mise-bin

MEDIUM

maintainer czyt 1 votes scanned 2026-11-01 05:59:34.516406

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:27 install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=mise-bin
    
      3pkgver=2026.10.24
    
      4pkgrel=1
    
      5pkgdesc="dev tools, env vars, task runner"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/jdx/mise"
    
      8license=('MIT')
    
      9options=('!debug')
    
      10optdepends=(
    
      11    'bash-completion: bash completion support'
    
      12    'fish: fish completion and automatic environment activation'
    
      13    'zsh: zsh completion support'
    
      14)
    
      15provides=('mise')
    
      16conflicts=('mise' 'mise-musl-bin' 'rtx')
    
      17replaces=('rtx')
    
      18source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64.tar.xz")
    
      19source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64.tar.xz")
    
      20sha256sums_x86_64=('1be1e24ddb3a01085dd73f703bc97398c9a3f5345edb192a52055a1140bcc6fb')
    
      21sha256sums_aarch64=('d448f4100b53c898d99b041ce3a72545c53239f1a6028128fa0f082441826a90')
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
    
      25
    
      26    # disable mise self-update (managed by pacman)
    
      27    install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"
    
      28
    
      29    # man page
    
      30    install -Dm644 "${srcdir}/mise/man/man1/mise.1" "${pkgdir}/usr/share/man/man1/mise.1"
    
      31
    
      32    # fish automatically loads both vendor completions and vendor conf files.
    
      33    install -d "${pkgdir}/usr/share/fish/vendor_completions.d"
    
      34    "${srcdir}/mise/bin/mise" completion fish > "${pkgdir}/usr/share/fish/vendor_completions.d/mise.fish"
    
      35    install -Dm644 "${srcdir}/mise/share/fish/vendor_conf.d/mise-activate.fish" "${pkgdir}/usr/share/fish/vendor_conf.d/mise-activate.fish"
    
      36
    
      37    # Generate bash and zsh completions from the same versioned binary.
    
      38    install -d "${pkgdir}/usr/share/bash-completion/completions"
    
      39    "${srcdir}/mise/bin/mise" completion bash > "${pkgdir}/usr/share/bash-completion/completions/mise"
    
      40    install -d "${pkgdir}/usr/share/zsh/site-functions"
    
      41    "${srcdir}/mise/bin/mise" completion zsh > "${pkgdir}/usr/share/zsh/site-functions/_mise"
    
      42
    
      43    # license
    
      44    install -Dm644 "${srcdir}/mise/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # docs
    
      47    install -Dm644 "${srcdir}/mise/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 05:59
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=mise-bin
-pkgver=2026.10.23
+pkgver=2026.10.24
 pkgrel=1
 pkgdesc="dev tools, env vars, task runner"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 replaces=('rtx')
 source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64.tar.xz")
 source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64.tar.xz")
-sha256sums_x86_64=('19b43f33d81e3977e5a0ecf027ed01ed5f1f31af182ee9ca9cba492dad4d4b8e')
-sha256sums_aarch64=('2fc250d93b50a9bd7c5069f08f794d32c1aa3ba49cc6e0834eb0b2fe0be224c1')
+sha256sums_x86_64=('1be1e24ddb3a01085dd73f703bc97398c9a3f5345edb192a52055a1140bcc6fb')
+sha256sums_aarch64=('d448f4100b53c898d99b041ce3a72545c53239f1a6028128fa0f082441826a90')
 
 package() {
     install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 05:59:34	Medium	1
2026-11-01 00:21:48	Low	2
2026-10-31 05:57:59	Medium	1
2026-10-31 00:07:41	Low	2
2026-10-30 05:55:14	Medium	1
2026-10-30 00:29:30	Low	2
2026-10-29 05:51:59	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 05:49:54	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 05:46:44	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 05:41:54	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 05:39:24	Medium	1
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 05:30:25	Medium	1