#146

feat: add support for Nix via a flake

s12d ago

← Back to list

01Issue

FeatureClosedSwamp CLITeam

Assigneesswamp_lord

Relationships

#982 Support installing swamp via mise GitHub backend

Opened by evrardjp · 7/6/2026

Problem

I tried installing swamp globally with mise using the GitHub backend:

mise use -g github:swamp-club/swamp[exe=swamp]

mise selected the latest GitHub release/artifact:

github:swamp-club/swamp@20260705.012006.0-sha.9055d66d verify GitHub artifact attestations

but installation failed during GitHub artifact attestation verification:

mise ERROR Failed to install github:swamp-club/swamp@latest: GitHub artifact attestations verification error for github:swamp-club/swamp@20260705.012006.0-sha.9055d66d: Verification failed: Sigstore error: Verification error: TSA timestamp verification failed: Failed to verify timestamp signature: no certificate matches issuer and serial number
mise ERROR Version: 2026.6.11 linux-x64 (2026-06-17)

Requested feature

Make swamp installable via mise, ideally with a simple command such as:

mise use -g github:swamp-club/swamp[exe=swamp]

or by documenting the supported mise command if a different selector/plugin configuration is required.

Proposed outcome

GitHub release artifacts and attestations are compatible with mise's GitHub backend verification.
The install command is documented in the Swamp install docs.
Users can install/update swamp with mise without disabling verification.

Environment

mise: 2026.6.11 linux-x64 (2026-06-17)
swamp artifact/version attempted by mise: 20260705.012006.0-sha.9055d66d
OS/arch from mise output: linux-x64

02Bog Flow

Closed

7/6/2026, 7:22:48 PM

No activity in this phase yet.

03Sludge Pulse

swamp_lord assigned swamp_lord7/6/2026, 7:16:19 PM

evrardjp commented 7/6/2026, 11:21:56 AM

It's normal that mise is not fetching latest version by default (so that's normal that we are seeing yesterday's version in here). It depends on a grace period, that ppl can override. It might throw ppl off in the first place, so I am just mentioning here so it does nto surprise ppl..

swamp_lord commented 7/6/2026, 7:22:48 PM

Thanks for the detailed report, @evrardjp — the environment info made this quick to pin down.

tl;dr: this is a mise-side bug, not a swamp release problem, and it's already fixed in newer mise.

I checked the release you hit (v20260705.012006.0-sha.9055d66d). It does have a valid GitHub artifact attestation — GitHub generates it automatically (in-toto release/v0.2 predicate, initiator: github, signed by GitHub's release attester), and its subject correctly lists every asset's digest. Nothing is wrong with swamp's artifacts or attestations.

The TSA timestamp verification failed: no certificate matches issuer and serial number error comes from mise's bundled sigstore trust root being out of date — it's missing GitHub's rotated TSA intermediate cert (valid from 2026-06-12). Your mise 2026.6.11 predates the fix. Same root cause as jdx/mise discussion #10680 (https://github.com/jdx/mise/discussions/10680), resolved in mise builds carrying sigstore-verify >= 0.10.0.

Fix: update mise to a current release, then this verifies cleanly:

mise use -g github:swamp-club/swamp[exe=swamp]

Workaround if you're pinned to an older mise (keeps checksum verification in force, scoped to the one command):

MISE_GITHUB_ATTESTATIONS=false mise use -g github:swamp-club/swamp[exe=swamp]

Since there's nothing to fix on swamp's release side, I'm closing this out. We'll separately add the mise install method to the docs so it's discoverable. Thanks again for the clear write-up!

Scorecard: beta/rc-only extensions show "not scored" despite successful scoring (GET /score resolves only latestVersion)

`swamp extension search --channel beta|rc|stable` ignores the filter — all channels + the no-flag default return an identical result set

Beta-channel extensions are never scored — perpetual 'Scoring is taking longer than expected'

feat: allow models to call other models mid-execution via context.runModel()

swamp-club: enable OAuth provider for swamp serve collective-based admission

extension update/install reports new version while on-disk pulled files stay old

command/shell: step with timeout + a surviving child process reports exit -1 despite command exiting 0

swamp serve startup/shutdown is very slow on large repo and lacks diagnostics

Vault push log overstates what left the machine: Pushed N vault file(s) to datastore counts every dirty file, not just vault files

serve-auth: mode: oauth — device grant client + collective-based admission

serve-auth: enable OIDC Provider + Device Authorization plugins in swamp-club

Orphaned data (migrated-away/deleted model) can't be GC'd or deleted

Docs: document swamp data prune (orphaned-data reclamation)

