Bundling APR in 2.2

[Paul Querna <ch...@force-elite.com>]

In most of the Apache 2.0.XX releases, we have been using a CVS snapshot
of APR and APR-Util.

I would like to make it an official policy that for the 2.2 cycle, we
will never use a CVS snapshot of APR.

I believe we should still bundle APR and APR-Util with HTTPd, but we
should only use the released versions of each.

This will keep it easy for end users, because APR will still be bundled
in our Source Distribution.

It will also make life much easier for System Packagers.  If we only use
released versions, APR and APR-Util can be easily placed into separate
packages.  This will become more important as more standalone
applications use APR.  

Comments/Objections?

-Paul Querna

Re: Bundling APR in 2.2

[Graham Leggett <mi...@sharp.fm>]

Joe Orton wrote:

> +1 to shipping the sources in the tarball.  In principle I like the idea
> of only shipping apr from a release tag, but it adds a significant
> burden if there needs to be an httpd security release for an apr issue. 
> I think we need to demonstrate that we can ship APR releases more often
> than once a year first.

I don't see any reason why APR would not ship more than once a year. The 
big step was v0.9 to v1.0, the step to v1.0.1 or onwards is a no 
brainer, especially for a security release.

> This is precisely dictated by APR_FIND_APR and how it's used.  Not
> bundling the apr and apr-util sources just takes away user choice, and I
> don't see any justification for doing that.

APR_FIND_APR allows you to install v0.x and v1.x simultaneously and 
choose between the two, but it will not help if APR v1.x.bar is 
installed and used by subversion, while APR v1.y.foo is used by httpd.

Regards,
Graham
--

Re: Bundling APR in 2.2

[Joe Orton <jo...@redhat.com>]

On Thu, Sep 16, 2004 at 07:41:00PM +0200, Graham Leggett wrote:
> Paul Querna wrote:
> >I believe we should still bundle APR and APR-Util with HTTPd, but we
> >should only use the released versions of each.
> >
> >This will keep it easy for end users, because APR will still be bundled
> >in our Source Distribution.

+1 to shipping the sources in the tarball.  In principle I like the idea
of only shipping apr from a release tag, but it adds a significant
burden if there needs to be an httpd security release for an apr issue. 
I think we need to demonstrate that we can ship APR releases more often
than once a year first.

> I think this will cause more problems than it solves, I would prefer to 
> see APR no longer bundled with httpd v2.2 onwards.
> 
> APR is now GA, and is available as a standalone package. It is also used 
> by other packages, like subversion etc. If APR is installed as standard 
> on a system, which APR does httpd use? The system one? The bundled one?

This is precisely dictated by APR_FIND_APR and how it's used.  Not
bundling the apr and apr-util sources just takes away user choice, and I
don't see any justification for doing that.

> Getting httpd v2.1 built as an RPM is currently broken, due to the 
> bundled APR clashing with a system APR. APR is it's own project, there 
> is no longer any need to bundle it with httpd.

That is purely a packaging issue and need not influence what goes in the
tarball.  You can easily make httpd.spec work with either an installed
or bundled apr based on an rpmbuild --with-blah flag, if you like. Or
just pick one behaviour and make it work.

joe

Re: Bundling APR in 2.2

[Graham Leggett <mi...@sharp.fm>]

Paul Querna wrote:

> In most of the Apache 2.0.XX releases, we have been using a CVS snapshot
> of APR and APR-Util.
> 
> I would like to make it an official policy that for the 2.2 cycle, we
> will never use a CVS snapshot of APR.

+1.

> I believe we should still bundle APR and APR-Util with HTTPd, but we
> should only use the released versions of each.
> 
> This will keep it easy for end users, because APR will still be bundled
> in our Source Distribution.

I think this will cause more problems than it solves, I would prefer to 
see APR no longer bundled with httpd v2.2 onwards.

APR is now GA, and is available as a standalone package. It is also used 
by other packages, like subversion etc. If APR is installed as standard 
on a system, which APR does httpd use? The system one? The bundled one?

