moonbit-bin

LOW

maintainer Lampese 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from a project-owned but non-whitelisted host; however, the files are verified via pinned checksums, and the content is a legitimate language platform's runtime and tooling, not malicious code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from a project-owned but non-whitelisted host; however, the files are verified via pinned checksums, and the content is a legitimate language platform's runtime and tooling, not malicious code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://cli.moonbitlang.cn/binaries/latest/moonbit-linux-x86_64.tar.gz#filename=${pkgname}-${pkgver}-linux-x86_64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=moonbit-bin
    
      2pkgver=0.1.20261023
    
      3pkgrel=2
    
      4pkgdesc="Intelligent developer platform for Cloud and Edge using WASM"
    
      5arch=('x86_64')
    
      6url="https://www.moonbitlang.com/"
    
      7license=('unknown')
    
      8depends=('tar' 'glibc' 'gcc-libs' 'git')
    
      9provides=("moonbit")
    
      10conflicts=("moonbit" "moon-bin")
    
      11options=('!debug')
    
      12_origin="https://cli.moonbitlang.com"
    
      13# MoonBit's install script builds .../binaries/$version/ and .../cores/core-$version.tar.gz,
    
      14# but dated versions (for example binaries/0.1.20261023/) are not published: S3
    
      15# returns AccessDenied. The public channels are "latest" and "nightly".
    
      16# pkgver is taken from `moon version` (PATH or MOONC_OVERRIDE must point at the
    
      17# bundled moonc) and the checksum is pinned to that exact tarball. Once "latest"
    
      18# moves, an old PKGBUILD's checksum no longer matches; the scheduled updater
    
      19# republishes so the pin stays current. The #filename= fragment keeps makepkg
    
      20# from reusing a previous download that shared the remote name.
    
      21source=("https://cli.moonbitlang.cn/binaries/latest/moonbit-linux-x86_64.tar.gz#filename=${pkgname}-${pkgver}-linux-x86_64.tar.gz"
    
      22  "https://cli.moonbitlang.cn/cores/core-latest.tar.gz#filename=moonbit-core-${pkgver}.tar.gz"
    
      23  "moon.sh")
    
      24
    
      25package() {
    
      26  # Install main runtime binary (kept under /usr/lib so the wrapper can live in /usr/bin)
    
      27  install -Dm 755 "${srcdir}/bin/moon" "${pkgdir}/usr/lib/moon"
    
      28
    
      29  # Install wrapper CLI (moon.sh) as the user-facing /usr/bin/moon
    
      30  install -Dm 755 "${srcdir}/moon.sh" "${pkgdir}/usr/bin/moon"
    
      31
    
      32  # Install all top-level executables from src/bin (except the main runtime and internal/)
    
      33  mkdir -p "${pkgdir}/usr/bin"
    
      34  for _f in "${srcdir}/bin/"*; do
    
      35    case "$(basename "$_f")" in
    
      36      moon) continue ;; # already installed to /usr/lib
    
      37      internal) continue ;; # packaged under share
    
      38      *.wasm) continue ;; # handled separately
    
      39    esac
    
      40    if [ -f "$_f" ]; then
    
      41      install -Dm 755 "$_f" "${pkgdir}/usr/bin/$(basename "$_f")"
    
      42    fi
    
      43  done
    
      44
    
      45  # Place wasm/runtime assets and the language core into /usr/share/moonbit/lib
    
      46  mkdir -p "${pkgdir}/usr/share/moonbit/lib"
    
      47  # copy any wasm helpers from bin (if present)
    
      48  if compgen -G "${srcdir}/bin/*.wasm" >/dev/null 2>&1; then
    
      49    cp -a "${srcdir}/bin/"*.wasm "${pkgdir}/usr/share/moonbit/lib/"
    
      50  fi
    
      51  # copy the language core tree
    
      52  cp -a "${srcdir}/core" "${pkgdir}/usr/share/moonbit/lib/"
    
      53
    
      54  # Install headers for developers who may build against the runtime
    
      55  if [ -d "${srcdir}/include" ]; then
    
      56    mkdir -p "${pkgdir}/usr/include/moonbit"
    
      57    cp -a "${srcdir}/include/"* "${pkgdir}/usr/include/moonbit/"
    
      58  fi
    
      59
    
      60  # Install raw libs/objects into /usr/lib/moonbit (for debugging or embedding)
    
      61  if [ -d "${srcdir}/lib" ]; then
    
      62    mkdir -p "${pkgdir}/usr/lib/moonbit"
    
      63    cp -a "${srcdir}/lib/"* "${pkgdir}/usr/lib/moonbit/" || true
    
      64  fi
    
      65
    
      66  # Internal tooling and packaged node assets go under /usr/share/moonbit/internal
    
      67  if [ -d "${srcdir}/bin/internal" ]; then
    
      68    mkdir -p "${pkgdir}/usr/share/moonbit/internal"
    
      69    cp -a "${srcdir}/bin/internal" "${pkgdir}/usr/share/moonbit/internal/"
    
      70  fi
    
      71}
    
      72sha256sums=('d0a96eaf91c77cfcdd7b7df75390c5a1a95d0b8a328b1a5ed6fee050cfbf8d50'
    
      73            '2d837ecbef5933c09726d63682a7695123d622e6aee13525fbc98c4b49433714'
    
      74            'a7ba404eb6995d8573e81fbe6c302fa5de96081585dc0420d29e4b419056c6a3')
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,13 +1,13 @@
 pkgname=moonbit-bin
 pkgver=0.1.20261023
-pkgrel=1
+pkgrel=2
 pkgdesc="Intelligent developer platform for Cloud and Edge using WASM"
 arch=('x86_64')
 url="https://www.moonbitlang.com/"
 license=('unknown')
 depends=('tar' 'glibc' 'gcc-libs' 'git')
 provides=("moonbit")
-conflicts=("moonbit")
+conflicts=("moonbit" "moon-bin")
 options=('!debug')
 _origin="https://cli.moonbitlang.com"
 # MoonBit's install script builds .../binaries/$version/ and .../cores/core-$version.tar.gz,

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 05:51:59	Medium	1
2026-10-29 00:13:55	Low	2
2026-10-28 07:49:59	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 03:46:34	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2