Removal of www/apache22

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

Removal of www/apache22

Bernard Spil
Hi all,

Just noticed that the Apache project has removed the patches they had
for 2.2.34.

     http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/

Combined with the security update of 2.4 branch to 2.4.33 leads me to
believe that Apache 2.2 is now vulnerable and no patches will be
provided.

If someone wishes to step up and get patches for 2.2 from e.g. RedHat,
we may be able to keep the port alive for a bit longer. If no one steps
up, I see no other way forward than to delete the port as indicated by
the DEPRECATED variable and expiration date 2017-07-01 since July 2016.

Cheers,

Bernard.
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Spil Oss-2
There's been no-one wanting to keep Apache 2.2 that has come forward.

Expect www/apache22 to be removed later in the week. Cleanup of
Mk/Uses/apache.mk after that.

2018-03-30 17:37 GMT+02:00 Spil Oss <[hidden email]>:

> Thanks Vincent! I was looking for these but could not find them any
> more. Should've looked in archive naturally.
>
> Hanging in here for a bit to find out if there's anyone else wanting
> to comment. Deletion 14 days after original message.
>
> Cheers, Bernard.
>
> 2018-03-27 16:07 GMT+02:00 Vincent Hoffman-Kazlauskas <[hidden email]>:
>>
>>
>> On 27/03/2018 13:52, Bernard Spil wrote:
>>> Hi all,
>>>
>>> Just noticed that the Apache project has removed the patches they had
>>> for 2.2.34.
>>>
>>>     http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/
>>>
>>> Combined with the security update of 2.4 branch to 2.4.33 leads me to
>>> believe that Apache 2.2 is now vulnerable and no patches will be provided.
>>>
>>> If someone wishes to step up and get patches for 2.2 from e.g. RedHat,
>>> we may be able to keep the port alive for a bit longer. If no one steps
>>> up, I see no other way forward than to delete the port as indicated by
>>> the DEPRECATED variable and expiration date 2017-07-01 since July 2016.
>>>
>>
>> While I agree that apache 2.2 is now firmly dead, they moved the patches
>> for 2.2.34 to
>> https://archive.apache.org/dist/httpd/patches/apply_to_2.2.34/ , however
>> no new patches for the recent CVEs were added.
>>
>>
>> Vince
>>
>>
>>
>>> Cheers,
>>>
>>> Bernard.
>>> _______________________________________________
>>> [hidden email] mailing list
>>> https://lists.freebsd.org/mailman/listinfo/freebsd-ports
>>> To unsubscribe, send any mail to "[hidden email]"
>> _______________________________________________
>> [hidden email] mailing list
>> https://lists.freebsd.org/mailman/listinfo/freebsd-ports
>> To unsubscribe, send any mail to "[hidden email]"
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Bernard Spil
In reply to this post by Bernard Spil
Hi All,

You are all maintainer of a port that depends on www/apache22. The
Apache 2.2 port has been marked EXPIRED for almost a year. I was about
to delete it but didn't want to go ahead without informing you. My
analysis of the dependent ports can be found in the FreeBSD wiki
https://wiki.freebsd.org/Apache#Apache_2.2

www/mod_antiloris [hidden email]
www/mod_clamav [hidden email]
www/mod_extract_forwarded [hidden email]
www/mod_log_config-st [hidden email]
www/mod_log_mysql [hidden email]
www/mod_macro22 [hidden email]
www/mod_memcache_block [hidden email]
www/mod_remoteip [hidden email]
www/mod_uid [hidden email]
www/mod_whatkilledus [hidden email]
www/mod_xml2enc [hidden email]
www/mod_spdy [hidden email]

If the port cannot be updated to work with Apache 2.4 it will be
removed together with www/apache22. Let me and apache@ know if you can
update the port to use 2.4 or if there's a different port we should be
pointing to in MOVED.

Thank you for your cooperation!