Getting httpd v2.1 built as an RPM is currently broken, due to the 
bundled APR clashing with a system APR. APR is it's own project, there 
is no longer any need to bundle it with httpd.

Regards,
Graham
--

Re: Bundling APR in 2.2

[Paul Querna <ch...@force-elite.com>]

On Thu, 2004-09-16 at 18:13 +0100, Nick Kew wrote:
> On Thu, 16 Sep 2004, Paul Querna wrote:
> 
> > In most of the Apache 2.0.XX releases, we have been using a CVS snapshot
> > of APR and APR-Util.
> >
> > I would like to make it an official policy that for the 2.2 cycle, we
> > will never use a CVS snapshot of APR.
> 
> That makes httpd releases (relatively frequent) hostage to APR releases
> (extremely infrequent) when we need a bugfix in CVS.  Is that acceptable?

If there is a significant bug in APR, it should be fixed in a release by
them.  Regarding APR's release frequency, it is my hope that it will
become more frequent as a possible side effect of only bundling released
versions.

However, APR is still their own project, and it is up to them when they
do a release.

> > I believe we should still bundle APR and APR-Util with HTTPd, but we
> > should only use the released versions of each.
> 
> Release version ABI yes.  Release version - only if that dependency
> can be fixed (i.e. APR folks can be hurried along where necessary).

I guess we should ask them if they can make releases more often :-)

> >
> > It will also make life much easier for System Packagers.  If we only use
> > released versions, APR and APR-Util can be easily placed into separate
> > packages.  This will become more important as more standalone
> > applications use APR.
> 
> Keeping binary-compatibility (ABI) is sufficient for that, innit?

No.  We have a backwards binary compatibility policy.  This means
existing functions and public structures will not change.  It does allow
new functions, structures or interfaces to be added.  When these things
are added, and then used in Apache, we must then wait for them to appear
in an APR Release.

-Paul Querna

Re: Bundling APR in 2.2

[Garrett Rooney <ro...@electricjellyfish.net>]

Nick Kew wrote:
> On Thu, 16 Sep 2004, Paul Querna wrote:
> 
> 
>>In most of the Apache 2.0.XX releases, we have been using a CVS snapshot
>>of APR and APR-Util.
>>
>>I would like to make it an official policy that for the 2.2 cycle, we
>>will never use a CVS snapshot of APR.
> 
> 
> That makes httpd releases (relatively frequent) hostage to APR releases
> (extremely infrequent) when we need a bugfix in CVS.  Is that acceptable?

So have one of the many APR developers on the HTTPD team roll an APR 
release if you need a fix.  There is absolutely zero reason that APR 
releases need to be infrequent.  Don't make one problem (totally random 
versions of APR being distributed out into the wild) worse in an attempt 
to avoid another problem (infrequent APR releases).  Just fix the second 
problem and be done with it.

Having HTTPD ship CVS snapshots of APR is inexcusable.  There's no 
reason that HTTPD is special, it should be using released versions just 
like everyone else.

-garrett

Re: Bundling APR in 2.2

[Nick Kew <ni...@webthing.com>]

On Thu, 16 Sep 2004, Paul Querna wrote:

> In most of the Apache 2.0.XX releases, we have been using a CVS snapshot
> of APR and APR-Util.
>
> I would like to make it an official policy that for the 2.2 cycle, we
> will never use a CVS snapshot of APR.

That makes httpd releases (relatively frequent) hostage to APR releases
(extremely infrequent) when we need a bugfix in CVS.  Is that acceptable?

> I believe we should still bundle APR and APR-Util with HTTPd, but we
> should only use the released versions of each.

Release version ABI yes.  Release version - only if that dependency
can be fixed (i.e. APR folks can be hurried along where necessary).

>
> It will also make life much easier for System Packagers.  If we only use
> released versions, APR and APR-Util can be easily placed into separate
> packages.  This will become more important as more standalone
> applications use APR.

Keeping binary-compatibility (ABI) is sufficient for that, innit?

-- 
Nick Kew