feature(mise): add mise dev container feature

[nozaq]

Summary

Adds ghcr.io/bare-devcontainer/features/mise, a Feature that installs mise on any Debian or Ubuntu based image, for the toolchains and CLIs a project pins itself (linters, terragrunt, a second language runtime) that the images deliberately leave out.

• Install and verification — the release binary comes from https://github.com/jdx/mise/releases/ and is checked against src/mise/SHASUMS256.txt, upstream's own checksum file committed here verbatim together with the minisign signature upstream published for it. The install therefore needs sha256sum and nothing else: no package goes into the container in order to verify an artifact, and there is no signature step an install could be talked into skipping. The signature is verified where the tooling is free — scripts/verify-material.sh checks the committed pair against the vendored public key, and the new verify-material job in ci.yml runs it on every change.
• No options, versioned as mise — the committed checksums cover one release, so they are the version pin, and the Feature's version is the version of the mise it installs (2026.9.10). scripts/pin-checksums.sh <feature> <tag> re-pins them to a named release and sets the Feature version from the tag, writing into the working tree only once the signature verifies; a newer mise therefore arrives as one pull request carrying both.
• The musl build — the statically linked linux-*-musl build is installed unconditionally, because it runs whatever the image's glibc version is. That is one download and no fallback path, where the glibc build needs one: a release can require a newer glibc than the image provides (mise ≥ 2026.7.0 on bookworm), and the only way to find out is to run it and see it fail.
• Prerequisites — wget (or curl), sha256sum and a CA bundle, installed with apt-get only when the image lacks them. Package lists the image shipped are kept: a Feature runs after the image was built, so the install removes /var/lib/apt/lists/* only when it was empty to begin with and the lists are its own apt-get update's doing.
• Nothing outside /usr/local/bin and the remote user's home — the tool installs and the download cache stay at mise's own defaults under the home directory, which the Dev Containers CLI chowns when it renumbers the remote user, so nothing needs a system group, a setgid bit, or a caveat about stale UIDs. The Feature declares no mounts and sets no environment: a volume to keep the tools across rebuilds, and a PATH entry for the shims, both name a path under the home directory that fixed Feature text cannot express, and both belong in the consumer's devcontainer.json, where remoteEnv also scopes PATH to the remote user instead of to every process in the container. NOTES.md documents both, as the node Feature already does for the npm cache.
• Trusted material — scripts/signed-material.json records which checksum file, signature and key belong to which Feature, for both scripts above. scripts/update-material.sh keeps refreshing signing keys weekly and now carries the mise key; release checksums are excluded there because they move with a release rather than on their own.
• README.md is generated with devcontainer features generate-docs; the other Feature READMEs regenerate byte-identical.

Test plan

• shellcheck -S warning clean on every install.sh, smoke_test.sh and scripts/*.sh
• install.sh run end to end against the real release: the downloaded binary's sha256sum matches the committed line exactly, and a static-pie binary lands at /usr/local/bin/mise
• Installed as a non-root remote user, then its UID and GID renumbered exactly the way the CLI's updateUID.Dockerfile does (sed on /etc/passwd and /etc/group, chown -R $HOME). All ten smoke checks pass before and after, with no group involved. Also run with _REMOTE_USER=root, and re-run over an existing layout.
• ~/.local, ~/.local/share and ~/.cache come out owned by the remote user, not root — creating the directories as root would otherwise lock the account out of everything else that lives there
• Negative paths: tampered checksum line → sha256sum -c FAILED, exit 1; no entry for the binary → fails before any download; a checksum file naming two mise versions → exit 1; missing checksum file → exit 1
• Both branches of the apt cleanup driven through the real install_prerequisites with apt-get stubbed: against lists holding index files all entries survive, against a cleaned directory (lock and partial only) what apt-get update fetched is removed. A full run on a host with populated lists leaves them at 28 entries before and after.
• pin-checksums.sh: usage, unknown feature, already-pinned no-op, bogus tag and a signature that does not verify all leave the working tree untouched; re-pinning to v2026.9.9 on a scratch copy moved the checksums, the signature and "version": "2026.9.9" together, with the rest of devcontainer-feature.json byte-identical
• verify-material.sh: verifies the committed pair, exits non-zero against a mismatched key, and rejects an empty table
• The mise exec checks run against a real install with api.github.com unreachable, so they do not depend on the GitHub API
• The musl build checked for regressions against the glibc one, since it is now the only one installed: same TLS behaviour through a MITM proxy, and both request python-precompiled-x86_64-unknown-linux-gnu on a Debian host, so mise detects the image's libc rather than its own build target and the choice does not reach the tools. A tool install is ~1s slower (5.4s against 4.5s for node@24), paid once per tool.
• Dropping trap - EXIT from pin-checksums.sh checked against a minimal reproduction: after the moves the temporary paths are gone, so the trap cannot reach the installed files
• CI green: verify-material, and smoke-test for all three Features on both mcr/base:debian and bare/debian:trixie

Notes

The Feature was first versioned 1.0.0 independently of mise. Since each release pins exactly one mise, it now carries mise's own calendar version. Two consequences: the major tag becomes the year, so :2026 stops moving at year end and the usage example points at :latest; and a fix to install.sh alone cannot be published without a new mise release, because semver build metadata (+1) is not a valid OCI tag and a prerelease suffix (-1) sorts below the release. mise releases close to daily, so such a fix waits at most a short while.

The first CI run of smoke-test failed on bare/debian:trixie: the install and all the structural checks passed, but mise exec python@3 returned a 403. mise's core:python backend verifies the GitHub artifact attestations of the precompiled build through the unauthenticated GitHub REST API, whose rate limit is per IP and therefore shared across GitHub-hosted runners. The check now installs node@24, whose backend takes both the version list and the tarball from nodejs.org, so nothing in it draws on that quota. Disabling the attestation check (MISE_PYTHON_GITHUB_ATTESTATIONS=false) would have kept Python at the cost of testing a weaker configuration than a user gets.

The glibc build was originally installed first with the musl build as a fallback. Upstream's installer picks the glibc build on a glibc host only because it matches the host libc — it offers MISE_INSTALL_MUSL=1 for the opposite choice — so there was nothing holding the fallback in place, and it is gone.

The Feature originally declared the two volumes itself. A Feature's mount target is fixed text, so they had to sit outside the home directory, which is the only reason the mise group, the setgid bit and the stale-UID caveat existed. Dropping the mounts removed all three at once.

It then put the shims on PATH through containerEnv, with /usr/local/share/mise symlinked into the remote user's home so a fixed path would resolve. That symlink read as system-wide while belonging to one account, and containerEnv is the whole container's environment, so root's PATH ended up naming a directory the remote user can write. remoteEnv has the scope this wants and a Feature cannot set it, so the PATH entry moved to the consumer's devcontainer.json and the symlink is gone.

The notes and comments were cut back to what a consumer or a future maintainer cannot derive from the tree: the reasoning for the design lives here rather than in the code, mise's own CLI is left to mise's documentation, and every comment that restated the line it sat on is gone. That pass also turned up trap - EXIT in pin-checksums.sh guarding against something that could not happen; it is removed.

The same src/claude-code/install.sh:63 and src/node/install.sh:87 remove /var/lib/apt/lists/* unconditionally, so they discard lists their image shipped. Out of scope here; worth a follow-up.

An earlier commit on this branch dropped two files it claimed to change: the mise row in the root README.md table and the mise key entry in scripts/update-material.sh were reverted locally before staging. Both are restored.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ti123BqzFGF4RaFf4qM5XJ