micdn

LOW

maintainer chaostone 1 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The .install script performs standard post-install setup (config file, systemd integration, directory permissions) using safe, transparent commands; no remote code execution, obfuscation, or unauthorized privilege escalation is present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The .install script performs standard post-install setup (config file, systemd integration, directory permissions) using safe, transparent commands; no remote code execution, obfuscation, or unauthorized privilege escalation is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:13 chmod 2775 /var/cache/micdn /var/cache/micdn/asset /var/cache/micdn/www 2>/dev/null || :
.install:14 chmod 2775 /var/lib/micdn /var/lib/micdn/blob /var/lib/micdn/maven \
.install:16 chmod 2775 /var/log/micdn 2>/dev/null || :

PKGBUILD

      1# 上游模板：micdn/scripts/package/PKGBUILD.proto
    
      2# 维护目录：~/aur-packages/micdn
    
      3
    
      4pkgname=micdn
    
      5pkgver=0.3.1
    
      6pkgrel=1
    
      7pkgdesc="Beangle minimal CDN (static, Maven, npm, blob, www)"
    
      8arch=('x86_64')
    
      9url='https://github.com/beangle/micdn'
    
      10license=('GPL-3.0-or-later')
    
      11depends=('curl')
    
      12makedepends=('ldc' 'dub' 'git' 'zlib' 'openssl')
    
      13optdepends=(
    
      14  'systemd: service unit micdn.service'
    
      15)
    
      16backup=('etc/micdn/micdn.xml')
    
      17install=micdn.install
    
      18source=(
    
      19  "git+https://github.com/beangle/micdn.git#tag=v${pkgver}"
    
      20  "micdn.install"
    
      21  "micdn.sysusers"
    
      22  "micdn.tmpfiles"
    
      23)
    
      24sha256sums=('SKIP'
    
      25            '8333910bf21675e99d5545262f26ac5027c0210b58dd8ce10510c79b61be3de6'
    
      26            '346a3b0bdb0fd0737be566b1a9aba853fb9f1361b70ddc14e33719d57ce078f9'
    
      27            'd80affc81230b473551692a51165df4be18daf9b93d8d3d780711598f1c2405f')
    
      28
    
      29prepare() {
    
      30  cd micdn
    
      31  dub fetch
    
      32}
    
      33
    
      34build() {
    
      35  cd micdn
    
      36  dub build --build=release-nobounds --compiler=ldc2
    
      37}
    
      38
    
      39# 可选：chroot 内单测失败时可整段注释
    
      40check() {
    
      41  cd micdn
    
      42  dub test --config=unittest --compiler=ldc2
    
      43}
    
      44
    
      45package() {
    
      46  cd micdn
    
      47
    
      48  install -Dm755 target/micdn "$pkgdir/usr/bin/micdn"
    
      49  # v0.3.1 的 xi:include 展开会把注释示例行（<!-- <xi:include href="blob.xml"/> -->）当真实指令，
    
      50  # 导致默认配置启动即 exit 2；上游保留此 bug，打包时剔除该行，保证全新安装默认配置可启动。
    
      51  install -Dm644 scripts/package/micdn.xml "$pkgdir/usr/share/micdn/micdn.xml.default"
    
      52  sed -i '/<xi:include href="blob.xml"/d' "$pkgdir/usr/share/micdn/micdn.xml.default"
    
      53  install -Dm644 scripts/package/micdn.service "$pkgdir/usr/lib/systemd/system/micdn.service"
    
      54  install -Dm644 "$srcdir/micdn.sysusers" "$pkgdir/usr/lib/sysusers.d/micdn.conf"
    
      55  install -Dm644 "$srcdir/micdn.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/micdn.conf"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2