Am 05.06.26 um 14:58 schrieb Eric Covener:
Hi all,
Please find below the proposed release tarball and signatures:
https://dist.apache.org/repos/dist/dev/httpd/
I would like to call a VOTE over the next few days to release
this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
[ ] +1: It's not just good, it's good enough!
[ ] +0: Let's have a talk.
[ ] -1: There's trouble in paradise. Here's what's wrong.
The computed digests of the tarball up for vote are:
sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
*httpd-2.4.68-rc1.tar.gz
sha512:
de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
*httpd-2.4.68-rc1.tar.gz
The candidate source is found at
<https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
+1 for release and thanks for RM and especially the very intense work on
security to everyone involved!
- Sigs and hashes OK
- contents of tarballs identical
- contents of tag and tarballs identical
except for expected deltas
Built on
- SLES 12+15 (64 Bits)
- RHEL 7+8+9+10 (64 Bits)
- Solaris 10 Sparc
For all platforms built
- with default (shared) modules
- with module set reallyall
- using --enable-load-all-modules
- using libraries
- APR/APU
- bundled deps tarball
- 1.7.6/1.6.3
- 1.7.x(HEAD=r1934904)/1.6.x(HEAD=r1934904)
- 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
- 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
- 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
- 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
- trunk(HEAD=r1934904) with expat
- trunk(HEAD=r1934904) with libxml2
- OpenSSL 4.0.0-1 3.6.2-1 3.5.6-1,
For OpenSSL 4 only bundled APR/APU without APU crypto
- expat 2.8.1
- pcre 10.47
- lua 5.5.0 (compiled with LUA_COMPAT_MODULE)
- libxml2 2.15.3
- sqlite 3.53.1
- libnghttp2 1.69.0
- brotli 1.2.0
- curl 8.20.0
- jansson 2.15.0
- libldap 2.6.13
also with platform ldap on Solaris)
- in total 15 builds per platform (19 for Solaris)
- Tool chain:
- platform gcc on Linux, gcc 9.5 on Solaris 10
- CFLAGS: -O2 -g -Wall -fno-strict-aliasing
All builds succeeded.
- compiler warnings: see below "A)"
Perl tests run with OpenSSL client versions 3.6.0, 3.5.0, 3.0.15, 1.1.1w
and 1.0.2u (for RHEL 10 with 3.6.0 3.5.4 3.0.18 1.1.1w) against every
server build. MPMs tested event, worker, prefork.
- only failures in 1305 test runs on Linux
(sporadic; status code 596 in perl client)
- Sporadic failures on test runs on Solaris. Only parts of the
combinations tested there until now, but the result seems already valid.
Details of Solaris perl test failures see below "B)".
Also pytest checked against one specific server version on every Linux
variant tested, using clients with OpenSSL 4.0.0, 3.6.2, 3.5.6 and
3.0.20 and against every MPM.
Only 5 runs out of 66 had a single (sporadic) failure.
Details of Linux pytest failures see below "C)".
Regards,
Rainer
A) Compiler warnings
::::::::::::::::::::
- compiler warnings httpd sources:
- all builds (I use recent libxml2)
modules/filters/mod_xml2enc.c:609:5: warning: 'xmlAddEncodingAlias' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:319:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:366:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:404:5: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:405:9: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:412:17: warning: 'htmlAttrAllowed' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
- when compiled against OpenSSL 4; might be fixed in upstream mod_md
modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
qualifier from pointer target type [-Wdiscarded-qualifiers]
- compiler warnings bundled apr-util (from deps tarball):
- only on RHEL 10 due to newest gcc
srclib/apr-util/dbm/sdbm/sdbm_pair.c:234:1: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:21:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:22:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:23:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:24:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:25:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:26:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:27:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:28:17: warning: old-style function
definition [-Wold-style-definition]
- all builds, both OpenSSL versions (3.5.6, 3.6.2):
- seems to be already fixed in 1.6.x head and 1.7.x head
srclib/apr-util/crypto/apr_crypto_openssl.c:141:5: warning:
'ENGINE_load_builtin_engines' is deprecated: Since OpenSSL 3.0
[-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:142:5: warning:
'ENGINE_register_all_complete' is deprecated: Since OpenSSL 3.0
[-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:208:9: warning:
'ENGINE_finish' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:209:9: warning:
'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:326:9: warning:
'ENGINE_by_id' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:330:9: warning:
'ENGINE_init' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:331:13: warning:
'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
- only on Solaris 10 Sparc:
/srclib/apr/locks/unix/proc_mutex.c:982:49: warning:
'mutex_proc_pthread_cond_methods' defined but not used
[-Wunused-const-variable=]
B) perl unit test failures
::::::::::::::::::::::::::
Only on Solaris, both already known.
Always fails:
# Failed test 4 in t/modules/buffer.t at line 37
# Failed test 8 in t/modules/buffer.t at line 37 fail #2
Fails about 2/3 of the test runs:
# Failed test 3 in t/modules/sed.t at line 37 fail #2
# posting body of size 25165824
# ... posted body of size 25165824
# Content Length 0
# testing : status code for /apache/sed-echo/out-foo-grow/foobar.html
# expected: '200'
# received: 596
not ok 3
C) pytest failures
::::::::::::::::::
Failures seem to be sporadic.
modules/http2/test_004_post.py::TestPost::test_h2_004_24[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_008_ranges.py::TestRanges::test_h2_008_04[0] - Asse...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_23[data-1m] - ...
modules/http2/test_600_h2proxy.py::TestH2Proxy::test_h2_600_32[0] - as...