With kind regards, Bernard Spil (with hat apache@)

2018-04-08 12:57 GMT+02:00 Bernard Spil <[hidden email]>:

> There's been no-one wanting to keep Apache 2.2 that has come forward.
>
> Expect www/apache22 to be removed later in the week. Cleanup of
> Mk/Uses/apache.mk after that.
>
> 2018-03-27 14:52 GMT+02:00 Bernard Spil <[hidden email]>:
>> Hi all,
>>
>> Just noticed that the Apache project has removed the patches they had for
>> 2.2.34.
>>
>>     http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/
>>
>> Combined with the security update of 2.4 branch to 2.4.33 leads me to
>> believe that Apache 2.2 is now vulnerable and no patches will be provided.
>>
>> If someone wishes to step up and get patches for 2.2 from e.g. RedHat, we
>> may be able to keep the port alive for a bit longer. If no one steps up, I
>> see no other way forward than to delete the port as indicated by the
>> DEPRECATED variable and expiration date 2017-07-01 since July 2016.
>>
>> Cheers,
>>
>> Bernard.
>> _______________________________________________
>> [hidden email] mailing list
>> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
>> To unsubscribe, send any mail to "[hidden email]"
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Łukasz Wąsikowski-2
W dniu 2018-04-11 o 20:29, Bernard Spil pisze:

> You are all maintainer of a port that depends on www/apache22. The
> Apache 2.2 port has been marked EXPIRED for almost a year. I was about
> to delete it but didn't want to go ahead without informing you. My
> analysis of the dependent ports can be found in the FreeBSD wiki
> https://wiki.freebsd.org/Apache#Apache_2.2

[...]

> www/mod_macro22 [hidden email]

This is apache 2.2 only version. Feature provided by this port is
included in apache 2.4 , so feel free to bury www/mod_macro22.

--
best regards,
Lukasz Wasikowski
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Philip M. Gollucci
In reply to this post by Spil Oss-2
#winning!

On Sun, Apr 8, 2018 at 3:52 AM, Spil Oss <[hidden email]> wrote:

> There's been no-one wanting to keep Apache 2.2 that has come forward.
>
> Expect www/apache22 to be removed later in the week. Cleanup of
> Mk/Uses/apache.mk after that.
>
> 2018-03-30 17:37 GMT+02:00 Spil Oss <[hidden email]>:
> > Thanks Vincent! I was looking for these but could not find them any
> > more. Should've looked in archive naturally.
> >
> > Hanging in here for a bit to find out if there's anyone else wanting
> > to comment. Deletion 14 days after original message.
> >
> > Cheers, Bernard.
> >
> > 2018-03-27 16:07 GMT+02:00 Vincent Hoffman-Kazlauskas <
> [hidden email]>:
> >>
> >>
> >> On 27/03/2018 13:52, Bernard Spil wrote:
> >>> Hi all,
> >>>
> >>> Just noticed that the Apache project has removed the patches they had
> >>> for 2.2.34.
> >>>
> >>>     http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/
> >>>
> >>> Combined with the security update of 2.4 branch to 2.4.33 leads me to
> >>> believe that Apache 2.2 is now vulnerable and no patches will be
> provided.
> >>>
> >>> If someone wishes to step up and get patches for 2.2 from e.g. RedHat,
> >>> we may be able to keep the port alive for a bit longer. If no one steps
> >>> up, I see no other way forward than to delete the port as indicated by
> >>> the DEPRECATED variable and expiration date 2017-07-01 since July 2016.
> >>>
> >>
> >> While I agree that apache 2.2 is now firmly dead, they moved the patches
> >> for 2.2.34 to
> >> https://archive.apache.org/dist/httpd/patches/apply_to_2.2.34/ ,
> however
> >> no new patches for the recent CVEs were added.
> >>
> >>
> >> Vince
> >>
> >>
> >>
> >>> Cheers,
> >>>
> >>> Bernard.
> >>> _______________________________________________
> >>> [hidden email] mailing list
> >>> https://lists.freebsd.org/mailman/listinfo/freebsd-ports
> >>> To unsubscribe, send any mail to "freebsd-ports-unsubscribe@
> freebsd.org"
> >> _______________________________________________
> >> [hidden email] mailing list
> >> https://lists.freebsd.org/mailman/listinfo/freebsd-ports
> >> To unsubscribe, send any mail to "[hidden email]
> "
> _______________________________________________
> [hidden email] mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
> To unsubscribe, send any mail to "[hidden email]"
>



--
---------------------------------------------------------------------------------
4096R/D21D2752
<http://pgp.mit.edu/pks/lookup?op=get&search=0xF699A450D21D2752> ECDF B597
B54B 7F92 753E  E0EA F699 A450 D21D 2752
Philip M. Gollucci ([hidden email]) c: 703.336.9354
Member,                           Apache Software Foundation
Committer,                        FreeBSD Foundation
Consultant,                       P6M7G8 Inc.
Director Cloud Technology,        Capital One

What doesn't kill us can only make us stronger;
Except it almost kills you.
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Philip M. Gollucci
In reply to this post by Łukasz Wąsikowski-2
mod_log_mysql ->
https://github.com/freebsd/freebsd-ports/blob/master/www/mod_log_sql