UAT: CLI coverage for swamp data prune (orphaned-data reclamation)

Session credential revocation scans entire credential map on every dispatch completion

Docs: update worker-commands.md for --all flag and JSON output change

datastore migrate-index aborts on hardcoded 30s S3 requestTimeout for large shards

swamp worker list: hide disconnected workers by default, add --all flag

swamp serve should survive bad extension failures

Worker fleets phase 7: how-to guides and explanation docs

swamp serve: catch unhandled promise rejections from extensions

[@adam/cfgmgmt] SSH helper can crash swamp serve via unhandled finally() rejection

Docs: add --server-token flag to worker connect reference

Add --server-token to worker connect for authenticated orchestrators

Docs: document --trusted-hosts flag for swamp serve

Document SWAMP_SERVE_EXTRA_HEADERS for reverse proxy/tunnel setups

Add --trusted-hosts flag to swamp serve for Docker/Kubernetes worker connections

Allow swamp clients to send custom headers when connecting to swamp serve

Docs: update serve-flags.md default queue timeout from 60s to 10m

Worker fleets phase 6: raise default queue timeout to 10 minutes

Worker fleets phase 4b: capacity slots and concurrent dispatch

MethodContext docs/comments mention context.putSecret but runtime exposes vaultService.put

Docs: add --concurrency flag and SLOTS column to worker-commands reference

install.sh still points users to systeminit/swamp

Support user systemd units for 'swamp serve daemon enable'

swamp serve scheduled execution runs steps in an isolated data scope: readResource sees empty state, writeResource never reaches the model-scope chain — stateful scheduled workflows duplicate instead of deduplicating

Support installing swamp via mise GitHub backend

Worker fleets phase 4a: dispatch runner extraction — child process per dispatch

Docs: add swamp worker daemon enable/disable/status to worker-commands reference

Worker fleets phase 3 PR2: swamp worker daemon enable

Docs: add drain, lifecycle policies, and exit-code contract to references

Worker fleets phase 3 PR1: drain state machine, lifecycle policies, signal handling

Leaderboard search excludes ghosts — a visible ghost can't be found by its alias

issue-lifecycle: plan lifecycle entry silently dropped when summary exceeds 1000 chars

Docs: add worker verify, --verify-on-enroll, and env-var config to references

Labs - Filters do not apply to Blocked status and Billing Tier category

Worker fleets phase 2 PR2: env-var config, swamp worker verify, --verify-on-enroll

Docs: add --type flag to issue edit reference and how-to

Docs: update manual with whole-field expression syntax for workflow task inputs/globalArgs

Allow changing an existing issue to security/confidential after submission

Allow dynamic object expressions for workflow task inputs/globalArgs

Docs: update enrollment token references for fleet tokens (--max-enrollments)

Worker fleets phase 2 PR1: fleet tokens (--max-enrollments, bindings, worker naming)

$identify events are never consumed — anonymous web history never binds to the account

Worker fleets phase 1 PR3: boot reconciliation and integration test

Login success still shows login tip

Support confidential visibility for non-security issues

Fine-grained scopes for swamp.club access tokens

Add associative info to user profiles: collective membership + collaborative contributions

Remove comments from /feed and redesign the page

feed_post_score_events queue grows unboundedly (no TTL, no delete-on-delivery)

Make paid subscribers visually stand out (badge, profile popup summary)

Relax the profanity filter

Giphy integration via /giphy command

@-mention autocomplete for users when writing lab ripples

Worker fleets phase 1 PR2: step_queued events, pending-dispatch model, queue introspection

Docs: add swamp worker queue to worker-commands reference

/lab shipped list is sorted by issue number, not ship date

Docs: update manual for ephemeral data and step-output dependency deferral

Docs: update remote execution references for elastic queueing

Support dynamic host discovery from external sources

Worker fleets phase 1: elastic queueing

catalog backfill should support scoped population for targeted lookups

Docs: document global skill sync behavior for custom tools in manual

swamp update syncs global skills to default agent directories instead of configured custom Pi skillsDir

coerceToSuffix does not sanitize path-unsafe characters, causing forEach items and vary dimensions with / to produce invalid data instance names

Badge for activity on other people's issues

swamp serve: add @keychain=<service>/<account> indirection for secret args on macOS

swamp serve: eliminate wrapper scripts via @vault= secret refs and native startup hooks

Automate mechanical frontmatter fixes in the fixing stage