You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Eric Covener <co...@gmail.com> on 2026/09/29 12:45:55 UTC
[VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Hi all,
Please find below the proposed release tarball and signatures:
https://dist.apache.org/repos/dist/dev/httpd/
I would like to call a VOTE over the next few days to release
this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
[ ] +1: It's not just good, it's good enough!
[ ] +0: Let's have a talk.
[ ] -1: There's trouble in paradise. Here's what's wrong.
The computed digests of the tarball up for vote are:
sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
*httpd-2.4.69-rc1.tar.gz
sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
*httpd-2.4.69-rc1.tar.gz
The candidate source is found at
<https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
--
Eric Covener
covener@gmail.com
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Giannis Christodoulou <ic...@apache.org>.
On 9/29/26 2:45 PM, Eric Covener wrote:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
+1, checked 2.4.x pyhttpd on RHEL8+9 (x86_64) comparing
2.4.69-rc1-candidate with a couple of previous versions (2.4.66, 2.4.68)
as a baseline.
Re: 2.4.x deprecation warnings
Posted by Rainer Jung <ra...@kippdata.de>.
Am 01.10.26 um 15:06 schrieb Joe Orton:
> On Thu, Oct 01, 2026 at 11:55:08AM +0200, Rainer Jung wrote:
>> modules/filters/mod_xml2enc.c:616:5: warning: 'xmlAddEncodingAlias' is
>> deprecated: See
>> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
>> [-Wdeprecated-declarations]
>
> This one relies on setting global libxml2 library context so was
> probably a bad idea to start with, we could likely turn it off for
> current library versions, it's a weird feature anyway. I haven't looked
> at the mod_proxy_html ones.
>
>> modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
>> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
>> modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
>> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
>> modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
>> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
>> modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
>> qualifier from pointer target type [-Wdiscarded-qualifiers]
>
> Fixed in r1938739, hadn't realised we were hiding the deprecation
> warnings in mod_ssl as well, fixed there too. We don't see this in CI
> because we don't build mod_md for the alternate OpenSSL versions. That
> relies on having libcurl built/linked the same way. Another one on the
> todo list :)
Thanks! Great! Yeah, changing deps away from system defaults has
consequences...
Rainer
2.4.x deprecation warnings
Posted by Joe Orton <jo...@apache.org>.
On Thu, Oct 01, 2026 at 11:55:08AM +0200, Rainer Jung wrote:
> modules/filters/mod_xml2enc.c:616:5: warning: 'xmlAddEncodingAlias' is
> deprecated: See
> https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
> [-Wdeprecated-declarations]
This one relies on setting global libxml2 library context so was
probably a bad idea to start with, we could likely turn it off for
current library versions, it's a weird feature anyway. I haven't looked
at the mod_proxy_html ones.
> modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
> deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
> modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
> qualifier from pointer target type [-Wdiscarded-qualifiers]
Fixed in r1938739, hadn't realised we were hiding the deprecation
warnings in mod_ssl as well, fixed there too. We don't see this in CI
because we don't build mod_md for the alternate OpenSSL versions. That
relies on having libcurl built/linked the same way. Another one on the
todo list :)
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Rainer Jung <ra...@kippdata.de>.
Am 29.09.26 um 14:45 schrieb Eric Covener:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [X] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
+1 for release and thanks for RM and especially the very intense work on
security to everyone involved!
- Sigs and hashes OK
- contents of tarballs identical
- contents of tag and tarballs identical
except for expected deltas
Built on
- SLES 12+15 (64 Bits)
- RHEL 7+8+9+10 (64 Bits)
- Solaris 10 Sparc
For Solaris only a single variant was build and tested.
