You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Eric Covener <co...@gmail.com> on 2026/06/05 12:58:15 UTC
[VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Hi all,
Please find below the proposed release tarball and signatures:
https://dist.apache.org/repos/dist/dev/httpd/
I would like to call a VOTE over the next few days to release
this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
[ ] +1: It's not just good, it's good enough!
[ ] +0: Let's have a talk.
[ ] -1: There's trouble in paradise. Here's what's wrong.
The computed digests of the tarball up for vote are:
sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
*httpd-2.4.68-rc1.tar.gz
sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
*httpd-2.4.68-rc1.tar.gz
The candidate source is found at
<https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
--
Eric Covener
covener@gmail.com
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Joe Orton <jo...@apache.org>.
On Fri, Jun 05, 2026 at 08:58:15AM -0400, Eric Covener wrote:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [X] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
+1 for release, and thanks for RMing.
Builds and httpd-tests passing on RHEL 8/9/10, Fedora 43/Rawhide (all
x86_64 only). CI passed at least once for each of Windows/Linux, though
some weirdness with the tag and one dodgy h2 test.
There is one mod_ssl gcc warning with RHEL8 openssl 1.1.1k, but it's
only a warning and it builds and tests cleanly with OpenSSL 4.0 now,
I'll try to fix the warning sometime.
Regards, Joe
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Eric Covener <co...@gmail.com>.
Release passes with following binding votes
+1: covener, jorton, jimjag, thumbs, jailletc36, jblond, steffenal, jung
Thanks for all community votes/feedback as well.
On Fri, Jun 5, 2026 at 8:58 AM Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
--
Eric Covener
covener@gmail.com
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Christophe JAILLET <ch...@wanadoo.fr>.
Le 05/06/2026 à 14:58, Eric Covener a écrit :
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
Hi,
[X] +1: It's not just good, it's good enough!
Linux fedora 7.0.9-205.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 21
16:31:48 UTC 2026 x86_64 GNU/Linux
gcc (GCC) 16.1.1 20260515 (Red Hat 16.1.1-2)
OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)
openssl: 3.5.5
brotli: 1.2.0
jansson: 2.14
nghttp2: 1.68.0
pcre2: 10.47
lua: 5.4.8
systemd: 259.5
openldap: 2.6.13
expat: 2.8.1
xml2: 2.12.10
curl: 8.18.0
Thanks a lot for all the time spent on triage / analysis / patch related
to all the IA stuff.
CJ
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Jeff McKenna <jm...@gatewaygeomatics.com>.
+1 on:
- Windows (MSVC 2022 & CMake 4.3.3)
- no workarounds needed!
thanks,
-jeff
On 2026-06-05 12:23 p.m., Frank Gingras wrote:
>
>
> On Fri, Jun 5, 2026 at 11:21 AM Jim Jagielski <jim@jagunet.com
> <ma...@jagunet.com>> wrote:
>
> +1 on:
> - macOS 26.5.1/arm64/Xcode 26.4
> - Ubuntu 24LTS x86-64
>
> Thx for RMing!
>
>> On Jun 5, 2026, at 8:58 AM, Eric Covener <covener@gmail.com
>> <ma...@gmail.com>> wrote:
>>
>> Hi all,
>>
>> Please find below the proposed release tarball and signatures:
>>
>> https://dist.apache.org/repos/dist/dev/httpd/ <https://
>> dist.apache.org/repos/dist/dev/httpd/>
>>
>> I would like to call a VOTE over the next few days to release
>> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
>> [ ] +1: It's not just good, it's good enough!
>> [ ] +0: Let's have a talk.
>> [ ] -1: There's trouble in paradise. Here's what's wrong.
>>
>> The computed digests of the tarball up for vote are:
>> sha256:
>> ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
>> *httpd-2.4.68-rc1.tar.gz
>> sha512:
>> de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
>> *httpd-2.4.68-rc1.tar.gz
>>
>> The candidate source is found at
>> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-
>> candidate <https://svn.apache.org/repos/asf/httpd/httpd/
>> tags/2.4.68-rc1-candidate>>
>> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate
>> <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>>.
