --all
mise uninstall --all

and then after doing

mise install

it only asked me to add few plugins for tools that indeed has no ubi/aqua options.

I guess that's a poor man solution to what I wanted to did :). Without nee to edit any configs etc.

[powerman]

It's not the only one in current registry which can be replaced with ubi - here is the full list:

evans = "ubi:ktr0731/evans"
gitleaks = "ubi:gitleaks/gitleaks"
go-swagger = "ubi:go-swagger/go-swagger"
gotestsum = "ubi:gotestyourself/gotestsum"
grpcurl = "ubi:fullstorydev/grpcurl"
jqp = "ubi:noahgorstein/jqp"
mage = "ubi:magefile/mage"
minikube = "ubi:kubernetes/minikube"
stylua = "ubi:JohnnyMorganz/stylua"
task = "ubi:go-task/task"
yamlfmt = "ubi:google/yamlfmt"

[BurnerWah]

Just curious: is https://github.com/zyedidia/eget works in these edge cases where ubi fails?

I haven't checked yet, since there isn't an eget backend available for mise.
Even if it does, UBI is built into mise itself, while eget would probably be harder to embed into mise.
I could try and see if it works when I get back to testing stuff next week though.

[jdx]

does mise itself work on PowerPC?

[BurnerWah]

does mise itself work on PowerPC?

I actually haven't done much testing of mise itself on other architectures, but I could probably test to see if mise can build on PowerPC and risc-v later today
I don't think I'll be able to get a VM for testing the whole program on PowerPC running until Monday, but I do have a risc-v VM on hand for testing already

[BurnerWah]

does mise itself work on PowerPC?

After some testing, for the most part it does work on PowerPC (specifically ppc64le, running on fedora 41 since the ubuntu rustc is too old).
The cargo backend is basically non-functional, probably due to cargo-binstall and sccache not having any prebuilt binaries available and me being unable to compile release builds for anything at all.
Otherwise, the issues I've run into seem like they'd be pretty easy to fix.
The python, node, go, and zig plugins all just need some code to change the architecture they try to download from powerpc64 to something like ppc64le or powerpc64le
And the java plugin has no metadata to work off of, so it fails to function outright, but I know temurin has ppc64 and ppc64le java available, so it could be made to work.
Deno & Bun have no prebuilt versions available.

As for tests, I got all but three unit tests to pass.

So yeah for the most part, it's functional.

[jdx]

The cargo backend is basically non-functional, probably due to cargo-binstall and sccache not having any prebuilt binaries available and me being unable to compile release builds for anything at all.

That should only be a problem if actually trying to use cargo-binstall and sccache. If you don't put them into your config mise won't try to install them.

[powerman]

Anyway, looks like my original question should be reworded in this way: if I'll see some asdf: plugin in 3rd-party project's .mise.toml in paranoid mode, is it possible to somehow replace it with my own (reviewed and not updated without my control - i.e. my own fork of that asdf plugin) asdf plugin, so that original .mise.toml will continue to work without modifications but my local system will be protected from executing non-reviewed 3rd-party code?

[powerman]

Maybe will be solved by #2885