mirasim-bin
MEDIUM
maintainer isbest
0 votes
scanned 2026-09-25 03:10:18.761179
Why flagged
The package downloads prebuilt .deb binaries from a non-whitelisted CDN (cdn-assets.mirasim.ai), which are then extracted and installed; these binaries are not built from source and could be silently replaced by an attacker, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:47
source_x86_64=("https://cdn-assets.mirasim.ai/mirasim/releases/v${pkgver}/Mirasim-${pkgver}-linux-amd64.deb")
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt .deb binaries from a non-whitelisted CDN (cdn-assets.mirasim.ai), which are then extracted and installed; these binaries are not built from source and could be silently replaced by an attacker, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: isbest <icoderdev@outlook.com>
2
3
pkgname=mirasim-bin
4
pkgver=0.0.354
5
pkgrel=3
6
pkgdesc='Terminal, agent, model and tool orchestrator'
7
arch=('x86_64' 'aarch64')
8
url='https://mirasim.ai'
9
license=('LicenseRef-proprietary')
10
depends=(
11
alsa-lib
12
at-spi2-core
13
cairo
14
dbus
15
expat
16
glib2
17
gtk3
18
hicolor-icon-theme
19
libcups
20
libdrm
21
libnotify
22
libsecret
23
libx11
24
libxcb
25
libxcomposite
26
libxdamage
27
libxext
28
libxfixes
29
libxkbcommon
30
libxrandr
31
libxss
32
libxtst
33
mesa
34
nspr
35
nss
36
pango
37
systemd-libs
38
util-linux-libs
39
xdg-utils
40
)
41
optdepends=('libappindicator: system tray icon')
42
provides=("mirasim=${pkgver}")
43
conflicts=('mirasim')
44
makedepends=('imagemagick')
45
options=('!strip' '!debug')
46
source=('launcher-flags.patch')
47
source_x86_64=("https://cdn-assets.mirasim.ai/mirasim/releases/v${pkgver}/Mirasim-${pkgver}-linux-amd64.deb")
48
source_aarch64=("https://cdn-assets.mirasim.ai/mirasim/releases/v${pkgver}/Mirasim-${pkgver}-linux-arm64.deb")
49
sha256sums=('6ea545e822b05486a227c96ca68ed0b215be4b86739580a5fe7f01d1df7d744d')
50
sha256sums_x86_64=('225335cce738b292ef6ff06aa82410937cd77b068c927dfb14d80c04bcc20dd1')
51
sha256sums_aarch64=('4e1f20ba8c8549d997d08f05276cc3ed325cae656d49522c8e75ded19bbc1031')
52
53
package() {
54
local deb
55
case "$CARCH" in
56
x86_64) deb="${srcdir}/Mirasim-${pkgver}-linux-amd64.deb" ;;
57
aarch64) deb="${srcdir}/Mirasim-${pkgver}-linux-arm64.deb" ;;
58
esac
59
60
# Upstream links this command in the deb postinst. The desktop file execs
61
# the absolute path under /opt, so the app does not depend on the link.
62
bsdtar -xOf "$deb" data.tar.xz | bsdtar -x -C "$pkgdir" -f -
63
install -dm755 "${pkgdir}/usr/bin"
64
ln -s /opt/Mirasim/mirasim-desktop "${pkgdir}/usr/bin/mirasim-desktop"
65
patch -d "${pkgdir}/opt/Mirasim" -p1 < "${srcdir}/launcher-flags.patch"
66
67
# The deb ships only 1024x1024. hicolor/index.theme does not list that
68
# directory, so icon lookups at every menu and taskbar size miss it.
69
local src_icon size
70
src_icon="${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/mirasim-desktop.png"
71
for size in 16 22 24 32 48 64 96 128 192 256 512; do
72
install -dm755 "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps"
73
magick "$src_icon" -resize "${size}x${size}" \
74
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/mirasim-desktop.png"
75
done
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-09-25 00:03+++ PKGBUILD @ 2026-09-25 03:10@@ -2,7 +2,7 @@ pkgname=mirasim-bin pkgver=0.0.354-pkgrel=1+pkgrel=3 pkgdesc='Terminal, agent, model and tool orchestrator' arch=('x86_64' 'aarch64') url='https://mirasim.ai'@@ -41,9 +41,12 @@ optdepends=('libappindicator: system tray icon') provides=("mirasim=${pkgver}") conflicts=('mirasim')+makedepends=('imagemagick') options=('!strip' '!debug')+source=('launcher-flags.patch') source_x86_64=("https://cdn-assets.mirasim.ai/mirasim/releases/v${pkgver}/Mirasim-${pkgver}-linux-amd64.deb") source_aarch64=("https://cdn-assets.mirasim.ai/mirasim/releases/v${pkgver}/Mirasim-${pkgver}-linux-arm64.deb")+sha256sums=('6ea545e822b05486a227c96ca68ed0b215be4b86739580a5fe7f01d1df7d744d') sha256sums_x86_64=('225335cce738b292ef6ff06aa82410937cd77b068c927dfb14d80c04bcc20dd1') sha256sums_aarch64=('4e1f20ba8c8549d997d08f05276cc3ed325cae656d49522c8e75ded19bbc1031') @@ -59,5 +62,16 @@ bsdtar -xOf "$deb" data.tar.xz | bsdtar -x -C "$pkgdir" -f - install -dm755 "${pkgdir}/usr/bin" ln -s /opt/Mirasim/mirasim-desktop "${pkgdir}/usr/bin/mirasim-desktop"+ patch -d "${pkgdir}/opt/Mirasim" -p1 < "${srcdir}/launcher-flags.patch"++ # The deb ships only 1024x1024. hicolor/index.theme does not list that+ # directory, so icon lookups at every menu and taskbar size miss it.+ local src_icon size+ src_icon="${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/mirasim-desktop.png"+ for size in 16 22 24 32 48 64 96 128 192 256 512; do+ install -dm755 "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps"+ magick "$src_icon" -resize "${size}x${size}" \+ "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/mirasim-desktop.png"+ done } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-25 03:10:18 | Medium | 3 |
| 2026-09-25 00:03:36 | Low | 3 |
| 2026-09-24 15:46:40 | Low | 3 |
| 2026-09-24 15:43:55 | Medium | 3 |