On Wed, Apr 11, 2018 at 12:52 PM, Łukasz Wąsikowski <[hidden email]>
wrote:

> W dniu 2018-04-11 o 20:29, Bernard Spil pisze:
>
> > You are all maintainer of a port that depends on www/apache22. The
> > Apache 2.2 port has been marked EXPIRED for almost a year. I was about
> > to delete it but didn't want to go ahead without informing you. My
> > analysis of the dependent ports can be found in the FreeBSD wiki
> > https://wiki.freebsd.org/Apache#Apache_2.2
>
> [...]
>
> > www/mod_macro22 [hidden email]
>
> This is apache 2.2 only version. Feature provided by this port is
> included in apache 2.4 , so feel free to bury www/mod_macro22.
>
> --
> best regards,
> Lukasz Wasikowski
> _______________________________________________
> [hidden email] mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
> To unsubscribe, send any mail to "[hidden email]"
>



--
---------------------------------------------------------------------------------
4096R/D21D2752
<http://pgp.mit.edu/pks/lookup?op=get&search=0xF699A450D21D2752> ECDF B597
B54B 7F92 753E  E0EA F699 A450 D21D 2752
Philip M. Gollucci ([hidden email]) c: 703.336.9354
Member,                           Apache Software Foundation
Committer,                        FreeBSD Foundation
Consultant,                       P6M7G8 Inc.
Director Cloud Technology,        Capital One

What doesn't kill us can only make us stronger;
Except it almost kills you.
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Hung-Yi Chen
Hi,

www/mod_memcache_block can work with apache 2.4.

I'll send a PR.


2018-04-12 4:35 GMT+08:00 Philip M. Gollucci <[hidden email]>:

> mod_log_mysql -> https://github.com/freebsd/freebsd-ports/blob/master/www/
> mod_log_sql
>
> On Wed, Apr 11, 2018 at 12:52 PM, Łukasz Wąsikowski <[hidden email]
> > wrote:
>
>> W dniu 2018-04-11 o 20:29, Bernard Spil pisze:
>>
>> > You are all maintainer of a port that depends on www/apache22. The
>> > Apache 2.2 port has been marked EXPIRED for almost a year. I was about
>> > to delete it but didn't want to go ahead without informing you. My
>> > analysis of the dependent ports can be found in the FreeBSD wiki
>> > https://wiki.freebsd.org/Apache#Apache_2.2
>>
>> [...]
>>
>> > www/mod_macro22 [hidden email]
>>
>> This is apache 2.2 only version. Feature provided by this port is
>> included in apache 2.4 , so feel free to bury www/mod_macro22.
>>
>> --
>> best regards,
>> Lukasz Wasikowski
>> _______________________________________________
>> [hidden email] mailing list
>> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
>> To unsubscribe, send any mail to "[hidden email]"
>>
>
>
>
> --
> ------------------------------------------------------------
> ---------------------
> 4096R/D21D2752
> <http://pgp.mit.edu/pks/lookup?op=get&search=0xF699A450D21D2752> ECDF
> B597 B54B 7F92 753E  E0EA F699 A450 D21D 2752
> Philip M. Gollucci ([hidden email]) c: 703.336.9354
> Member,                           Apache Software Foundation
> Committer,                        FreeBSD Foundation
> Consultant,                       P6M7G8 Inc.
> Director Cloud Technology,        Capital One
>
> What doesn't kill us can only make us stronger;
> Except it almost kills you.
>
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Bernard Spil
Hi All,

I've pulled the trigger on the removal of www/apache22.
I've kept mod_memcache_blok but marked it BROKEN pending maintaner update.

Added bofh@ as resin3 is also affected (option, default disabled).

If the port does work with Apache 2.4 (or with a patch), let me know
so we can add it again.

Cheers, Bernard.

