Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Yann Ylavic]

On Thu, Mar 28, 2019 at 11:40 PM Yann Ylavic  wrote:
>
> On Thu, Mar 28, 2019 at 10:30 PM Ruediger Pluem  wrote:
> >
> >
> >
> > On 03/28/2019 10:27 PM, Yann Ylavic wrote:
> > > On Thu, Mar 28, 2019 at 10:24 PM Ruediger Pluem  wrote:
> > >>
> > >> On 03/28/2019 05:39 PM, yla...@apache.org wrote:
> > >>>
> > >>> +for (wpos = str; *str; ++str) {
> > >>>  if (!quoted) {
> > >>> -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
> > >>> +if (*str == '"') {
> > >>
> > >> Question: Is the token allowed to the quoted?
> > >
> > > Hmm no, I asked and was told to RTFM, and then forgot :)
> > > Will fix, thanks!
> > >
> >
> > All good. It is not allowed to be quoted and then the code behaves 
> > correctly and returns with APR_EINVAL.
>
> Not really, 'Cache-Control: "private"' for instance is not allowed but
> accepted here.
> Hopefully fixed in r1856507.

Oh, you were right actually, the quoted token was already caught by
the first "skip separators" checks.
But I find the new code from r1856507 clearer anyway, so I'll leave it
(unless I'm the only one)..

Regards,
Yann.

Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Yann Ylavic]

On Thu, Mar 28, 2019 at 10:30 PM Ruediger Pluem  wrote:
>
>
>
> On 03/28/2019 10:27 PM, Yann Ylavic wrote:
> > On Thu, Mar 28, 2019 at 10:24 PM Ruediger Pluem  wrote:
> >>
> >> On 03/28/2019 05:39 PM, yla...@apache.org wrote:
> >>>
> >>> +for (wpos = str; *str; ++str) {
> >>>  if (!quoted) {
> >>> -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
> >>> +if (*str == '"') {
> >>
> >> Question: Is the token allowed to the quoted?
> >
> > Hmm no, I asked and was told to RTFM, and then forgot :)
> > Will fix, thanks!
> >
>
> All good. It is not allowed to be quoted and then the code behaves correctly 
> and returns with APR_EINVAL.

Not really, 'Cache-Control: "private"' for instance is not allowed but
accepted here.
Hopefully fixed in r1856507.

Thanks,
Yann.

Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Ruediger Pluem]

On 03/28/2019 10:27 PM, Yann Ylavic wrote:
> On Thu, Mar 28, 2019 at 10:24 PM Ruediger Pluem  wrote:
>>
>> On 03/28/2019 05:39 PM, yla...@apache.org wrote:
>>>
>>> +for (wpos = str; *str; ++str) {
>>>  if (!quoted) {
>>> -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
>>> +if (*str == '"') {
>>
>> Question: Is the token allowed to the quoted?
> 
> Hmm no, I asked and was told to RTFM, and then forgot :)
> Will fix, thanks!
> 

All good. It is not allowed to be quoted and then the code behaves correctly 
and returns with APR_EINVAL.

Regards

Rüdiger

Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Yann Ylavic]

On Thu, Mar 28, 2019 at 10:24 PM Ruediger Pluem  wrote:
>
> On 03/28/2019 05:39 PM, yla...@apache.org wrote:
> >
> > +for (wpos = str; *str; ++str) {
> >  if (!quoted) {
> > -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
> > +if (*str == '"') {
>
> Question: Is the token allowed to the quoted?

Hmm no, I asked and was told to RTFM, and then forgot :)
Will fix, thanks!

Regards,
Yann.

Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Ruediger Pluem]

On 03/28/2019 10:24 PM, Ruediger Pluem wrote:
> 
> 
> On 03/28/2019 05:39 PM, yla...@apache.org wrote:
>> Author: ylavic
>> Date: Thu Mar 28 16:39:39 2019
>> New Revision: 1856493
>>
>> URL: http://svn.apache.org/viewvc?rev=1856493=rev
>> Log:
>> mod_cache: Fix parsing of quoted Cache-Control token arguments. PR 63288.
>>
>> Make cache_strqtok() return both the token and its unquoted argument (if 
>> any),
>> or an error if the parsing fails.
>>
>> Cache-Control integer values (max-age, max-stale, ...) can then be parsed w/o
>> taking care of the (optional) quoting.
>>
>> Suggested by: fielding
>>
>> Modified:
>> httpd/httpd/trunk/CHANGES
>> httpd/httpd/trunk/modules/cache/cache_storage.c
>> httpd/httpd/trunk/modules/cache/cache_util.c
>> httpd/httpd/trunk/modules/cache/cache_util.h
>>
> 
>> Modified: httpd/httpd/trunk/modules/cache/cache_util.c
>> URL: 
>> http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/cache/cache_util.c?rev=1856493=1856492=1856493=diff
>> ==
>> --- httpd/httpd/trunk/modules/cache/cache_util.c (original)
>> +++ httpd/httpd/trunk/modules/cache/cache_util.c Thu Mar 28 16:39:39 2019
> 
>> @@ -923,75 +925,84 @@ CACHE_DECLARE(char *)ap_cache_generate_n
>>  }
>>  
>>  /**
>> - * String tokenizer that ignores separator characters within quoted strings
>> - * and escaped characters, as per RFC2616 section 2.2.
>> + * String tokenizer per RFC 7234 section 5.2 (1#token[=["]arg["]]).
>> + * If any (and arg not NULL), the argument is also returned (unquoted).
>>   */
>> -char *cache_strqtok(char *str, const char *sep, char **last)
>> +apr_status_t cache_strqtok(char *str, char **token, char **arg, char **last)
>>  {
>> -char *token;
>> +#define CACHE_TOKEN_SEPS "\t ,"
>>  int quoted = 0;
>> +char *wpos;
>>  
>>  if (!str) { /* subsequent call */
>>  str = *last;/* start where we left off */
>>  }
>> -
>>  if (!str) { /* no more tokens */
>> -return NULL;
>> +return APR_EOF;
>>  }
>>  
>> -/* skip characters in sep (will terminate at '\0') */
>> -while (*str && ap_strchr_c(sep, *str)) {
>> +/* skip separators (will terminate at '\0') */
>> +while (*str && TEST_CHAR(*str, T_HTTP_TOKEN_STOP)) {
>> +if (!ap_strchr_c(CACHE_TOKEN_SEPS, *str)) {
>> +return APR_EINVAL;
>> +}
>>  ++str;
>>  }
>> -
>>  if (!*str) {/* no more tokens */
>> -return NULL;
>> +return APR_EOF;
>>  }
>>  
>> -token = str;
>> +*token = str;
>> +if (arg) {
>> +*arg = NULL;
>> +}
>>  
>>  /* skip valid token characters to terminate token and
>>   * prepare for the next call (will terminate at '\0)
>> - * on the way, ignore all quoted strings, and within
>> + * on the way, handle quoted strings, and within
>>   * quoted strings, escaped characters.
>>   */
>> -*last = token;
>> -while (**last) {
>> +for (wpos = str; *str; ++str) {
>>  if (!quoted) {
>> -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
>> +if (*str == '"') {
> 
> Question: Is the token allowed to the quoted?

Answering myself: The token is not allowed to be quoted.

Regards

Rüdiger

Re: svn commit: r1856493 - in /httpd/httpd/trunk: CHANGES modules/cache/cache_storage.c modules/cache/cache_util.c modules/cache/cache_util.h

[Ruediger Pluem]

On 03/28/2019 05:39 PM, yla...@apache.org wrote:
> Author: ylavic
> Date: Thu Mar 28 16:39:39 2019
> New Revision: 1856493
> 
> URL: http://svn.apache.org/viewvc?rev=1856493=rev
> Log:
> mod_cache: Fix parsing of quoted Cache-Control token arguments. PR 63288.
> 
> Make cache_strqtok() return both the token and its unquoted argument (if any),
> or an error if the parsing fails.
> 
> Cache-Control integer values (max-age, max-stale, ...) can then be parsed w/o
> taking care of the (optional) quoting.
> 
> Suggested by: fielding
> 
> Modified:
> httpd/httpd/trunk/CHANGES
> httpd/httpd/trunk/modules/cache/cache_storage.c
> httpd/httpd/trunk/modules/cache/cache_util.c
> httpd/httpd/trunk/modules/cache/cache_util.h
> 

