Conversation
Installs mise from its GitHub release into /usr/local/bin, verifying the release checksums against their minisign signature with the mise public key vendored in the feature, the same key and method the mise image uses. The glibc build is installed where it runs and the statically linked musl build otherwise, so releases that outgrew an older Debian's glibc still work there. Tool installs and the download cache go to /var/lib/mise and /var/cache/mise, which the feature mounts volumes on and points MISE_DATA_DIR and MISE_CACHE_DIR at, with the shims directory on PATH. Both directories are owned by a mise system group with the setgid bit, following the claude-code feature, so they stay writable after updateRemoteUserUID renumbers the remote user. The minisign key is registered with update-material.sh so the weekly workflow refreshes it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ti123BqzFGF4RaFf4qM5XJ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
ghcr.io/bare-devcontainer/features/mise, a Feature that installs mise on any Debian or Ubuntu based image, for the toolchains and CLIs a project pins itself (linters,terragrunt, a second language runtime) that the images deliberately leave out.https://github.com/jdx/mise/releases/. Its checksum is verified againstSHASUMS256.txt, whose minisign signature is checked withsrc/mise/mise-minisign.pub, the same key and method themiseimage uses. The key is registered inscripts/update-material.shso the weekly workflow refreshes it. No other Feature is required;minisign,sha256sum, a downloader and a CA bundle are installed withapt-getonly when the image lacks them./var/lib/miseand/var/cache/mise, which the Feature mounts named volumes on and pointsMISE_DATA_DIR/MISE_CACHE_DIRat, with the shims directory onPATH. Both are owned by amisesystem group with the setgid bit, following theclaude-codeFeature, so they stay writable afterupdateRemoteUserUIDrenumbers the remote user.version:latest(resolved through the redirect ofreleases/latest) or an exact version such as2026.9.10.README.mdis generated withdevcontainer features generate-docs; the existing READMEs regenerate unchanged.Test plan
shellcheck -S warningoninstall.shandsmoke_test.shinstall.shrun against a local mock release server with a self-generated minisign key:latestvia redirect (wget and curl paths), exact version, unrecognised version, tamperedSHASUMS256.txt(signature verification fails, exit 1), glibc build failing to run (musl fallback), temporary directory removed on exitsmoke_test.shas a non-root user against that install (PATH, env, group, setgid, ownership)smoke-testjob onmcr/base:debianandbare/debian:trixie, which covers the real download andmise exec python@3🤖 Generated with Claude Code
https://claude.ai/code/session_01Ti123BqzFGF4RaFf4qM5XJ
Generated by Claude Code