trust - how to handle as root?

[laur89]

I have a bash bootstrap script that is executed on a fresh debian installation that does most of the system setup. Among other things, it pulls config files, installs mise, installs mise-managed tools, and then uses said tools to build & install other programs.

One such tool is zig, and a program it builds & installs is ly display manager.

In short, this is roughly what happens:

eval "$(mise activate bash --shims)"
mise use --global usage
mise install
mise upgrade
/fetch ly code and cd to its dir/
zig build  # note zig is provided via mise shims
sudo env "PATH=$PATH" zig build installnoconf -Dinit_system=systemd  # PATH=$PATH as zig is avail as a shim

Last command prompts me:

mise config files in /home/laur89 are not trusted. Trust them?
Yes  No  All

Couple of problems with it:

1. there are no mise config files in /home/laur89. or is it referring to /home/laur89/.config/mise... ?
2. I don't want my bootstrap script to run interactively, and
3. selecting Yes hangs the execution. no errors, no nothing.

How to proceed? The logic needs to be modified so that sudo can use the mise-managed zig.

---

Note on my current system that's been live for a few years, when the bootstrap script is executed from a shell that executes eval -- "$(mise activate bash)" (i.e. without --shim) from ~/.bashrc:

• if we do not activate shims from the bootstrap script, then installation succeeds;
• but if the shim activation is still eval'd from the script like show above, then the execution hangs the same, but without any trust prompts.

[roele]

You can trust certain directories by default with trusted_config_paths

Example:

trusted_config_paths = ["~/.config/mise", "~/work"]

[laur89]

Meaning /root/.config/mise/config.toml should whitelist my regular user's config? That might do the trick.

But it's still unclear why the discrepancy between shim and no-shim usage as described in the last part of original question.

[roele]

Hard to tell without the complete picture...

[laur89]

Added regular user's config.toml to root's trusted_config_paths, but the invocation still hangs. No trust prompt though.

[laur89]

Per this reply on discord, the hanging can be worked around by passing both commands through mise exec:

$ mise x -- zig build
$ mise x -- sudo env "PATH=$PATH" zig build installnoconf...

In addition to that, trusting our regular user's mise config for root is still required as well:

# /root/.config/mise/config.toml:
[settings]
trusted_config_paths=["/home/laur89/.config/mise/config.toml"]

---

This solves the immediate issue for me, but it's still unclear as to why none of it is required when executing the script in a shell that has done eval -- "$(mise activate bash) from .bashrc?

[roele]

Well there are some differences how activate and shims operate. Maybe you find some answers at https://mise.jdx.dev/dev-tools/shims.html#shims-vs-path.

Besides that mise operates mainly in user space to prevent permission issues. So installing tools with root and executing them with another user is guaranteed to cause issues.