bozohttpd

maintainer mrxx · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's official URL archived on web.archive.org, which is a reliable source; building from archived upstream source is normal for AUR packages and poses no real risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official URL archived on web.archive.org, which is a reliable source; building from archived upstream source is normal for AUR packages and poses no real risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://web.archive.org/web/20231024192659/${url}/${pkgname}-${pkgver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  mrxx <mrxx at cyberhome dot at>
    
      2# Contributors: Se7endAY, Nathan Owe <ndowens04 at gmail>, tamjan <tsjk at hotmail>
    
      3
    
      4pkgname=bozohttpd
    
      5pkgver=20220517
    
      6pkgrel=1
    
      7pkgdesc="A small and secure HTTP version 1.1 server"
    
      8arch=('i686' 'x86_64' 'armv6h')
    
      9url="http://www.eterna.com.au/bozohttpd/"
    
      10license=('BSD')
    
      11depends=('openssl' 'lua')
    
      12optdepends=('php-cgi')
    
      13source=("https://web.archive.org/web/20231024192659/${url}/${pkgname}-${pkgver}.tar.bz2"
    
      14	'bozohttpd.service'
    
      15	'bozohttpd_ssl.service'
    
      16	'bozohttpd.install'
    
      17	'sample.cgi'
    
      18	'sample_perl.cgi'
    
      19	'LICENSE'
    
      20)
    
      21sha256sums=('9bfd0942a0876e5529b0d962ddbcf50473bcf84cf5e4447043e4a0f4ea65597a'
    
      22            '8333eccd1c35d5001342c6130112105f1f6633ca70a7ca3c0d9ca4ccfe03db2c'
    
      23            '660240d1b3389591a0320bc7ccc0b8bcb0c8b2a533177bb0836b2f4db4569bb9'
    
      24            '11f5ea1a3a0d84bcf49418406533e4f43ce2285125f9a4194ce5e76e3f89a748'
    
      25            '461e0609e1cd8056cb24b06e21cbe8755bfe7166cc6348c8b5ded40895307766'
    
      26            '341aeec49ee05d601d458c278c819727f68a7b4164348cce34a231761bda57c0'
    
      27            '859cb6bc2ccf1864e185d32bc35ee81cb04b51e3e4c1f667fea1cf41f505e6c4')
    
      28install=bozohttpd.install
    
      29
    
      30build()
    
      31{
    
      32	cd "${pkgname}-${pkgver}"
    
      33
    
      34	mv Makefile.boot Makefile || return 1
    
      35
    
      36	sed -i 's/d_namlen/d_reclen/g' bozohttpd.c
    
      37
    
      38	# Fix php-cgi regression
    
      39	sed -i '591d' cgi-bozo.c
    
      40
    
      41	# Include stdint.h
    
      42	sed -i '/.*stdbool\.h.*/a #include <stdint.h>' bozohttpd.h
    
      43
    
      44	# Blocklist support is for NetBSD only, hence the addition of -DNO_BLOCKLIST_SUPPORT
    
      45	make LARGE_CFLAGS="" LOCAL_CFLAGS="" OPT="${CFLAGS}" CPPFLAGS="${CPPFLAGS} \
    
      46		-DNO_BLOCKLIST_SUPPORT -DDO_HTPASSWD -D_GNU_SOURCE -D_DEFAULT_SOURCE" \
    
      47		CRYPTOLIBS="-lcrypto -lssl -lcrypt" EXTRALIBS="-llua" || return 1
    
      48}
    
      49
    
      50package()
    
      51{
    
      52	cd "${pkgname}-${pkgver}"
    
      53	mkdir -p "${pkgdir}"/usr/{bin,lib/cgi-bin,share/{${pkgname},man/man8}}
    
      54	install -D testsuite/*.* testsuite/data/*.* "${pkgdir}/usr/share/${pkgname}/"
    
      55	install -D *.lua "${pkgdir}/usr/lib/cgi-bin/"
    
      56	install -m755 bozohttpd "${pkgdir}/usr/bin/"
    
      57	install -m644 bozohttpd.8 "${pkgdir}/usr/share/man/man8/"
    
      58	cd "$srcdir"
    
      59	install -Dm644 bozohttpd.service "${pkgdir}"/usr/lib/systemd/system/bozohttpd.service
    
      60	install -Dm644 bozohttpd_ssl.service "${pkgdir}"/usr/lib/systemd/system/bozohttpd_ssl.service
    
      61	install -D *.cgi "${pkgdir}/usr/lib/cgi-bin/"
    
      62	install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2