moonbit-bin

maintainer Lampese · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries and core assets from a non-whitelisted but project-associated host (cli.moonbitlang.cn); while the host is not standard, it is plausibly official, checksums are provided, and the installed files are runtime components and assets, not obfuscated or executable scripts.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries and core assets from a non-whitelisted but project-associated host (cli.moonbitlang.cn); while the host is not standard, it is plausibly official, checksums are provided, and the installed files are runtime components and assets, not obfuscated or executable scripts.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://cli.moonbitlang.cn/binaries/latest/moonbit-linux-x86_64.tar.gz#filename=${pkgname}-${pkgver}-linux-x86_64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=moonbit-bin
    
      2pkgver=0.1.20260330
    
      3pkgrel=1
    
      4pkgdesc="Intelligent developer platform for Cloud and Edge using WASM"
    
      5arch=('x86_64')
    
      6url="https://www.moonbitlang.com/"
    
      7license=('unknown')
    
      8depends=('tar' 'glibc' 'gcc-libs' 'git')
    
      9provides=("moonbit")
    
      10conflicts=("moonbit")
    
      11options=('!debug')
    
      12_origin="https://cli.moonbitlang.com"
    
      13# Save downloads with a versioned local filename to avoid reusing an older
    
      14# file that happens to have the same remote name (e.g. "latest/*.tar.gz").
    
      15# This uses the URL fragment "#filename=" supported by makepkg.
    
      16source=("https://cli.moonbitlang.cn/binaries/latest/moonbit-linux-x86_64.tar.gz#filename=${pkgname}-${pkgver}-linux-x86_64.tar.gz"
    
      17  "https://cli.moonbitlang.cn/cores/core-latest.tar.gz#filename=moonbit-core-${pkgver}.tar.gz"
    
      18  "moon.sh")
    
      19
    
      20# NOTE: After updating `pkgver`, update the corresponding `sha256sums`.
    
      21# If a cached file with the old name exists in the build `src/` directory,
    
      22# remove it (or run `makepkg -C`) so makepkg downloads the new file.
    
      23
    
      24package() {
    
      25  # Install main runtime binary (kept under /usr/lib so the wrapper can live in /usr/bin)
    
      26  install -Dm 755 "${srcdir}/bin/moon" "${pkgdir}/usr/lib/moon"
    
      27
    
      28  # Install wrapper CLI (moon.sh) as the user-facing /usr/bin/moon
    
      29  install -Dm 755 "${srcdir}/moon.sh" "${pkgdir}/usr/bin/moon"
    
      30
    
      31  # Install all top-level executables from src/bin (except the main runtime and internal/)
    
      32  mkdir -p "${pkgdir}/usr/bin"
    
      33  for _f in "${srcdir}/bin/"*; do
    
      34    case "$(basename "$_f")" in
    
      35      moon) continue ;; # already installed to /usr/lib
    
      36      internal) continue ;; # packaged under share
    
      37      *.wasm) continue ;; # handled separately
    
      38    esac
    
      39    if [ -f "$_f" ]; then
    
      40      install -Dm 755 "$_f" "${pkgdir}/usr/bin/$(basename "$_f")"
    
      41    fi
    
      42  done
    
      43
    
      44  # Place wasm/runtime assets and the language core into /usr/share/moonbit/lib
    
      45  mkdir -p "${pkgdir}/usr/share/moonbit/lib"
    
      46  # copy any wasm helpers from bin (if present)
    
      47  if compgen -G "${srcdir}/bin/*.wasm" >/dev/null 2>&1; then
    
      48    cp -a "${srcdir}/bin/"*.wasm "${pkgdir}/usr/share/moonbit/lib/"
    
      49  fi
    
      50  # copy the language core tree
    
      51  cp -a "${srcdir}/core" "${pkgdir}/usr/share/moonbit/lib/"
    
      52
    
      53  # Install headers for developers who may build against the runtime
    
      54  if [ -d "${srcdir}/include" ]; then
    
      55    mkdir -p "${pkgdir}/usr/include/moonbit"
    
      56    cp -a "${srcdir}/include/"* "${pkgdir}/usr/include/moonbit/"
    
      57  fi
    
      58
    
      59  # Install raw libs/objects into /usr/lib/moonbit (for debugging or embedding)
    
      60  if [ -d "${srcdir}/lib" ]; then
    
      61    mkdir -p "${pkgdir}/usr/lib/moonbit"
    
      62    cp -a "${srcdir}/lib/"* "${pkgdir}/usr/lib/moonbit/" || true
    
      63  fi
    
      64
    
      65  # Internal tooling and packaged node assets go under /usr/share/moonbit/internal
    
      66  if [ -d "${srcdir}/bin/internal" ]; then
    
      67    mkdir -p "${pkgdir}/usr/share/moonbit/internal"
    
      68    cp -a "${srcdir}/bin/internal" "${pkgdir}/usr/share/moonbit/internal/"
    
      69  fi
    
      70}
    
      71sha256sums=('4d9f811fce8b10de29292f1b7606b8acf2adf0e84d42ea62ace8ca8600783c84'
    
      72            '1900367fef9d09f1e7dc6b0a5226daaf8ceaecaa84d0e3fa2bb66b0aba47f139'
    
      73            'a7ba404eb6995d8573e81fbe6c302fa5de96081585dc0420d29e4b419056c6a3')
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2