> Modified: httpd/httpd/trunk/modules/cache/cache_util.c
> URL: 
> http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/cache/cache_util.c?rev=1856493=1856492=1856493=diff
> ==
> --- httpd/httpd/trunk/modules/cache/cache_util.c (original)
> +++ httpd/httpd/trunk/modules/cache/cache_util.c Thu Mar 28 16:39:39 2019

> @@ -923,75 +925,84 @@ CACHE_DECLARE(char *)ap_cache_generate_n
>  }
>  
>  /**
> - * String tokenizer that ignores separator characters within quoted strings
> - * and escaped characters, as per RFC2616 section 2.2.
> + * String tokenizer per RFC 7234 section 5.2 (1#token[=["]arg["]]).
> + * If any (and arg not NULL), the argument is also returned (unquoted).
>   */
> -char *cache_strqtok(char *str, const char *sep, char **last)
> +apr_status_t cache_strqtok(char *str, char **token, char **arg, char **last)
>  {
> -char *token;
> +#define CACHE_TOKEN_SEPS "\t ,"
>  int quoted = 0;
> +char *wpos;
>  
>  if (!str) { /* subsequent call */
>  str = *last;/* start where we left off */
>  }
> -
>  if (!str) { /* no more tokens */
> -return NULL;
> +return APR_EOF;
>  }
>  
> -/* skip characters in sep (will terminate at '\0') */
> -while (*str && ap_strchr_c(sep, *str)) {
> +/* skip separators (will terminate at '\0') */
> +while (*str && TEST_CHAR(*str, T_HTTP_TOKEN_STOP)) {
> +if (!ap_strchr_c(CACHE_TOKEN_SEPS, *str)) {
> +return APR_EINVAL;
> +}
>  ++str;
>  }
> -
>  if (!*str) {/* no more tokens */
> -return NULL;
> +return APR_EOF;
>  }
>  
> -token = str;
> +*token = str;
> +if (arg) {
> +*arg = NULL;
> +}
>  
>  /* skip valid token characters to terminate token and
>   * prepare for the next call (will terminate at '\0)
> - * on the way, ignore all quoted strings, and within
> + * on the way, handle quoted strings, and within
>   * quoted strings, escaped characters.
>   */
> -*last = token;
> -while (**last) {
> +for (wpos = str; *str; ++str) {
>  if (!quoted) {
> -if (**last == '\"' && !ap_strchr_c(sep, '\"')) {
> +if (*str == '"') {

Question: Is the token allowed to the quoted?

Regards

Rüdiger

Re: [VOTE] Release httpd-2.4.39

[Dennis Clarke]

On 3/28/19 11:48 AM, Yann Ylavic wrote:
> On Wed, Mar 27, 2019 at 4:10 PM Daniel Ruggeri  wrote:
>>
>> I would like to call a VOTE over the next few days to release this
>> candidate tarball as 2.4.39:
> 
> [X] +1: It's not just good, it's good enough!
> 
> All tests pass on Debian(s) 8, 9 and 10 w/ openssl(s) 1.0.2, 1.1.0 and 1.1.1.
> Sigs and digests OK.
> 

I have Debian sid on ppc64 which is really an edge case.
tinkering with that now.

Dennis

Re: [VOTE] Release httpd-2.4.39

[Yann Ylavic]

On Wed, Mar 27, 2019 at 4:10 PM Daniel Ruggeri  wrote:
>
> I would like to call a VOTE over the next few days to release this
> candidate tarball as 2.4.39:

[X] +1: It's not just good, it's good enough!

All tests pass on Debian(s) 8, 9 and 10 w/ openssl(s) 1.0.2, 1.1.0 and 1.1.1.
Sigs and digests OK.

Thanks Daniel!

