Life cycle questions

[Ben Harper <be...@rackspace.com>]

Greetings,

I have some questions regarding the life cycle of the different versions 
of apr and apr-util that the 'Version Numbers' page did not fully 
answer.  Different projects handle life cycle differently.  Some only 
support the latest version, while others support several versions 
concurrently.  Is only 1.6 support or will 1.5 still get updates?

The project I work with (ius.io) currently packages apr 1.5 and apr-util 
1.5 so we can package httpd.  We are trying to determine if we need to 
upgrade these packages.

Thanks,
Ben
IUS & Rackspace

Re: Life cycle questions

[William A Rowe Jr <wr...@rowe-clan.net>]

On Tue, Aug 1, 2017 at 8:24 AM, Ben Harper <be...@rackspace.com> wrote:
>
> On 08/01/2017 02:14 AM, Nick Kew wrote:
>>
>> On Mon, 2017-07-31 at 09:23 -0500, Ben Harper wrote:
>>
>>> Thanks for the timely replies.  Would it be safe to say that there will
>>> be no breaking changes till a 2.x version?
>>
>>
>> At the simple level of the API, yes.  It should continue to
>> serve as a drop-in replacement for earlier versions.
>>
>> Build options&dependencies changed from 1.5 to 1.6 and may
>> change again.  So you might update your build.
>>
> Thanks for that confirmation.  Hopefully one last question, would that be
> true for apr-util as well?

Almost. ABI is stable through all 1.x apr & apr-util builds, as noted in
the versioning doc you cited.

With the ultimate release of APR 2.0, all of the apr-util symbols will be
folded into the primary apr 2.0 library. While we will retain some apu*.h
files and apu_* namespace use for some level of source compatibility,
using apr 2.0 will require reconfig/recompilation, and quite possibly some
source modifications, particularly if APR/apr-util 0.9.x legacy names are
still not corrected to the 1.x equivalents.

Re: Life cycle questions

[Ben Harper <be...@rackspace.com>]

On 08/01/2017 02:14 AM, Nick Kew wrote:
> On Mon, 2017-07-31 at 09:23 -0500, Ben Harper wrote:
> 
>> Thanks for the timely replies.  Would it be safe to say that there will
>> be no breaking changes till a 2.x version?
> 
> At the simple level of the API, yes.  It should continue to
> serve as a drop-in replacement for earlier versions.
> 
> Build options&dependencies changed from 1.5 to 1.6 and may
> change again.  So you might update your build.
> 
Thanks for that confirmation.  Hopefully one last question, would that 
be true for apr-util as well?

-Ben
IUS & Rackspace

Re: Life cycle questions

[Nick Kew <ni...@apache.org>]

On Mon, 2017-07-31 at 09:23 -0500, Ben Harper wrote:

> Thanks for the timely replies.  Would it be safe to say that there will 
> be no breaking changes till a 2.x version?

At the simple level of the API, yes.  It should continue to
serve as a drop-in replacement for earlier versions.

Build options&dependencies changed from 1.5 to 1.6 and may
change again.  So you might update your build.

-- 
Nick Kew

Re: Life cycle questions

[Ben Harper <be...@rackspace.com>]

On 07/30/2017 01:16 PM, William A Rowe Jr wrote:
> On Jul 28, 2017 6:37 PM, "Nick Kew" <ni...@apache.org> wrote:
> 
> On Fri, 2017-07-28 at 15:02 -0500, Ben Harper wrote:
>> Greetings,
>>
>> I have some questions regarding the life cycle of the different versions
>> of apr and apr-util that the 'Version Numbers' page did not fully
>> answer.  Different projects handle life cycle differently.  Some only
>> support the latest version, while others support several versions
>> concurrently.  Is only 1.6 support or will 1.5 still get updates?
> 
> The distinction is less important than with some projects.
> 
> 1.5 is unlikely to get updates now unless hit by some serious
> security issue.  But 1.6 is really just an incremental update
> on 1.5: the main reason for the version bump is how it deals
> with third-party dependencies: expat is unbundled, and more
> up-to-date versions of some other libraries are supported.
> 
> 
> Note also, beyond self contained enhancements (some of which might become
> httpd 2.4 prereqs for newer features), we have been pretty good about
> making new dependencies optional in the 1.x series. So adopting 1.6 (and at
> some point, 1.7) should be relatively painless.
> 


Hey Nick and William,

Thanks for the timely replies.  Would it be safe to say that there will 
be no breaking changes till a 2.x version?

Thanks,
Ben
IUS & Rackspace

Re: Life cycle questions

[William A Rowe Jr <wr...@rowe-clan.net>]

On Jul 28, 2017 6:37 PM, "Nick Kew" <ni...@apache.org> wrote:

On Fri, 2017-07-28 at 15:02 -0500, Ben Harper wrote:
> Greetings,
>
> I have some questions regarding the life cycle of the different versions
> of apr and apr-util that the 'Version Numbers' page did not fully
> answer.  Different projects handle life cycle differently.  Some only
> support the latest version, while others support several versions
> concurrently.  Is only 1.6 support or will 1.5 still get updates?

The distinction is less important than with some projects.

1.5 is unlikely to get updates now unless hit by some serious
security issue.  But 1.6 is really just an incremental update
on 1.5: the main reason for the version bump is how it deals
with third-party dependencies: expat is unbundled, and more
up-to-date versions of some other libraries are supported.


Note also, beyond self contained enhancements (some of which might become
httpd 2.4 prereqs for newer features), we have been pretty good about
making new dependencies optional in the 1.x series. So adopting 1.6 (and at
some point, 1.7) should be relatively painless.

Re: Life cycle questions

[Nick Kew <ni...@apache.org>]

On Fri, 2017-07-28 at 15:02 -0500, Ben Harper wrote:
> Greetings,
> 
> I have some questions regarding the life cycle of the different versions 
> of apr and apr-util that the 'Version Numbers' page did not fully 
> answer.  Different projects handle life cycle differently.  Some only 
> support the latest version, while others support several versions 
> concurrently.  Is only 1.6 support or will 1.5 still get updates?

The distinction is less important than with some projects.

1.5 is unlikely to get updates now unless hit by some serious
security issue.  But 1.6 is really just an incremental update
on 1.5: the main reason for the version bump is how it deals
with third-party dependencies: expat is unbundled, and more
up-to-date versions of some other libraries are supported.

> The project I work with (ius.io) currently packages apr 1.5 and apr-util 
> 1.5 so we can package httpd.  We are trying to determine if we need to 
> upgrade these packages.

The latest httpd packages APR 1.6: it resolves some issues
for them.  Including security issue cve-2012-0876 for users who
use the bundled expat.

Ultimately if you don't upgrade, you may find your users clamouring
for more up-to-date versions of libraries like mysql and openssl
than will build (cleanly, out-of-the-box) with 1.5.

-- 
Nick Kew