>>
>> --
>> Eric Covener
>> covener@gmail.com <ma...@gmail.com>
>
> --
> Jim
> "This is an outrage!"
> Tony Harrison
>
>
> Just tested on Slackware64, no issues here.
>
> +1
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Frank Gingras <th...@apache.org>.
On Fri, Jun 5, 2026 at 11:21 AM Jim Jagielski <ji...@jagunet.com> wrote:
> +1 on:
> - macOS 26.5.1/arm64/Xcode 26.4
> - Ubuntu 24LTS x86-64
>
> Thx for RMing!
>
> On Jun 5, 2026, at 8:58 AM, Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512:
> de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
>
>
> --
> Jim
> "This is an outrage!"
> Tony Harrison
>
>
Just tested on Slackware64, no issues here.
+1
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Jim Jagielski <ji...@jagunet.com>.
+1 on:
- macOS 26.5.1/arm64/Xcode 26.4
- Ubuntu 24LTS x86-64
Thx for RMing!
> On Jun 5, 2026, at 8:58 AM, Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
--
Jim
"This is an outrage!"
Tony Harrison
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Eric Covener <co...@gmail.com>.
> [ ] +1: It's not just good, it's good enough!
my +1 on aix/xlc/ppc64
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Pierre Brochard <pi...@famillebrochard.fr>.
+1
Tested with my cross-compilation stack on Linux and Windows.
Works on Ubuntu and Slackware64 as an independant installation from the
system Httpd.
Compile and works with OpenSSL 3.5.6 (latest LTS version).
Works also with mod_qos, mod_zstd (adapted from the two versions on
github) and a dedicated complex Apache module for my database system
(which can do suspend / resume with the event mpm).
I didn't test on OpenSSL 4.
Pierre Brochard (pierre.brochard.1982@m4x.org)
Le 05/06/2026 à 14:58, Eric Covener a écrit :
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Steffen <in...@apachelounge.com>.
+1 all fine on Windows 64 and 32.
Thanks for all the work.
SteffenAL
> Op 5 jun 2026 om 15:00 heeft Eric Covener <co...@gmail.com> het volgende geschreven:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Mario Brandt <jb...@gmail.com>.
+1 on Debian 13
Rainer Jung <ra...@kippdata.de> schrieb am So., 7. Juni 2026, 19:41:
> Am 05.06.26 um 14:58 schrieb Eric Covener:
> > Hi all,
> >
> > Please find below the proposed release tarball and signatures:
> >
> > https://dist.apache.org/repos/dist/dev/httpd/
> >
> > I would like to call a VOTE over the next few days to release
> > this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> > [ ] +1: It's not just good, it's good enough!
> > [ ] +0: Let's have a talk.
> > [ ] -1: There's trouble in paradise. Here's what's wrong.
> >
> > The computed digests of the tarball up for vote are:
> > sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> > *httpd-2.4.68-rc1.tar.gz
> > sha512:
> de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> > *httpd-2.4.68-rc1.tar.gz
> >
> > The candidate source is found at
> > <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> > and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
>
> +1 for release and thanks for RM and especially the very intense work on
> security to everyone involved!