Re: [VOTE] Release httpd-2.4.39

[Jim Jagielski]

My own..

Cheers!

> On Mar 28, 2019, at 10:00 AM, Plüm, Rüdiger, Vodafone Group 
>  wrote:
> 
> What pcre lib did you use on CentOS5? The one provided by CentOS or your own?
>  
> Regards
>  
> Rüdiger
>  
>  
> C2 General
> Von: Jim Jagielski  
> Gesendet: Donnerstag, 28. März 2019 14:52
> An: httpd 
> Betreff: Re: [VOTE] Release httpd-2.4.39
>  
> Yep, CentOS5. Mostly due to the fact that regressions would likely show up 
> more readily on older OSs rather than newer ones.
>  
> Plus, there's still a crap-ton of systems using CentOS5/RHEL5
>  
> 
> On Mar 28, 2019, at 8:51 AM, Plüm, Rüdiger, Vodafone Group 
> mailto:ruediger.pl...@vodafone.com>> wrote:
>  
> 
> 
> 
> C2 General
> 
> 
> -Ursprüngliche Nachricht-
> Von: Jim Jagielski mailto:j...@jagunet.com>>
> Gesendet: Donnerstag, 28. März 2019 13:39
> An: httpd mailto:dev@httpd.apache.org>>
> Betreff: Re: [VOTE] Release httpd-2.4.39
> 
> 
> 
> On Mar 27, 2019, at 11:09 AM, Daniel Ruggeri  >
> wrote:
> 
> 
> Hi, all;
>  Please find below the proposed release tarball and signatures:
> https://dist.apache.org/repos/dist/dev/httpd/ 
> 
> 
> I would like to call a VOTE over the next few days to release this
> candidate tarball as 2.4.39:
> 
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
> 
> The computed digests of the tarball up for vote are:
> sha1: e66d6bfea42254e64d3b5009f49ecc486ac46de2 *httpd-2.4.39.tar.gz
> sha256:
> 8b95fe249f3a6c50aad3ca125eef3e02d619116cde242e1bc3c266b7b5c37c30 *httpd-
> 2.4.39.tar.gz
> 
> 
> --
> Daniel Ruggeri
> 
> Tested and passed on the following systems (no regressions):
> 
>  o macOS 10.14.4, Xcode 10.2
>  o CentOS 5, 64bit
> 
> Really CentOS 5? Just asking because it does not receive further OS updates 
> and I wouldn't recommend to use it any longer.
> 
> Regards
> 
> Rüdiger

AW: [VOTE] Release httpd-2.4.39

[Plüm , Rüdiger , Vodafone Group]

What pcre lib did you use on CentOS5? The one provided by CentOS or your own?

Regards

Rüdiger



C2 General
Von: Jim Jagielski 
Gesendet: Donnerstag, 28. März 2019 14:52
An: httpd 
Betreff: Re: [VOTE] Release httpd-2.4.39

Yep, CentOS5. Mostly due to the fact that regressions would likely show up more 
readily on older OSs rather than newer ones.

Plus, there's still a crap-ton of systems using CentOS5/RHEL5

On Mar 28, 2019, at 8:51 AM, Plüm, Rüdiger, Vodafone Group 
mailto:ruediger.pl...@vodafone.com>> wrote:




C2 General

-Ursprüngliche Nachricht-
Von: Jim Jagielski mailto:j...@jagunet.com>>
Gesendet: Donnerstag, 28. März 2019 13:39
An: httpd mailto:dev@httpd.apache.org>>
Betreff: Re: [VOTE] Release httpd-2.4.39


On Mar 27, 2019, at 11:09 AM, Daniel Ruggeri 
mailto:drugg...@primary.net>>
wrote:

Hi, all;
 Please find below the proposed release tarball and signatures:
https://dist.apache.org/repos/dist/dev/httpd/

I would like to call a VOTE over the next few days to release this
candidate tarball as 2.4.39:
[ ] +1: It's not just good, it's good enough!
[ ] +0: Let's have a talk.
[ ] -1: There's trouble in paradise. Here's what's wrong.

