micdn

maintainer chaostone · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The .install script performs standard post-install setup (config file, systemd integration, directory permissions) using safe, transparent commands; no remote code execution, obfuscation, or unauthorized privilege escalation is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The .install script performs standard post-install setup (config file, systemd integration, directory permissions) using safe, transparent commands; no remote code execution, obfuscation, or unauthorized privilege escalation is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

.install:13 chmod 2775 /var/cache/micdn /var/cache/micdn/asset /var/cache/micdn/www 2>/dev/null || :
.install:14 chmod 2775 /var/lib/micdn /var/lib/micdn/blob /var/lib/micdn/maven \
.install:16 chmod 2775 /var/log/micdn 2>/dev/null || :

PKGBUILD

      1# 上游模板：micdn/scripts/package/PKGBUILD.proto
    
      2# 维护目录：~/aur-packages/micdn
    
      3
    
      4pkgname=micdn
    
      5pkgver=0.3.1
    
      6pkgrel=1
    
      7pkgdesc="Beangle minimal CDN (static, Maven, npm, blob, www)"
    
      8arch=('x86_64')
    
      9url='https://github.com/beangle/micdn'
    
      10license=('GPL-3.0-or-later')
    
      11depends=('curl')
    
      12makedepends=('ldc' 'dub' 'git' 'zlib' 'openssl')
    
      13optdepends=(
    
      14  'systemd: service unit micdn.service'
    
      15)
    
      16backup=('etc/micdn/micdn.xml')
    
      17install=micdn.install
    
      18source=(
    
      19  "git+https://github.com/beangle/micdn.git#tag=v${pkgver}"
    
      20  "micdn.install"
    
      21  "micdn.sysusers"
    
      22  "micdn.tmpfiles"
    
      23)
    
      24sha256sums=('SKIP'
    
      25            '8333910bf21675e99d5545262f26ac5027c0210b58dd8ce10510c79b61be3de6'
    
      26            '346a3b0bdb0fd0737be566b1a9aba853fb9f1361b70ddc14e33719d57ce078f9'
    
      27            'd80affc81230b473551692a51165df4be18daf9b93d8d3d780711598f1c2405f')
    
      28
    
      29prepare() {
    
      30  cd micdn
    
      31  dub fetch
    
      32}
    
      33
    
      34build() {
    
      35  cd micdn
    
      36  dub build --build=release-nobounds --compiler=ldc2
    
      37}
    
      38
    
      39# 可选：chroot 内单测失败时可整段注释
    
      40check() {
    
      41  cd micdn
    
      42  dub test --config=unittest --compiler=ldc2
    
      43}
    
      44
    
      45package() {
    
      46  cd micdn
    
      47
    
      48  install -Dm755 target/micdn "$pkgdir/usr/bin/micdn"
    
      49  # v0.3.1 的 xi:include 展开会把注释示例行（<!-- <xi:include href="blob.xml"/> -->）当真实指令，
    
      50  # 导致默认配置启动即 exit 2；上游保留此 bug，打包时剔除该行，保证全新安装默认配置可启动。
    
      51  install -Dm644 scripts/package/micdn.xml "$pkgdir/usr/share/micdn/micdn.xml.default"
    
      52  sed -i '/<xi:include href="blob.xml"/d' "$pkgdir/usr/share/micdn/micdn.xml.default"
    
      53  install -Dm644 scripts/package/micdn.service "$pkgdir/usr/lib/systemd/system/micdn.service"
    
      54  install -Dm644 "$srcdir/micdn.sysusers" "$pkgdir/usr/lib/sysusers.d/micdn.conf"
    
      55  install -Dm644 "$srcdir/micdn.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/micdn.conf"
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # 维护目录：~/aur-packages/micdn
 
 pkgname=micdn
-pkgver=0.2.3
+pkgver=0.3.1
 pkgrel=1
 pkgdesc="Beangle minimal CDN (static, Maven, npm, blob, www)"
 arch=('x86_64')
@@ -21,8 +21,8 @@
   "micdn.sysusers"
   "micdn.tmpfiles"
 )
-sha256sums=('8187f3381a9efcfca603977feced1efec623ea87e9453f9be3915ff395dda870'
-            'f5feb564ee3d732263ef4b1b52e573f918b05b75b4063be6e85fbdc882830888'
+sha256sums=('SKIP'
+            '8333910bf21675e99d5545262f26ac5027c0210b58dd8ce10510c79b61be3de6'
             '346a3b0bdb0fd0737be566b1a9aba853fb9f1361b70ddc14e33719d57ce078f9'
             'd80affc81230b473551692a51165df4be18daf9b93d8d3d780711598f1c2405f')
 
@@ -46,7 +46,10 @@
   cd micdn
 
   install -Dm755 target/micdn "$pkgdir/usr/bin/micdn"
+  # v0.3.1 的 xi:include 展开会把注释示例行（<!-- <xi:include href="blob.xml"/> -->）当真实指令，
+  # 导致默认配置启动即 exit 2；上游保留此 bug，打包时剔除该行，保证全新安装默认配置可启动。
   install -Dm644 scripts/package/micdn.xml "$pkgdir/usr/share/micdn/micdn.xml.default"
+  sed -i '/<xi:include href="blob.xml"/d' "$pkgdir/usr/share/micdn/micdn.xml.default"
   install -Dm644 scripts/package/micdn.service "$pkgdir/usr/lib/systemd/system/micdn.service"
   install -Dm644 "$srcdir/micdn.sysusers" "$pkgdir/usr/lib/sysusers.d/micdn.conf"
   install -Dm644 "$srcdir/micdn.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/micdn.conf"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 07:28:04	MEDIUM	1
2026-08-14 05:27:47	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0