From f1e0ca526d702e10100394a821f19b6779ca11f7 Mon Sep 17 00:00:00 2001
From: default <216188+jdx@users.noreply.github.com>
Date: Sun, 23 Aug 2026 22:08:33 +0000
Subject: [PATCH] fix(mise-bin): delay upstream releases for 24 hours
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

*AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.*
---
 pkgbuilds/mise-bin/.omarchy/upstream.sh | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkgbuilds/mise-bin/.omarchy/upstream.sh b/pkgbuilds/mise-bin/.omarchy/upstream.sh
index 53e666a..365063d 100644
--- a/pkgbuilds/mise-bin/.omarchy/upstream.sh
+++ b/pkgbuilds/mise-bin/.omarchy/upstream.sh
@@ -4,12 +4,31 @@ set -euo pipefail
 repo="jdx/mise"
 release=$(curl -fsSL "https://api.github.com/repos/$repo/releases/latest")
 tag=$(jq -r '.tag_name // empty' <<<"$release")
+published_at=$(jq -r '.published_at // empty' <<<"$release")
 
 if [[ ! "$tag" =~ ^v([A-Za-z0-9._+]+)$ ]]; then
   echo "Latest mise release has an invalid tag: ${tag:-<empty>}" >&2
   exit 1
 fi
 
+if [[ -z "$published_at" ]] || ! published_epoch=$(date --date="$published_at" +%s); then
+  echo "Latest mise release has an invalid published_at: ${published_at:-<empty>}" >&2
+  exit 1
+fi
+
+# Keep a compromised mise release from reaching Omarchy before there has been
+# a full day for maintainers and the community to notice and pull it.
+minimum_release_age_seconds=$((24 * 60 * 60))
+now=$(date +%s)
+if (( now - published_epoch < minimum_release_age_seconds )); then
+  if [[ "${MISE_BIN_BYPASS_RELEASE_AGE:-}" == "1" ]]; then
+    echo "Bypassing mise release-age gate for $tag" >&2
+  else
+    echo '{}'
+    exit 0
+  fi
+fi
+
 pkgver=${BASH_REMATCH[1]}
 checksums=$(curl -fsSL \
   "https://github.com/$repo/releases/download/$tag/SHASUMS256.txt")