mise-musl-bin

LOW

maintainer czyt 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases and disables self-updates to defer to pacman; the flagged privileged install is standard packaging practice and not malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases and disables self-updates to defer to pacman; the flagged privileged install is standard packaging practice and not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:27 install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=mise-musl-bin
    
      3pkgver=2026.10.10
    
      4pkgrel=1
    
      5pkgdesc="Portable musl build of mise: dev tools, env vars, task runner"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/jdx/mise"
    
      8license=('MIT')
    
      9options=('!debug')
    
      10optdepends=(
    
      11    'bash-completion: bash completion support'
    
      12    'fish: fish completion and automatic environment activation'
    
      13    'zsh: zsh completion support'
    
      14)
    
      15provides=('mise')
    
      16conflicts=('mise' 'mise-bin' 'rtx')
    
      17replaces=('rtx')
    
      18source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64-musl.tar.xz")
    
      19source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64-musl.tar.xz")
    
      20sha256sums_x86_64=('f725bf2bb7c4beac4d71a31854ba9c351c99ae4cff61fdffe9ee4edf3f779cc9')
    
      21sha256sums_aarch64=('2581288056e44f35133a684af63966a62ec04aec5434ce84c19c60d876902690')
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
    
      25
    
      26    # disable mise self-update (managed by pacman)
    
      27    install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"
    
      28
    
      29    # man page
    
      30    install -Dm644 "${srcdir}/mise/man/man1/mise.1" "${pkgdir}/usr/share/man/man1/mise.1"
    
      31
    
      32    # fish automatically loads both vendor completions and vendor conf files.
    
      33    install -d "${pkgdir}/usr/share/fish/vendor_completions.d"
    
      34    "${srcdir}/mise/bin/mise" completion fish > "${pkgdir}/usr/share/fish/vendor_completions.d/mise.fish"
    
      35    install -Dm644 "${srcdir}/mise/share/fish/vendor_conf.d/mise-activate.fish" "${pkgdir}/usr/share/fish/vendor_conf.d/mise-activate.fish"
    
      36
    
      37    # Generate bash and zsh completions from the same versioned binary.
    
      38    install -d "${pkgdir}/usr/share/bash-completion/completions"
    
      39    "${srcdir}/mise/bin/mise" completion bash > "${pkgdir}/usr/share/bash-completion/completions/mise"
    
      40    install -d "${pkgdir}/usr/share/zsh/site-functions"
    
      41    "${srcdir}/mise/bin/mise" completion zsh > "${pkgdir}/usr/share/zsh/site-functions/_mise"
    
      42
    
      43    # license
    
      44    install -Dm644 "${srcdir}/mise/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # docs
    
      47    install -Dm644 "${srcdir}/mise/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,6 +1,6 @@
 # Maintainer: czyt <czytcn@gmail.com>
 pkgname=mise-musl-bin
-pkgver=2026.10.9
+pkgver=2026.10.10
 pkgrel=1
 pkgdesc="Portable musl build of mise: dev tools, env vars, task runner"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 replaces=('rtx')
 source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64-musl.tar.xz")
 source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64-musl.tar.xz")
-sha256sums_x86_64=('02125333078ee2b64fa9011229ee07ca8e1e5949d406ad7c4829f100b5641be4')
-sha256sums_aarch64=('9d81a48ab67720baf7b9f6b182598452647ccb969f69a438f3982f541b5eb917')
+sha256sums_x86_64=('f725bf2bb7c4beac4d71a31854ba9c351c99ae4cff61fdffe9ee4edf3f779cc9')
+sha256sums_aarch64=('2581288056e44f35133a684af63966a62ec04aec5434ce84c19c60d876902690')
 
 package() {
     install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 05:14:45	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 05:10:54	Medium	1
2026-10-15 00:28:05	Low	2
2026-10-14 05:19:21	Medium	1
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 07:12:50	Medium	1
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 08:13:38	Medium	1
2026-10-10 00:11:52	Low	2
2026-10-09 08:10:33	Medium	1
2026-10-09 00:05:33	Low	2
2026-10-08 08:08:18	Medium	1
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 08:02:16	Medium	1
2026-10-06 00:13:36	Low	2