From 1e42e3e059f2d8955795a04c8b735c8c342c5cfd Mon Sep 17 00:00:00 2001
From: Gaurav Tiwari <gaurav@gauravtiwari.co.uk>
Date: Fri, 16 Oct 2026 10:12:56 +0100
Subject: [PATCH] Update BoringCache images to 1.42.0

---
 CHANGELOG.md                        |  6 ++++++
 docs/building.md                    |  2 ++
 lib/boringbuilder/boring_cache.rb   |  8 ++++----
 lib/boringbuilder/mise.rb           |  8 +++++++-
 lib/boringbuilder/version.rb        |  2 +-
 test/boringbuilder/pipeline_test.rb | 19 +++++++++++++++++++
 6 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 87af991..c3e584a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.0.alpha.8 - 2026-10-16
+
+- Update the BoringCache CLI and build images to 1.42.0 with pinned multi-platform digests.
+- Trust copied project Mise configuration inside build containers before installing tools, while retaining
+  paranoid mode.
+
 ## 0.1.0.alpha.7 - 2026-10-02
 
 - Require Dagger Ruby 0.11.1 or newer for startup status and Dagger 0.21.9 support.
diff --git a/docs/building.md b/docs/building.md
index 8ff96d6..e9bf51f 100644
--- a/docs/building.md
+++ b/docs/building.md
@@ -134,6 +134,8 @@ end
 
 `pipeline.mise` prepares the requested tools and application source in a Dagger container. Project versions in
 `mise.toml`, `.mise.toml`, or `.tool-versions` override recipe fallbacks, and `mise.lock` is respected when present.
+The build trusts the copied project configuration files inside its container before installing tools. Mise's
+paranoid mode remains enabled; host-side Mise trust is unchanged.
 Any tool in the [Mise registry](https://mise.jdx.dev/registry.html) can use the same shape.
 
 `pipeline.run` persists the declared path in the local Dagger engine or through BoringCache when shared credentials
diff --git a/lib/boringbuilder/boring_cache.rb b/lib/boringbuilder/boring_cache.rb
index 0a4173d..9338fbc 100644
--- a/lib/boringbuilder/boring_cache.rb
+++ b/lib/boringbuilder/boring_cache.rb
@@ -2,10 +2,10 @@
 
 module BoringBuilder
   class BoringCache
-    CLI_IMAGE = "ghcr.io/boringcache/base:bookworm-v1.19.4@" \
-                "sha256:84d1e168a50fd086ecd4fdb2fd96f689982a6f3c61454acd8c7189e336f8f3ae"
-    BUILD_IMAGE = "ghcr.io/boringcache/base:bookworm-build-v1.19.4@" \
-                  "sha256:df4461581214c0052157041238a67b8da420e1399e4024bc857c68c74a9721cb"
+    CLI_IMAGE = "ghcr.io/boringcache/base:bookworm-v1.42.0@" \
+                "sha256:9d663a781f5e2ff07ee430cb73e99b6b01e00584583c78c27062680842673430"
+    BUILD_IMAGE = "ghcr.io/boringcache/base:bookworm-build-v1.42.0@" \
+                  "sha256:0d621a60a42741365f69d991b121e1a1ea3b900c360b11e265d99e27eeaaa311"
     TOKEN_NAMES = %w[BORINGCACHE_RESTORE_TOKEN BORINGCACHE_SAVE_TOKEN].freeze
     ENVIRONMENT_NAMES = %w[BORINGCACHE_API_URL BORINGCACHE_DEFAULT_WORKSPACE BORINGCACHE_WORKSPACE].freeze
 
diff --git a/lib/boringbuilder/mise.rb b/lib/boringbuilder/mise.rb
index 781ec85..3b30646 100644
--- a/lib/boringbuilder/mise.rb
+++ b/lib/boringbuilder/mise.rb
@@ -7,7 +7,8 @@ class Mise
     DEFAULT_IMAGE = BoringCache::BUILD_IMAGE
     CACHE_PATH = "/mise/cache"
     INSTALL_COMMAND = %w[mise install].freeze
-    METADATA_FILES = %w[mise.toml .mise.toml .tool-versions mise.lock].freeze
+    CONFIG_FILES = %w[mise.toml .mise.toml .tool-versions].freeze
+    METADATA_FILES = [*CONFIG_FILES, "mise.lock"].freeze
     ENVIRONMENT = {
       "MISE_CACHE_DIR" => CACHE_PATH,
       "MISE_DATA_DIR" => "/mise",
@@ -32,6 +33,11 @@ def install(container, tools:, workdir:, only: nil)
       container = with_environment(container)
       container = container.with_workdir(workdir)
                            .with_new_file("/etc/mise/config.toml", system_config(tools))
+      CONFIG_FILES.each do |name|
+        next unless project.root.join(name).file?
+
+        container = container.with_exec(["mise", "trust", "--", "#{workdir}/#{name}"])
+      end
       command = [*INSTALL_COMMAND, *Array(only).map(&:to_s)]
       pipeline.run(
         container,
diff --git a/lib/boringbuilder/version.rb b/lib/boringbuilder/version.rb
index 92f51b1..326dfca 100644
--- a/lib/boringbuilder/version.rb
+++ b/lib/boringbuilder/version.rb
@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BoringBuilder
-  VERSION = "0.1.0.alpha.7"
+  VERSION = "0.1.0.alpha.8"
 end
diff --git a/test/boringbuilder/pipeline_test.rb b/test/boringbuilder/pipeline_test.rb
index 40a5461..04d8d60 100644
--- a/test/boringbuilder/pipeline_test.rb
+++ b/test/boringbuilder/pipeline_test.rb
@@ -28,6 +28,25 @@ def test_creates_a_source_mounted_mise_toolchain
     assert_called_with_path client, :with_mounted_cache, BoringBuilder::Mise::CACHE_PATH
   end
 
+  def test_trusts_copied_project_configs_before_installing_tools
+    root = build_project
+    File.write(root.join(".mise.toml"), "[tools]\nnode = \"24\"\n")
+    File.write(root.join(".tool-versions"), "node 24\n")
+    File.write(root.join("mise.lock"), "")
+    pipeline, client = pipeline_for(environment: {}, root: root)
+
+    pipeline.mise(tools: { node: "24" }, workdir: "/workspace")
+
+    commands = client.calls.filter_map { |name, arguments, _| arguments.first if name == :with_exec }
+    trust_commands = commands.select { |command| command.first(2) == %w[mise trust] }
+
+    assert_equal [
+      %w[mise trust -- /workspace/.mise.toml],
+      %w[mise trust -- /workspace/.tool-versions]
+    ], trust_commands
+    assert_operator commands.index(trust_commands.last), :<, commands.index(BoringBuilder::Mise::INSTALL_COMMAND)
+  end
+
   def test_uses_boringcache_for_the_mise_toolchain_when_shared_credentials_are_present
     pipeline, client = pipeline_for(
       environment: {