>
> - Sigs and hashes OK
> - contents of tarballs identical
> - contents of tag and tarballs identical
> except for expected deltas
>
> Built on
>
> - SLES 12+15 (64 Bits)
> - RHEL 7+8+9+10 (64 Bits)
> - Solaris 10 Sparc
>
> For all platforms built
>
> - with default (shared) modules
> - with module set reallyall
> - using --enable-load-all-modules
>
> - using libraries
> - APR/APU
> - bundled deps tarball
> - 1.7.6/1.6.3
> - 1.7.x(HEAD=r1934904)/1.6.x(HEAD=r1934904)
> - 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
> - 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
> - 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
> - 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
> - trunk(HEAD=r1934904) with expat
> - trunk(HEAD=r1934904) with libxml2
> - OpenSSL 4.0.0-1 3.6.2-1 3.5.6-1,
> For OpenSSL 4 only bundled APR/APU without APU crypto
> - expat 2.8.1
> - pcre 10.47
> - lua 5.5.0 (compiled with LUA_COMPAT_MODULE)
> - libxml2 2.15.3
> - sqlite 3.53.1
> - libnghttp2 1.69.0
> - brotli 1.2.0
> - curl 8.20.0
> - jansson 2.15.0
> - libldap 2.6.13
> also with platform ldap on Solaris)
>
> - in total 15 builds per platform (19 for Solaris)
>
> - Tool chain:
> - platform gcc on Linux, gcc 9.5 on Solaris 10
> - CFLAGS: -O2 -g -Wall -fno-strict-aliasing
>
> All builds succeeded.
>
> - compiler warnings: see below "A)"
>
> Perl tests run with OpenSSL client versions 3.6.0, 3.5.0, 3.0.15, 1.1.1w
> and 1.0.2u (for RHEL 10 with 3.6.0 3.5.4 3.0.18 1.1.1w) against every
> server build. MPMs tested event, worker, prefork.
>
> - only failures in 1305 test runs on Linux
> (sporadic; status code 596 in perl client)
>
> - Sporadic failures on test runs on Solaris. Only parts of the
> combinations tested there until now, but the result seems already valid.
>
> Details of Solaris perl test failures see below "B)".
>
> Also pytest checked against one specific server version on every Linux
> variant tested, using clients with OpenSSL 4.0.0, 3.6.2, 3.5.6 and
> 3.0.20 and against every MPM.
>
> Only 5 runs out of 66 had a single (sporadic) failure.
>
> Details of Linux pytest failures see below "C)".
>
> Regards,
>
> Rainer
>
> A) Compiler warnings
> ::::::::::::::::::::
>
> - compiler warnings httpd sources:
>
> - all builds (I use recent libxml2)
>
> modules/filters/mod_xml2enc.c:609:5: warning: 'xmlAddEncodingAlias' is
> deprecated: See
> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
> [-Wdeprecated-declarations]
>
> modules/filters/mod_proxy_html.c:319:5: warning: 'htmlTagLookup' is
> deprecated: See
> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
> [-Wdeprecated-declarations]
> modules/filters/mod_proxy_html.c:366:5: warning: 'htmlTagLookup' is
> deprecated: See
> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
> [-Wdeprecated-declarations]
> modules/filters/mod_proxy_html.c:404:5: warning: 'attrs_req' is
> deprecated [-Wdeprecated-declarations]
> modules/filters/mod_proxy_html.c:405:9: warning: 'attrs_req' is
> deprecated [-Wdeprecated-declarations]
> modules/filters/mod_proxy_html.c:412:17: warning: 'htmlAttrAllowed' is
> deprecated: See
> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
> [-Wdeprecated-declarations]
>
> - when compiled against OpenSSL 4; might be fixed in upstream mod_md
>
> modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
> qualifier from pointer target type [-Wdiscarded-qualifiers]
>
> - compiler warnings bundled apr-util (from deps tarball):
>
> - only on RHEL 10 due to newest gcc
>
> srclib/apr-util/dbm/sdbm/sdbm_pair.c:234:1: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:21:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:22:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:23:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:24:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:25:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:26:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:27:17: warning: old-style function
> definition [-Wold-style-definition]
> srclib/apr-util/dbm/sdbm/sdbm_pair.h:28:17: warning: old-style function
> definition [-Wold-style-definition]
>
> - all builds, both OpenSSL versions (3.5.6, 3.6.2):
> - seems to be already fixed in 1.6.x head and 1.7.x head
>
> srclib/apr-util/crypto/apr_crypto_openssl.c:141:5: warning:
> 'ENGINE_load_builtin_engines' is deprecated: Since OpenSSL 3.0
> [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:142:5: warning:
> 'ENGINE_register_all_complete' is deprecated: Since OpenSSL 3.0
> [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:208:9: warning:
> 'ENGINE_finish' is deprecated: Since OpenSSL 3.0
> [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:209:9: warning:
> 'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:326:9: warning:
> 'ENGINE_by_id' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:330:9: warning:
> 'ENGINE_init' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
> srclib/apr-util/crypto/apr_crypto_openssl.c:331:13: warning:
> 'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
>
> - only on Solaris 10 Sparc:
>
> /srclib/apr/locks/unix/proc_mutex.c:982:49: warning:
> 'mutex_proc_pthread_cond_methods' defined but not used
> [-Wunused-const-variable=]
>
>
> B) perl unit test failures
> ::::::::::::::::::::::::::
>
> Only on Solaris, both already known.
