hiawatha

LOW

maintainer Kewl 2 votes scanned 2026-09-26 00:12:15.973514

View on AUR

Why flagged

The source is a tarball from the official project domain (hiawatha.leisink.net), which is the developer's own site; building from the project's official source, even on a non-whitelisted host, is standard and safe for AUR packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project domain (hiawatha.leisink.net), which is the developer's own site; building from the project's official source, even on a non-whitelisted host, is standard and safe for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://hiawatha.leisink.net/files/download/$pkgname-$pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainner: Kewl <kewl at alto dot eu dot org>
    
      2# Contributor: Kyle Keen <keenerd@gmail.com>
    
      3# Contributor: Kurt Marasco <celilo _at_ lavabit _dot_ com>
    
      4# Contributor: Pascal Ernster <aur at hardfalcon dot net>
    
      5_watch=('https://hiawatha.leisink.net/changelog' 'body' 'regex' '\"version\">(\d[\d.]*\d+)<' 'pkgver')
    
      6
    
      7pkgname=hiawatha
    
      8pkgver=12.4
    
      9pkgrel=1
    
      10pkgdesc="Secure and advanced webserver"
    
      11url="https://hiawatha.leisink.net/"
    
      12arch=('x86_64')
    
      13license=('GPL2')
    
      14depends=('libxslt' 'libxcrypt')
    
      15optdepends=('php-fpm: PHP fastcgi'
    
      16            'php: letsencrypt/lefh')
    
      17makedepends=('cmake' 'python')
    
      18backup=('etc/hiawatha/hiawatha.conf'
    
      19        'etc/hiawatha/cgi-wrapper.conf'
    
      20        'etc/hiawatha/mimetype.conf')
    
      21source=("https://hiawatha.leisink.net/files/download/$pkgname-$pkgver.tar.gz" 
    
      22        'hiawatha.conf.sample'
    
      23        'hiawatha.service'
    
      24        'lefh-renew.service'
    
      25        'lefh-renew.timer')
    
      26sha256sums=('c80f87b5f9f04520b57af96ac52905198f96de38c3b7d988abc0f758cdd46d2e'
    
      27            '4671d2586cbe3cd6497b16ff422c6143cdab40641ef3c9c4988c478351a8f5e7'
    
      28            'b5a2671703b52eec376cfc4697b86aafa4f7fdd9b2b9203798e2117770bafa53'
    
      29            '2598480f8b249aaf7028ea66bac0195e1c017fb17c2c169b69e0b66413728457'
    
      30            'd12c5a68c293f66d95ae4df704ea349adbad972fb25475ab1a0a24fb42bfc70b')
    
      31
    
      32prepare() {
    
      33  cd "$srcdir/$pkgname-$pkgver"
    
      34  sed -i 's/www-data/http/g' extra/logrotate.in
    
      35
    
      36  # Update stock hiawatha.conf
    
      37  sed -e 's|#ServerId = www-data|ServerId = http|' \
    
      38      -e 's|/var/www/|/srv/http/|g' \
    
      39      -e 's|//|/|g' \
    
      40      -e 's|#CGIextension = cgi|&\n#TriggerOnCGIstatus = no|g' \
    
      41      -e 's|ConnectTo = 127.0.0.1:2005|ConnectTo = 127.0.0.1:9000|g' \
    
      42      -e 's|#	Extension = php|&\n#       SessionTimeout = 30|g' \
    
      43      -e 's|#ErrorHandler = 404:/error.cgi|&\n#UseGZfile = yes|g' \
    
      44      -i config/hiawatha.conf.in
    
      45  
    
      46  sed -e 's|/etc/init.d/hiawatha restart|systemctl restart hiawatha.service|' \
    
      47      -i extra/letsencrypt/letsencrypt.conf.in
    
      48
    
      49  # Fix signal handler prototypes for GCC >= 12
    
      50  sed -i 's/void \([A-Z0-9_]*_handler\)()/void \1(int sig)/g' src/hiawatha.c
    
      51  sed -i 's/void \([A-Z0-9_]*_handler\)()/void \1(int sig)/g' src/cgi-wrapper.c
    
      52
    
      53  # Add (void)sig; to silence unused warnings if handler doesn't use the signal
    
      54  sed -i '/^{/a \    (void)sig;' src/hiawatha.c
    
      55  sed -i '/^{/a \    (void)sig;' src/cgi-wrapper.c
    
      56}
    
      57
    
      58build() {
    
      59  cd "$srcdir/$pkgname-$pkgver"
    
