mise-bin

maintainer czyt · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR packages; disabling self-updates is a common practice to keep control with pacman and does not indicate danger.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR packages; disabling self-updates is a common practice to keep control with pacman and does not indicate danger.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:25 install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=mise-bin
    
      3pkgver=2026.7.17
    
      4pkgrel=1
    
      5pkgdesc="dev tools, env vars, task runner"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/jdx/mise"
    
      8license=('MIT')
    
      9options=('!debug')
    
      10optdepends=(
    
      11    'bash-completion: bash completion support'
    
      12)
    
      13provides=('mise')
    
      14conflicts=('mise' 'rtx')
    
      15replaces=('rtx')
    
      16source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64-musl.tar.xz")
    
      17source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64-musl.tar.xz")
    
      18sha256sums_x86_64=('23df5a6f2cd849cd95f6ea819460d67c96bb4b044dafe49f3edd55833f500696')
    
      19sha256sums_aarch64=('c646a12ef69d2223fcf5a203ce6102f7262bace853ece4dfedbd79a875c63c38')
    
      20
    
      21package() {
    
      22    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
    
      23
    
      24    # disable mise self-update (managed by pacman)
    
      25    install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"
    
      26
    
      27    # man page
    
      28    install -Dm644 "${srcdir}/mise/man/man1/mise.1" "${pkgdir}/usr/share/man/man1/mise.1"
    
      29
    
      30    # fish completion (bash/zsh not included in pre-built tarball)
    
      31    install -Dm644 "${srcdir}/mise/share/fish/vendor_conf.d/mise-activate.fish" "${pkgdir}/usr/share/fish/vendor_conf.d/mise-activate.fish"
    
      32
    
      33    # license
    
      34    install -Dm644 "${srcdir}/mise/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35
    
      36    # docs
    
      37    install -Dm644 "${srcdir}/mise/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=mise-bin
-pkgver=2026.7.15
+pkgver=2026.7.17
 pkgrel=1
 pkgdesc="dev tools, env vars, task runner"
 arch=('x86_64' 'aarch64')
@@ -15,8 +15,8 @@
 replaces=('rtx')
 source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64-musl.tar.xz")
 source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64-musl.tar.xz")
-sha256sums_x86_64=('ceeb4503a69fa91851fc46bf97a8f1fd18c5f80ed3910dd1ea4b4b68c9eaa23e')
-sha256sums_aarch64=('6226931543607494027a173cb67d3b60d3ff7f2f6991a086a72a36687cdc7905')
+sha256sums_x86_64=('23df5a6f2cd849cd95f6ea819460d67c96bb4b044dafe49f3edd55833f500696')
+sha256sums_aarch64=('c646a12ef69d2223fcf5a203ce6102f7262bace853ece4dfedbd79a875c63c38')
 
 package() {
     install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 05:17:13	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 05:14:03	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 03:37:00	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 05:34:42	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 05:29:17	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 05:22:32	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 05:16:02	MEDIUM	1