2018-04-12 9:50 GMT+02:00 Hung-Yi Chen <[hidden email]>:

> Hi,
>
> www/mod_memcache_block can work with apache 2.4.
>
> I'll send a PR.
>
>
> 2018-04-12 4:35 GMT+08:00 Philip M. Gollucci <[hidden email]>:
>>
>> mod_log_mysql ->
>> https://github.com/freebsd/freebsd-ports/blob/master/www/mod_log_sql
>>
>> On Wed, Apr 11, 2018 at 12:52 PM, Łukasz Wąsikowski
>> <[hidden email]> wrote:
>>>
>>> W dniu 2018-04-11 o 20:29, Bernard Spil pisze:
>>>
>>> > You are all maintainer of a port that depends on www/apache22. The
>>> > Apache 2.2 port has been marked EXPIRED for almost a year. I was about
>>> > to delete it but didn't want to go ahead without informing you. My
>>> > analysis of the dependent ports can be found in the FreeBSD wiki
>>> > https://wiki.freebsd.org/Apache#Apache_2.2
>>>
>>> [...]
>>>
>>> > www/mod_macro22 [hidden email]
>>>
>>> This is apache 2.2 only version. Feature provided by this port is
>>> included in apache 2.4 , so feel free to bury www/mod_macro22.
>>>
>>> --
>>> best regards,
>>> Lukasz Wasikowski
>>> _______________________________________________
>>> [hidden email] mailing list
>>> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
>>> To unsubscribe, send any mail to "[hidden email]"
>>
>>
>>
>>
>> --
>>
>> ---------------------------------------------------------------------------------
>> 4096R/D21D2752 ECDF B597 B54B 7F92 753E  E0EA F699 A450 D21D 2752
>> Philip M. Gollucci ([hidden email]) c: 703.336.9354
>> Member,                           Apache Software Foundation
>> Committer,                        FreeBSD Foundation
>> Consultant,                       P6M7G8 Inc.
>> Director Cloud Technology,        Capital One
>>
>> What doesn't kill us can only make us stronger;
>> Except it almost kills you.
>
>
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"
Reply | Threaded
Open this post in threaded view
|

Re: Removal of www/apache22

Hung-Yi Chen
Hi Bernard,

I've sent a PR #228053.

2018-04-16 19:29 GMT+08:00 Bernard Spil <[hidden email]>:

> Hi All,
>
> I've pulled the trigger on the removal of www/apache22.
> I've kept mod_memcache_blok but marked it BROKEN pending maintaner update.
>
> Added bofh@ as resin3 is also affected (option, default disabled).
>
> If the port does work with Apache 2.4 (or with a patch), let me know
> so we can add it again.
>
> Cheers, Bernard.
>
> 2018-04-12 9:50 GMT+02:00 Hung-Yi Chen <[hidden email]>:
> > Hi,
> >
> > www/mod_memcache_block can work with apache 2.4.
> >
> > I'll send a PR.
> >
> >
> > 2018-04-12 4:35 GMT+08:00 Philip M. Gollucci <[hidden email]>:
> >>
> >> mod_log_mysql ->
> >> https://github.com/freebsd/freebsd-ports/blob/master/www/mod_log_sql
> >>
> >> On Wed, Apr 11, 2018 at 12:52 PM, Łukasz Wąsikowski
> >> <[hidden email]> wrote:
> >>>
> >>> W dniu 2018-04-11 o 20:29, Bernard Spil pisze:
> >>>
> >>> > You are all maintainer of a port that depends on www/apache22. The
> >>> > Apache 2.2 port has been marked EXPIRED for almost a year. I was
> about
> >>> > to delete it but didn't want to go ahead without informing you. My
> >>> > analysis of the dependent ports can be found in the FreeBSD wiki
> >>> > https://wiki.freebsd.org/Apache#Apache_2.2
> >>>
> >>> [...]
> >>>
> >>> > www/mod_macro22 [hidden email]
> >>>
> >>> This is apache 2.2 only version. Feature provided by this port is
> >>> included in apache 2.4 , so feel free to bury www/mod_macro22.
> >>>
> >>> --
> >>> best regards,
> >>> Lukasz Wasikowski
> >>> _______________________________________________
> >>> [hidden email] mailing list
> >>> https://lists.freebsd.org/mailman/listinfo/freebsd-apache
> >>> To unsubscribe, send any mail to "freebsd-apache-unsubscribe@fr
> eebsd.org"
> >>
> >>
> >>
> >>
> >> --
> >>
> >> ------------------------------------------------------------
> ---------------------
> >> 4096R/D21D2752 ECDF B597 B54B 7F92 753E  E0EA F699 A450 D21D 2752
> >> Philip M. Gollucci ([hidden email]) c: 703.336.9354
> >> Member,                           Apache Software Foundation
> >> Committer,                        FreeBSD Foundation
> >> Consultant,                       P6M7G8 Inc.
> >> Director Cloud Technology,        Capital One
> >>
> >> What doesn't kill us can only make us stronger;
> >> Except it almost kills you.
> >
> >
>
_______________________________________________
[hidden email] mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-apache
To unsubscribe, send any mail to "[hidden email]"