      60  mkdir -p build
    
      61  cd build
    
      62
    
      63  cmake ../ -DCMAKE_INSTALL_PREFIX="/" \
    
      64            -DCMAKE_INSTALL_BINDIR="/usr/bin" \
    
      65            -DCMAKE_INSTALL_SBINDIR="/usr/bin" \
    
      66            -DCMAKE_INSTALL_SYSCONFDIR="/etc/hiawatha" \
    
      67            -DCMAKE_INSTALL_LIBDIR="/usr/lib" \
    
      68            -DCMAKE_INSTALL_MANDIR="/usr/share/man" \
    
      69            -DCONFIG_DIR="/etc/hiawatha" \
    
      70            -DLOG_DIR="/var/log/hiawatha" \
    
      71            -DPID_DIR="/run" \
    
      72            -DENABLE_TLS=ON \
    
      73            -DUSE_SYSTEM_MBEDTLS=OFF \
    
      74            -DENABLE_MONITOR=ON \
    
      75            -DWEBROOT_DIR="/srv/http/hiawatha" \
    
      76            -DWORK_DIR="/var/lib/hiawatha" \
    
      77            -DCMAKE_POLICY_VERSION_MINIMUM=3.5
    
      78
    
      79  make
    
      80
    
      81  # Features enabled by default
    
      82  # -DENABLE_CACHE
    
      83  # -DENABLE_IPV6
    
      84  # -DENABLE_RPROXY
    
      85  # -DENABLE_TOOLKIT
    
      86  # -DENABLE_XSLT
    
      87
    
      88  # Features disabled by default
    
      89  # -DENABLE_DEBUG
    
      90  # -DENABLE_TOMAHAWK
    
      91
    
      92  # Arch mbedtls is built without MBEDTLS_THREADING_{C,PTHREAD}, which
    
      93  # Hiawatha requires. Use the bundled copy (installed to /usr/lib/hiawatha).
    
      94}
    
      95
    
      96package() {
    
      97  cd "$srcdir/$pkgname-$pkgver/build"
    
      98  make DESTDIR="$pkgdir/" install
    
      99 
    
      100  rmdir "$pkgdir/run"
    
      101  rm "$pkgdir/srv/http/hiawatha/index.html"
    
      102  rmdir -p --ignore-fail-on-non-empty "$pkgdir/srv/http/hiawatha"
    
      103 
    
      104  install -Dm644 logrotate.d/hiawatha "$pkgdir/etc/logrotate.d/hiawatha"
    
      105  cd "$srcdir"
    
      106  install -Dm644 hiawatha.service   "$pkgdir/usr/lib/systemd/system/hiawatha.service"
    
      107  install -Dm644 lefh-renew.service "$pkgdir/usr/lib/systemd/system/lefh-renew.service"
    
      108  install -Dm644 lefh-renew.timer   "$pkgdir/usr/lib/systemd/system/lefh-renew.timer"
    
      109  install -Dm644 hiawatha.conf.sample "$pkgdir/etc/hiawatha/"
    
      110}
    
      111
    
      112

Changes since previous scan

--- PKGBUILD @ 2026-08-15 00:26
+++ PKGBUILD @ 2026-09-26 00:12
@@ -5,8 +5,8 @@
 _watch=('https://hiawatha.leisink.net/changelog' 'body' 'regex' '\"version\">(\d[\d.]*\d+)<' 'pkgver')
 
 pkgname=hiawatha
-pkgver=12.2
-pkgrel=2
+pkgver=12.4
+pkgrel=1
 pkgdesc="Secure and advanced webserver"
 url="https://hiawatha.leisink.net/"
 arch=('x86_64')
@@ -23,7 +23,7 @@
         'hiawatha.service'
         'lefh-renew.service'
         'lefh-renew.timer')
-sha256sums=('f0343f5bf0a200973ebdf16668ab8e845e78498682ca83b05b78b2cc78fbe736'
+sha256sums=('c80f87b5f9f04520b57af96ac52905198f96de38c3b7d988abc0f758cdd46d2e'
             '4671d2586cbe3cd6497b16ff422c6143cdab40641ef3c9c4988c478351a8f5e7'
             'b5a2671703b52eec376cfc4697b86aafa4f7fdd9b2b9203798e2117770bafa53'
             '2598480f8b249aaf7028ea66bac0195e1c017fb17c2c169b69e0b66413728457'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 00:12:15	Low	2
2026-09-25 17:12:25	Medium	1
2026-08-15 00:26:13	Clean	2
2026-08-14 01:27:12	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1