For all Linux platforms built
- with default (shared) modules
- with module set reallyall
- using --enable-load-all-modules
- using libraries
- APR/APU
- bundled deps tarball
- 1.7.6/1.6.5
- 1.7.x(HEAD=r1936982)/1.6.x(HEAD=r1937534)
- 1.7.x(HEAD=r1936982)/1.7.x(HEAD=r1937534) with expat
- 1.7.x(HEAD=r1936982)/1.7.x(HEAD=r1937534) with libxml2
- 1.8.x(HEAD=r1936982)/1.7.x(HEAD=r1937534) with expat
- 1.8.x(HEAD=r1936982)/1.7.x(HEAD=r1937534) with libxml2
- OpenSSL 4.0.3-1 3.6.5-1 3.5.9-1,
For OpenSSL 4 only bundled APR/APU without APU crypto
- expat 2.8.5
- pcre 10.49
- lua 5.5.1 (compiled with LUA_COMPAT_MODULE)
- libxml2 2.15.4
- sqlite 3.53.4
- libnghttp2 1.70.0
- brotli 1.2.0
- curl 8.22.0, using
- nghttp3 1.18.0
- ngtcp2 1.25.0
- c-ares 1.34.8
- libpsl 0.23.3
- jansson 2.15.1
- libldap 2.7.1
- in total 15 builds per platform
- builds against APR trunk currently fail with various errrors. I will
investigate; not critical
- Tool chain:
- platform gcc on Linux, gcc 9.5 on Solaris 10
- CFLAGS: -O2 -g -Wall -fno-strict-aliasing
All builds succeeded.
- compiler warnings: see below "A)"
Perl tests run with OpenSSL client versions 3.6.0, 3.5.0, 3.0.15, 1.1.1w
and 1.0.2u (for RHEL 10 with 3.6.0 3.5.4 3.0.18 1.1.1w) against every
server build. MPMs tested event, worker, prefork.
- 941 out of planned 1350 test runs done
- no test failures until now
- pytest have not yet run; i need to adjust my automation to the
changes there
Regards,
Rainer
A) Compiler warnings
::::::::::::::::::::
- compiler warnings httpd sources:
- all builds (I use recent libxml2)
modules/filters/mod_xml2enc.c:616:5: warning: 'xmlAddEncodingAlias' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:318:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:365:5: warning: 'htmlTagLookup' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:403:5: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:404:9: warning: 'attrs_req' is
deprecated [-Wdeprecated-declarations]
modules/filters/mod_proxy_html.c:411:17: warning: 'htmlAttrAllowed' is
deprecated: See
https://gnome.pages.gitlab.gnome.org/libxml2/html/deprecated.html
[-Wdeprecated-declarations]
- when compiled against OpenSSL 4; might be fixed in upstream mod_md
modules/md/md_crypt.c:1259:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1260:13: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1265:5: warning: 'X509_cmp_current_time' is
deprecated: Since OpenSSL 4.0 [-Wdeprecated-declarations]
modules/md/md_crypt.c:1326:24: warning: initialization discards 'const'
qualifier from pointer target type [-Wdiscarded-qualifiers]
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Frank Gingras <th...@apache.org>.
On Tue, Sep 29, 2026 at 3:27 PM Giovanni Bechis <gi...@paclan.it> wrote:
> Il 29 settembre 2026 14:45:55 CEST, Eric Covener <co...@gmail.com> ha
> scritto:
>
>> Hi all,
>>
>> Please find below the proposed release tarball and signatures:
>>
>> https://dist.apache.org/repos/dist/dev/httpd/
>>
>> I would like to call a VOTE over the next few days to release
>> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
>> [ ] +1: It's not just good, it's good enough!
>> [ ] +0: Let's have a talk.
>> [ ] -1: There's trouble in paradise. Here's what's wrong.
>>
>> The computed digests of the tarball up for vote are:
>> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
>> *httpd-2.4.69-rc1.tar.gz
>> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
>> *httpd-2.4.69-rc1.tar.gz
>>
>> The candidate source is found at
>> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
>> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>>
>>
> Tested on Fedora 44 and OpenBSD-8.0.
> +1, thanks for RMing.
> Giovanni
>
+1
All tests pass here, Slackware64 15.0, thanks for the RM.
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Giovanni Bechis <gi...@paclan.it>.
Il 29 settembre 2026 14:45:55 CEST, Eric Covener <co...@gmail.com> ha scritto:
>Hi all,
>
>Please find below the proposed release tarball and signatures:
>
>https://dist.apache.org/repos/dist/dev/httpd/
>
>I would like to call a VOTE over the next few days to release
>this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
>[ ] +1: It's not just good, it's good enough!
