mise-musl-bin

LOW

maintainer czyt 0 votes scanned 2026-08-26 11:31:48.695587

View on AUR

Why flagged

Downloads official prebuilt musl binaries from the project's own GitHub releases with pinned SHA256 checksums; the flagged 'self-update' concern is actually a disable-self-update sentinel file, which is correct pacman packaging practice; running the binary to generate completions is standard and low-risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads official prebuilt musl binaries from the project's own GitHub releases with pinned SHA256 checksums; the flagged 'self-update' concern is actually a disable-self-update sentinel file, which is correct pacman packaging practice; running the binary to generate completions is standard and low-risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:27 install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=mise-musl-bin
    
      3pkgver=2026.8.14
    
      4pkgrel=2
    
      5pkgdesc="Portable musl build of mise: dev tools, env vars, task runner"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/jdx/mise"
    
      8license=('MIT')
    
      9options=('!debug')
    
      10optdepends=(
    
      11    'bash-completion: bash completion support'
    
      12    'fish: fish completion and automatic environment activation'
    
      13    'zsh: zsh completion support'
    
      14)
    
      15provides=('mise')
    
      16conflicts=('mise' 'mise-bin' 'rtx')
    
      17replaces=('rtx')
    
      18source_x86_64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-x64-musl.tar.xz")
    
      19source_aarch64=("https://github.com/jdx/mise/releases/download/v${pkgver}/mise-v${pkgver}-linux-arm64-musl.tar.xz")
    
      20sha256sums_x86_64=('d04e9d8841cb291f31681b0ef304453d41ee7367c23dc431bba3406cdf3f1bce')
    
      21sha256sums_aarch64=('9186ee7019902572bb4fc1f48cc8f48cafe3c19a75d63484ebd1e79c2f5698a0')
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/mise/bin/mise" "${pkgdir}/usr/bin/mise"
    
      25
    
      26    # disable mise self-update (managed by pacman)
    
      27    install -Dm644 /dev/null "${pkgdir}/usr/lib/mise/.disable-self-update"
    
      28
    
      29    # man page
    
      30    install -Dm644 "${srcdir}/mise/man/man1/mise.1" "${pkgdir}/usr/share/man/man1/mise.1"
    
      31
    
      32    # fish automatically loads both vendor completions and vendor conf files.
    
      33    install -d "${pkgdir}/usr/share/fish/vendor_completions.d"
    
      34    "${srcdir}/mise/bin/mise" completion fish > "${pkgdir}/usr/share/fish/vendor_completions.d/mise.fish"
    
      35    install -Dm644 "${srcdir}/mise/share/fish/vendor_conf.d/mise-activate.fish" "${pkgdir}/usr/share/fish/vendor_conf.d/mise-activate.fish"
    
      36
    
      37    # Generate bash and zsh completions from the same versioned binary.
    
      38    install -d "${pkgdir}/usr/share/bash-completion/completions"
    
      39    "${srcdir}/mise/bin/mise" completion bash > "${pkgdir}/usr/share/bash-completion/completions/mise"
    
      40    install -d "${pkgdir}/usr/share/zsh/site-functions"
    
      41    "${srcdir}/mise/bin/mise" completion zsh > "${pkgdir}/usr/share/zsh/site-functions/_mise"
    
      42
    
      43    # license
    
      44    install -Dm644 "${srcdir}/mise/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # docs
    
      47    install -Dm644 "${srcdir}/mise/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 11:31:48	Low	3
2026-08-26 11:30:20	Medium	2