>
> Always fails:
>
> # Failed test 4 in t/modules/buffer.t at line 37
> # Failed test 8 in t/modules/buffer.t at line 37 fail #2
>
> Fails about 2/3 of the test runs:
>
> # Failed test 3 in t/modules/sed.t at line 37 fail #2
> # posting body of size 25165824
> # ... posted body of size 25165824
> # Content Length 0
> # testing : status code for /apache/sed-echo/out-foo-grow/foobar.html
> # expected: '200'
> # received: 596
> not ok 3
>
>
> C) pytest failures
> ::::::::::::::::::
>
> Failures seem to be sporadic.
>
> modules/http2/test_004_post.py::TestPost::test_h2_004_24[0-data-1m] - ...
> modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
> modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
> modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
> modules/http2/test_008_ranges.py::TestRanges::test_h2_008_04[0] - Asse...
> modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
> modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
> modules/http2/test_500_proxy.py::TestProxy::test_h2_500_23[data-1m] - ...
> modules/http2/test_600_h2proxy.py::TestH2Proxy::test_h2_600_32[0] - as...
>
>
>
Re: [VOTE] Release httpd-2.4.68-rc1 as httpd-2.4.68
Posted by Rainer Jung <ra...@kippdata.de>.
Am 05.06.26 um 14:58 schrieb Eric Covener:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.68-rc1 as 2.4.68:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: ed9a9d4500fb48bb28eaffb3ba71d06ccf86d498fa13ab9f781da010cc488498
> *httpd-2.4.68-rc1.tar.gz
> sha512: de3d6e2dd37a600b99b63b6740a06348d6f7642109f3c35e7eb1b82088ade8a5da9145b52c232587b9c2604c33ae908d0009ada4ea3168679e7f061b3135112d
> *httpd-2.4.68-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.68-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.68-rc1-candidate>.
+1 for release and thanks for RM and especially the very intense work on
security to everyone involved!
- Sigs and hashes OK
- contents of tarballs identical
- contents of tag and tarballs identical
except for expected deltas
Built on
- SLES 12+15 (64 Bits)
- RHEL 7+8+9+10 (64 Bits)
- Solaris 10 Sparc
For all platforms built
- with default (shared) modules
- with module set reallyall
- using --enable-load-all-modules
- using libraries
- APR/APU
- bundled deps tarball
- 1.7.6/1.6.3
- 1.7.x(HEAD=r1934904)/1.6.x(HEAD=r1934904)
- 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
- 1.7.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
- 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with expat
- 1.8.x(HEAD=r1934904)/1.7.x(HEAD=r1934904) with libxml2
- trunk(HEAD=r1934904) with expat
- trunk(HEAD=r1934904) with libxml2
- OpenSSL 4.0.0-1 3.6.2-1 3.5.6-1,
For OpenSSL 4 only bundled APR/APU without APU crypto
- expat 2.8.1
- pcre 10.47
- lua 5.5.0 (compiled with LUA_COMPAT_MODULE)
- libxml2 2.15.3
- sqlite 3.53.1
- libnghttp2 1.69.0
- brotli 1.2.0
- curl 8.20.0
- jansson 2.15.0
- libldap 2.6.13
also with platform ldap on Solaris)
- in total 15 builds per platform (19 for Solaris)
- Tool chain:
- platform gcc on Linux, gcc 9.5 on Solaris 10
- CFLAGS: -O2 -g -Wall -fno-strict-aliasing
All builds succeeded.