>[ ] +0: Let's have a talk.
>[ ] -1: There's trouble in paradise. Here's what's wrong.
>
>The computed digests of the tarball up for vote are:
>sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
>*httpd-2.4.69-rc1.tar.gz
>sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
>*httpd-2.4.69-rc1.tar.gz
>
>The candidate source is found at
><https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
>and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>
>--
>Eric Covener
>covener@gmail.com
Tested on Fedora 44 and OpenBSD-8.0.
+1, thanks for RMing.
Giovanni
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Eric Covener <co...@gmail.com>.
Thanks everyone for fixing/testing/voting, calling it a little early
with the following binding PMC member votes:
+1: jorton, covener, gbechis, thumbs, jim, ichristod, steffenal, jfclere, rjung
On Tue, Sep 29, 2026 at 8:45 AM Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
--
Eric Covener
covener@gmail.com
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Jeff McKenna <jm...@gatewaygeomatics.com>.
On 2026-09-29 9:45 a.m., Eric Covener wrote:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>
+1 (compiled on Windows with Visual Studio and CMake 4.4.3)
thanks,
-jeff
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by jean-frederic clere <jf...@gmail.com>.
On 9/29/26 2:45 PM, Eric Covener wrote:
> [X] +1: It's not just good, it's good enough!
tested on VS2019 and fedora (both x86_64)
--
Cheers
Jean-Frederic
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Joe Orton <jo...@apache.org>.
On Tue, Sep 29, 2026 at 08:45:55AM -0400, Eric Covener wrote:
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [X] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
+1 and LGTM, thanks as ever for RMing.
CI passed, and builds and passes tests (current httpd-tests git) on
Fedora 44, RHEL8+9+10 (x86_64 only). mod_ssl still has that one compiler
warning on RHEL8 but not a big deal and not a regression.
I was surprised by the tarball size growing - but that's the new
test/pytest_suite in there.
Regards, Joe
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Jim Jagielski <ji...@jagunet.com>.
> On Sep 29, 2026, at 8:45 AM, Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [X] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>
>
+1: Tested on macOS 26/Tahoe, Ubuntu24 and 26
--
Jim
"This is an outrage!"
Tony Harrison
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Eric Covener <co...@gmail.com>.
On Tue, Sep 29, 2026 at 8:45 AM Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [x] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
My +1 AIX/xlc/ppc64 (perl tests only)
Re: [VOTE] Release httpd-2.4.69-rc1 as httpd-2.4.69
Posted by Eric Covener <co...@gmail.com>.
FYI I will probably call the release short of the full 72h so please
reply if you want the full/extra time!
On Tue, Sep 29, 2026 at 8:45 AM Eric Covener <co...@gmail.com> wrote:
>
> Hi all,
>
> Please find below the proposed release tarball and signatures:
>
> https://dist.apache.org/repos/dist/dev/httpd/
>
> I would like to call a VOTE over the next few days to release
> this candidate tarball httpd-2.4.69-rc1 as 2.4.69:
> [ ] +1: It's not just good, it's good enough!
> [ ] +0: Let's have a talk.
> [ ] -1: There's trouble in paradise. Here's what's wrong.
>
> The computed digests of the tarball up for vote are:
> sha256: c551b9861e26f146f57e1b1765e69c89a60b3db0ec252ccab0d36283487016bb
> *httpd-2.4.69-rc1.tar.gz
> sha512: 5e5a4a8502a3f794a1e86a980925b0ba84fa04d02996d944e3188ba0bc9b9d01ad55810aa6284aa1305b7d58aab4c35f14316bdbb6a1f0c23907683805f8b6ec
> *httpd-2.4.69-rc1.tar.gz
>
> The candidate source is found at
> <https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.69-rc1-candidate>
> and at <https://github.com/apache/httpd/tree/2.4.69-rc1-candidate>.
>
> --
> Eric Covener
> covener@gmail.com
--
Eric Covener
covener@gmail.com