kit -- developer toolchain supply chain

What problem does it solve?

kit prevents “version drift” and weak supply-chain verification when installing developer tools from multiple git-based registries by making resolution, integrity checks, and trust posture explicit and reproducible.

Core Features & Use Cases

• Resolve cross-registry tool versions: selects the effective tool definition across configured registries and generates the corresponding mise configuration lock.
• Enforce verification posture by tier: validates installed binaries using the required method (cosign/attestation for higher trust tiers, checksums for lower tiers) rather than relying on ad-hoc installs.
• Automate upstream update tracking (CI pipelines): supports a three-stage workflow to detect upstream changes, evaluate them, apply updates, and hard-gate registry merges via deterministic verification.

Quick Start

Run the safety-first flow by syncing your resolved tool versions with kit sync after you set up one registry, then confirm what you actually have with kit status.