The computed digests of the tarball up for vote are:
sha1: e66d6bfea42254e64d3b5009f49ecc486ac46de2 *httpd-2.4.39.tar.gz
sha256:
8b95fe249f3a6c50aad3ca125eef3e02d619116cde242e1bc3c266b7b5c37c30 *httpd-
2.4.39.tar.gz

--
Daniel Ruggeri

Tested and passed on the following systems (no regressions):

 o macOS 10.14.4, Xcode 10.2
 o CentOS 5, 64bit

Really CentOS 5? Just asking because it does not receive further OS updates and 
I wouldn't recommend to use it any longer.

Regards

Rüdiger

Re: [VOTE] Release httpd-2.4.39

[Jim Jagielski]

Yep, CentOS5. Mostly due to the fact that regressions would likely show up more 
readily on older OSs rather than newer ones.

Plus, there's still a crap-ton of systems using CentOS5/RHEL5

> On Mar 28, 2019, at 8:51 AM, Plüm, Rüdiger, Vodafone Group 
>  wrote:
> 
> 
> 
> 
> C2 General
> 
>> -Ursprüngliche Nachricht-
>> Von: Jim Jagielski 
>> Gesendet: Donnerstag, 28. März 2019 13:39
>> An: httpd 
>> Betreff: Re: [VOTE] Release httpd-2.4.39
>> 
>> 
>>> On Mar 27, 2019, at 11:09 AM, Daniel Ruggeri 
>> wrote:
>>> 
>>> Hi, all;
>>>  Please find below the proposed release tarball and signatures:
>>> https://dist.apache.org/repos/dist/dev/httpd/
>>> 
>>> I would like to call a VOTE over the next few days to release this
>> candidate tarball as 2.4.39:
>>> [ ] +1: It's not just good, it's good enough!
>>> [ ] +0: Let's have a talk.
>>> [ ] -1: There's trouble in paradise. Here's what's wrong.
>>> 
>>> The computed digests of the tarball up for vote are:
>>> sha1: e66d6bfea42254e64d3b5009f49ecc486ac46de2 *httpd-2.4.39.tar.gz
>>> sha256:
>> 8b95fe249f3a6c50aad3ca125eef3e02d619116cde242e1bc3c266b7b5c37c30 *httpd-
>> 2.4.39.tar.gz
>>> 
>>> --
>>> Daniel Ruggeri
>> 
>> Tested and passed on the following systems (no regressions):
>> 
>>  o macOS 10.14.4, Xcode 10.2
>>  o CentOS 5, 64bit
> 
> Really CentOS 5? Just asking because it does not receive further OS updates 
> and I wouldn't recommend to use it any longer.
> 
> Regards
> 
> Rüdiger

AW: AW: [VOTE] Release httpd-2.4.39

[Plüm , Rüdiger , Vodafone Group]

C2 General

> -Ursprüngliche Nachricht-
> Von: Dennis Clarke 
> Gesendet: Donnerstag, 28. März 2019 14:23
> An: dev@httpd.apache.org
> Betreff: Re: AW: [VOTE] Release httpd-2.4.39
> 
> On 3/28/19 8:51 AM, Plüm, Rüdiger, Vodafone Group wrote:
> >
> >
> >
> >>
> >> Tested and passed on the following systems (no regressions):
> >>
> >>   o macOS 10.14.4, Xcode 10.2
> >>   o CentOS 5, 64bit
> >
> > Really CentOS 5? Just asking because it does not receive further OS
> updates and I wouldn't recommend to use it any longer.
> >
> 
> People out there are running all manner of boxen and that even includes
> Solaris 10 or maybe some variation of SCO UNIX. Anything can and will
> happen. I am certain that there are CentOS 5/RHEL5 boxen out there just
> churning away and doing what they do for the last decade or so.

I am sure as well, but the question is: Is it worth testing on these platforms 
still
and thus encourage people to still use them?
I remember that I faced an issue with CentOS 5 and the system supplied pcre and 
2.4.
Hence I was also wondering how that passed. Possibly an external pcre.