- compiler warnings: see below "A)"
Perl tests run with OpenSSL client versions 3.6.0, 3.5.0, 3.0.15, 1.1.1w
and 1.0.2u (for RHEL 10 with 3.6.0 3.5.4 3.0.18 1.1.1w) against every
server build. MPMs tested event, worker, prefork.
- only failures in 1305 test runs on Linux
(sporadic; status code 596 in perl client)
- Sporadic failures on test runs on Solaris. Only parts of the
combinations tested there until now, but the result seems already valid.
Details of Solaris perl test failures see below "B)".
Also pytest checked against one specific server version on every Linux
variant tested, using clients with OpenSSL 4.0.0, 3.6.2, 3.5.6 and
3.0.20 and against every MPM.
Only 5 runs out of 66 had a single (sporadic) failure.
Details of Linux pytest failures see below "C)".
Regards,
Rainer
A) Compiler warnings
::::::::::::::::::::
- compiler warnings httpd sources:
- all builds (I use recent libxml2)
modules/filters/mod_xml2enc.c:609:5: warning: 'xmlAddEncodingAlias' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:319:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:366:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:404:5: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:405:9: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:412:17: warning: 'htmlAttrAllowed' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
- when compiled against OpenSSL 4; might be fixed in upstream mod_md
modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
qualifier from pointer target type [-Wdiscarded-qualifiers]
- compiler warnings bundled apr-util (from deps tarball):
- only on RHEL 10 due to newest gcc
srclib/apr-util/dbm/sdbm/sdbm_pair.c:234:1: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:21:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:22:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:23:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:24:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:25:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:26:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:27:17: warning: old-style function
definition [-Wold-style-definition]
srclib/apr-util/dbm/sdbm/sdbm_pair.h:28:17: warning: old-style function
definition [-Wold-style-definition]
- all builds, both OpenSSL versions (3.5.6, 3.6.2):
- seems to be already fixed in 1.6.x head and 1.7.x head
srclib/apr-util/crypto/apr_crypto_openssl.c:141:5: warning:
'ENGINE_load_builtin_engines' is deprecated: Since OpenSSL 3.0
[-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:142:5: warning:
'ENGINE_register_all_complete' is deprecated: Since OpenSSL 3.0
[-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:208:9: warning:
'ENGINE_finish' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:209:9: warning:
'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:326:9: warning:
'ENGINE_by_id' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:330:9: warning:
'ENGINE_init' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
srclib/apr-util/crypto/apr_crypto_openssl.c:331:13: warning:
'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
- only on Solaris 10 Sparc:
/srclib/apr/locks/unix/proc_mutex.c:982:49: warning:
'mutex_proc_pthread_cond_methods' defined but not used
[-Wunused-const-variable=]
B) perl unit test failures
::::::::::::::::::::::::::
Only on Solaris, both already known.
Always fails:
# Failed test 4 in t/modules/buffer.t at line 37
# Failed test 8 in t/modules/buffer.t at line 37 fail #2
Fails about 2/3 of the test runs:
# Failed test 3 in t/modules/sed.t at line 37 fail #2
# posting body of size 25165824
# ... posted body of size 25165824
# Content Length 0
# testing : status code for /apache/sed-echo/out-foo-grow/foobar.html
# expected: '200'
# received: 596
not ok 3
C) pytest failures
::::::::::::::::::
Failures seem to be sporadic.
modules/http2/test_004_post.py::TestPost::test_h2_004_24[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_004_post.py::TestPost::test_h2_004_25[0-data-1m] - ...
modules/http2/test_008_ranges.py::TestRanges::test_h2_008_04[0] - Asse...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_22[data-1m] - ...
modules/http2/test_500_proxy.py::TestProxy::test_h2_500_23[data-1m] - ...
modules/http2/test_600_h2proxy.py::TestH2Proxy::test_h2_600_32[0] - as...