⚠️ Potential issue | 🟡 Minor

# First, locate and read the Dockerfile
fd "Dockerfile" .devcontainer

# Read the specific lines mentioned in the review
cat -n .devcontainer/Dockerfile | sed -n '35,50p'

# Search for CI workflow files and version references
find . -type f \( -name "*.yml" -o -name "*.yaml" \) | grep -E "(workflow|ci|github)" | head -20

# Search for meson and ninja version references in workflow files
rg "meson.*1\.0\.1|ninja.*1\.10\.1" --type yaml

# Search more broadly for version specifications
rg "meson|ninja" --type yaml -A 2 -B 2 | grep -E "(version|release|download)" | head -30

# Read the meson_build.yml workflow
cat -n .github/workflows/meson_build.yml | head -80

# Check if meson/ninja versions are specified in any workflow
rg "meson|ninja" .github/workflows/ -A 3 | head -60

# Check if there's a pyproject.toml or setup.py in meson directory
find . -maxdepth 3 -name "pyproject.toml" -o -name "setup.py" | head -20

Update meson installation to use pip and address deprecated setup.py, plus coordinate version updates with CI workflow.

The installation block has several areas for improvement, and notably the versions are intentionally pinned to match .github/workflows/meson_build.yml:

1. Deprecated setup.py install (Line 45): The python3 setup.py install command is deprecated. Use pip3 install /tmp/meson-1.0.1/ instead.

2. Missing checksum verification: The downloads are not verified with checksums. Consider adding SHA256 verification for security.

3. Old pinned versions: Meson 1.0.1 and Ninja 1.10.1 are pinned to match the CI workflow, but both are dated (2023 and 2020 respectively). If updating to newer versions (current: Meson 1.10.0, Ninja 1.13.2), you must also update .github/workflows/meson_build.yml lines 27-28 to keep them synchronized.

.devcontainer/Dockerfile lines 39-46: the meson install uses deprecated python3
setup.py install and lacks checksum verification and coordinated CI version
updates; replace the setup.py install with pip3 install /tmp/meson-1.0.1/ (or
pip3 install meson==<version> if you update the pinned version), add SHA256
checksum verification for both the meson tarball and ninja zip after download
and before extraction, and if you bump meson/ninja versions update the matching
pins in .github/workflows/meson_build.yml (lines ~27-28) so the Dockerfile and
CI stay synchronized.

Yes, intentionally pin the same version as CI pipeline.

@rophy, understood — keeping the versions synchronized with the CI pipeline is a good practice for consistency.

However, there are still two concerns independent of the version choice:

1. Deprecated installation method (Line 45): The python3 setup.py install command is deprecated. Even with Meson 1.0.1, you should use pip3 install /tmp/meson-1.0.1/ instead to avoid deprecation warnings and follow modern Python packaging standards.

2. Missing checksum verification: For security, consider adding SHA256 verification after downloading the tarballs:

   RUN curl -L "https://github.com/mesonbuild/meson/releases/download/1.0.1/meson-1.0.1.tar.gz" -o /tmp/meson-1.0.1.tar.gz \
       && echo "<SHA256_HASH>  /tmp/meson-1.0.1.tar.gz" | sha256sum -c - \
       && curl -L "https://github.com/ninja-build/ninja/releases/download/v1.10.1/ninja-linux.zip" -o /tmp/ninja-linux.zip \
       && echo "<SHA256_HASH>  /tmp/ninja-linux.zip" | sha256sum -c - \
       && unzip -o /tmp/ninja-linux.zip -d /tmp \
       && cp /tmp/ninja /usr/bin/ \
       && tar xzf /tmp/meson-1.0.1.tar.gz -C /tmp \
       && cd /tmp/meson-1.0.1 && pip3 install . \
       && rm -rf /tmp/meson-1.0.1* /tmp/ninja*

Would you like to address these improvements while keeping the version pinning?

nah, I'm fine with strictly copying what CI piepline does.

@rophy, understood — I respect your decision to keep the dev container setup aligned with the CI pipeline exactly as-is. Feel free to reach out if you need anything else!