Regards

Rüdiger

Re: AW: [VOTE] Release httpd-2.4.39

[Dennis Clarke]

On 3/28/19 8:51 AM, Plüm, Rüdiger, Vodafone Group wrote:
> 
> 
> 
>>
>> Tested and passed on the following systems (no regressions):
>>
>>   o macOS 10.14.4, Xcode 10.2
>>   o CentOS 5, 64bit
> 
> Really CentOS 5? Just asking because it does not receive further OS updates 
> and I wouldn't recommend to use it any longer.
> 

People out there are running all manner of boxen and that even includes
Solaris 10 or maybe some variation of SCO UNIX. Anything can and will
happen. I am certain that there are CentOS 5/RHEL5 boxen out there just
churning away and doing what they do for the last decade or so.

Dennis

AW: [VOTE] Release httpd-2.4.39

[Plüm , Rüdiger , Vodafone Group]

C2 General

> -Ursprüngliche Nachricht-
> Von: Jim Jagielski 
> Gesendet: Donnerstag, 28. März 2019 13:39
> An: httpd 
> Betreff: Re: [VOTE] Release httpd-2.4.39
> 
> 
> > On Mar 27, 2019, at 11:09 AM, Daniel Ruggeri 
> wrote:
> >
> > Hi, all;
> >   Please find below the proposed release tarball and signatures:
> > https://dist.apache.org/repos/dist/dev/httpd/
> >
> > I would like to call a VOTE over the next few days to release this
> candidate tarball as 2.4.39:
> > [ ] +1: It's not just good, it's good enough!
> > [ ] +0: Let's have a talk.
> > [ ] -1: There's trouble in paradise. Here's what's wrong.
> >
> > The computed digests of the tarball up for vote are:
> > sha1: e66d6bfea42254e64d3b5009f49ecc486ac46de2 *httpd-2.4.39.tar.gz
> > sha256:
> 8b95fe249f3a6c50aad3ca125eef3e02d619116cde242e1bc3c266b7b5c37c30 *httpd-
> 2.4.39.tar.gz
> >
> > --
> > Daniel Ruggeri
> 
> Tested and passed on the following systems (no regressions):
> 
>   o macOS 10.14.4, Xcode 10.2
>   o CentOS 5, 64bit

Really CentOS 5? Just asking because it does not receive further OS updates and 
I wouldn't recommend to use it any longer.

Regards

Rüdiger

Re: [VOTE] Release httpd-2.4.39

[Jim Jagielski]

> On Mar 27, 2019, at 11:09 AM, Daniel Ruggeri  wrote:
> 
> Hi, all;
>   Please find below the proposed release tarball and signatures:
> https://dist.apache.org/repos/dist/dev/httpd/
> 
> I would like to call a VOTE over the next few days to release this candidate 
> tarball as 2.4.39:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
> 
> The computed digests of the tarball up for vote are:
> sha1: e66d6bfea42254e64d3b5009f49ecc486ac46de2 *httpd-2.4.39.tar.gz
> sha256: 8b95fe249f3a6c50aad3ca125eef3e02d619116cde242e1bc3c266b7b5c37c30 
> *httpd-2.4.39.tar.gz
> 
> -- 
> Daniel Ruggeri

Tested and passed on the following systems (no regressions):

  o macOS 10.14.4, Xcode 10.2
  o CentOS 5, 64bit
  o CentOS 6, 64bit
  o Fedora 23, 64bit

+1 for release! Thx for RMing.

Re: [VOTE] Release httpd-2.4.39

[Stefan Eissing]

> Am 27.03.2019 um 16:09 schrieb Daniel Ruggeri :
> 
> Hi, all;
>   Please find below the proposed release tarball and signatures:
> https://dist.apache.org/repos/dist/dev/httpd/
> 
> I would like to call a VOTE over the next few days to release this candidate 
> tarball as 2.4.39:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.

+1: all running fine
- h2+md tests on MacOS 10.14.4
- h2 tests on ubuntu 16.04 LTS
- h2fuzzing on ubuntu 16.04 LTS

Thanks for RMing!