mise-bin

MEDIUM

maintainer czyt 1 votes scanned 2026-09-17 05:24:46.293726

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:27 install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=mise-bin
    
      3pkgver=2026.9.9
    
      4pkgrel=1
    
      5pkgdesc="dev tools, env vars, task runner"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/jdx/mise"
    
      8license=('MIT')
    
      9options=('!debug')
    
      10optdepends=(
    
      11    'bash-completion: bash completion support'
    
      12    'fish: fish completion and automatic environment activation'
    
      13    'zsh: zsh completion support'
    
      14)
    
      15provides=('mise')
    
      16conflicts=('mise' 'mise-musl-bin' 'rtx')
    
      17replaces=('rtx')
    
      18source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64.tar.xz")
    
      19source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64.tar.xz")
    
      20sha256sums_x86_64=('ed3ee9b7331182e57f77230cf6af64d90e6e1a01e2c3e4749568ea335837c0fb')
    
      21sha256sums_aarch64=('09d0489db27c173d1427b4248e3e1fbf18b00ccc1d887d8746f1d8b311903a50')
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
    
      25
    
      26    # disable mise self-update (managed by pacman)
    
      27    install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"
    
      28
    
      29    # man page
    
      30    install -Dm644 "${srcdir}/mise/man/man1/mise.1" "${pkgdir}/usr/share/man/man1/mise.1"
    
      31
    
      32    # fish automatically loads both vendor completions and vendor conf files.
    
      33    install -d "${pkgdir}/usr/share/fish/vendor_completions.d"
    
      34    "${srcdir}/mise/bin/mise" completion fish > "${pkgdir}/usr/share/fish/vendor_completions.d/mise.fish"
    
      35    install -Dm644 "${srcdir}/mise/share/fish/vendor_conf.d/mise-activate.fish" "${pkgdir}/usr/share/fish/vendor_conf.d/mise-activate.fish"
    
      36
    
      37    # Generate bash and zsh completions from the same versioned binary.
    
      38    install -d "${pkgdir}/usr/share/bash-completion/completions"
    
      39    "${srcdir}/mise/bin/mise" completion bash > "${pkgdir}/usr/share/bash-completion/completions/mise"
    
      40    install -d "${pkgdir}/usr/share/zsh/site-functions"
    
      41    "${srcdir}/mise/bin/mise" completion zsh > "${pkgdir}/usr/share/zsh/site-functions/_mise"
    
      42
    
      43    # license
    
      44    install -Dm644 "${srcdir}/mise/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # docs
    
      47    install -Dm644 "${srcdir}/mise/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-09-17 00:27
+++ PKGBUILD @ 2026-09-17 05:24
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=mise-bin
-pkgver=2026.9.8
+pkgver=2026.9.9
 pkgrel=1
 pkgdesc="dev tools, env vars, task runner"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 replaces=('rtx')
 source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64.tar.xz")
 source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64.tar.xz")
-sha256sums_x86_64=('197e484ccf012cbb846047195f4bc6aa15fa895adf3d0ac5d35a1f1a260bce05')
-sha256sums_aarch64=('b519a2027e2ca95e16a2ead2f2d23ef4ba274a03a9c239643fc652bcae3af93d')
+sha256sums_x86_64=('ed3ee9b7331182e57f77230cf6af64d90e6e1a01e2c3e4749568ea335837c0fb')
+sha256sums_aarch64=('09d0489db27c173d1427b4248e3e1fbf18b00ccc1d887d8746f1d8b311903a50')
 
 package() {
     install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 05:24:46	Medium	1
2026-09-17 00:27:14	Low	2
2026-09-16 05:21:26	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 05:18:46	Medium	1
2026-09-15 00:25:31	Low	2
2026-09-14 05:16:15	Medium	1
2026-09-14 00:27:57	Low	2
2026-09-13 05:13:46	Medium	1
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 05:22:12	Medium	1
2026-09-11 00:19:22	Low	2
2026-09-10 05:20:15	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 05:18:57	Medium	1
2026-09-09 00:04:09	Low	2
2026-09-08 05:16:12	Medium	1
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2