aube blocks renovate installs on a @yarnpkg/libzip trust downgrade

mise’s embedded aube installer refused to install renovate in my testing. One transitive dependency, @yarnpkg/libzip@3.2.2, failed aube’s trust policy with a “trust downgrade”.

What I Learned

I reproduced the failure with a one-tool mise.toml:

# /tmp/mise-aube-test/mise.toml
[tools]
"npm:renovate" = "44.79.6"

$ mise lock
mise ERROR aube install failed: failed to resolve dependencies
  caused by: trust downgrade for @yarnpkg/libzip@3.2.2 (trustPolicy=no-downgrade):
  earlier published version 3.2.0 had provenance attestation but this version has no trust evidence

Version 3.2.0 was published with npm provenance attestation; 3.2.2 has none. aube treats losing trust evidence between releases of the same package as a potential supply-chain compromise.

After reviewing the release, I bypassed the block with a per-tool exclude:

# mise.toml
[tools]
"npm:renovate" = { version = "44.79.6", trust_policy_excludes = ["@yarnpkg/libzip@3.2.2"] }

Notes

• npm itself installs this dependency without complaint; the check only exists in aube.
• npm view @yarnpkg/libzip@3.2.2 lists the package’s long-time maintainers; the release just lacks provenance, which happens with manually published releases.
• A bare package name in trust_policy_excludes exempts every version, so prefer pinning package@version.

References

• aube trust policy: the no-downgrade rule and its investigation guide
• mise npm backend: installer selection and trust_policy_excludes
• npm provenance statements: what the missing attestation is
• Renovate documentation: the dependency update tool being installed
• @yarnpkg/libzip on npm: package metadata and release history