Kolab Groupware OBS

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 7

httpd.spec Changed

@@ -1,45 +1,23 @@
-%if 0%{?opensuse_bs}
-#!BuildIgnore: elinks
-#!BuildIgnore: links
-#!BuildIgnore: lynx
-#!BuildIgnore: systemd
-%endif
-
-%if 0%{?suse_version} < 1 && 0%{?fedora} < 1 && 0%{?rhel} < 7
-%global with_systemd 0
-%else
-%global with_systemd 1
-%endif
-
-%{!?_unitdir: %global _unitdir /usr/lib/systemd/system}
-
 %define contentdir %{_datadir}/httpd
 %define docroot /var/www
-%if 0%{?rhel} > 6 || 0%{?fedora} > 17
-%define _httpdrundir /run/httpd
-%else
-%define _httpdrundir /var/run/httpd
-%endif
 %define suexec_caller apache
 %define mmn 20120211
-%define mmnisa %{mmn}-%{__isa_name}-%{__isa_bits}
-%define vstring Enterprise Linux
-
-# Drop automatic provides for module DSOs
-%{?filter_setup:
-%filter_provides_in %{_libdir}/httpd/modules/.*\.so$
-%filter_setup
-}
+%define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
+%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
+%if 0%{?fedora} < 27
+%global mpm prefork
+%else
+%global mpm event
+%endif
 
 Summary: Apache HTTP Server
 Name: httpd
 Version: 2.4.27
-Release: 1%{?dist}
-URL: http://httpd.apache.org/
-Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
+Release: 8%{?dist}
+URL: https://httpd.apache.org/
+Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
 Source1: index.html
 Source2: httpd.logrotate
-Source3: httpd.sysconf
 Source4: httpd-ssl-pass-dialog
 Source5: httpd.tmpfiles
 Source6: httpd.service
@@ -67,9 +45,9 @@
 # Documentation
 Source30: README.confd
 Source31: README.confmod
+Source32: httpd.service.xml
 Source40: htcacheclean.service
 Source41: htcacheclean.sysconf
-Source100: httpd.init
 # build/scripts patches
 Patch1: httpd-2.4.1-apctl.patch
 Patch2: httpd-2.4.9-apxs.patch
@@ -77,65 +55,52 @@
 Patch5: httpd-2.4.3-layout.patch
 Patch6: httpd-2.4.3-apctl-systemd.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.10-detect-systemd.patch
+Patch19: httpd-2.4.25-detect-systemd.patch
 # Features/functional changes
 Patch23: httpd-2.4.4-export.patch
 Patch24: httpd-2.4.1-corelimit.patch
-Patch25: httpd-2.4.1-selinux.patch
+Patch25: httpd-2.4.25-selinux.patch
 Patch26: httpd-2.4.4-r1337344+.patch
 Patch27: httpd-2.4.2-icons.patch
-Patch29: httpd-2.4.10-mod_systemd.patch
+Patch29: httpd-2.4.27-systemd.patch
 Patch30: httpd-2.4.4-cachehardmax.patch
 Patch31: httpd-2.4.18-sslmultiproxy.patch
 Patch34: httpd-2.4.17-socket-activation.patch
 Patch35: httpd-2.4.17-sslciphdefault.patch
 # Bug fixes
-Patch55: httpd-2.4.4-malformed-host.patch
 Patch56: httpd-2.4.4-mod_unique_id.patch
 Patch57: httpd-2.4.10-sigint.patch
-Patch58: httpd-2.4.17-debug-crash.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=1397243
+Patch58: httpd-2.4.25-r1738878.patch
+Patch59: httpd-2.4.27-r1808230.patch
 # Security fixes
+Patch200: httpd-2.4.27-CVE-2017-9798.patch
+
 License: ASL 2.0
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
-BuildRequires: autoconf, perl, pkgconfig, findutils, xmlto
-BuildRequires: zlib-devel, libselinux-devel, lua-devel
-BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.2.0, pcre-devel >= 5.0
-%if 0%{?with_systemd}
-BuildRequires: systemd-devel
-%endif
-Requires: /etc/mime.types
-%if 0%{?fedora} > 1 || 0%{?rhel} > 7
-BuildRequires: system-logos-httpd
+BuildRequires: autoconf, perl-generators, pkgconfig, findutils, xmlto
+%if 0%{?fedora}
+BuildRequires: perl-interpreter
 %else
-BuildRequires: system-logos
+BuildRequires: perl
 %endif
+BuildRequires: zlib-devel, libselinux-devel, lua-devel
+BuildRequires: apr-devel >= 1.5.0, apr-util-devel >= 1.5.0, pcre-devel >= 5.0
+BuildRequires: systemd-devel
+Requires: /etc/mime.types, system-logos-httpd
+Obsoletes: httpd-suexec
 Provides: webserver
-Provides: mod_dav = %{version}-%{release}
-Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmn}%{__isa_name}%{__isa_bits}
+Provides: mod_dav = %{version}-%{release}, httpd-suexec = %{version}-%{release}
+Provides: httpd-mmn = %{mmn}, httpd-mmn = %{mmnisa}
 Requires: httpd-tools = %{version}-%{release}
 Requires: httpd-filesystem = %{version}-%{release}
+Requires: mod_http2
 Requires(pre): httpd-filesystem
-%if 0%{?with_systemd}
-%if 0%{?suse_version}
-Requires(post):     systemd
-Requires(postun):   systemd
-Requires(preun):    systemd
-%else
-Requires(post):     systemd-units
-Requires(postun):   systemd-units
-Requires(preun):    coreutils
-Requires(preun):    systemd-units
-%endif
-%else
-Requires(post):     chkconfig
-Requires(post):     initscripts
-Requires(postun):   initscripts
-Requires(preun):    chkconfig
-Requires(preun):    initscripts
-%endif
+Requires(preun): systemd-units
+Requires(postun): systemd-units
+Requires(post): systemd-units
 Conflicts: apr < 1.5.0-1
-Requires: apr-util >= 1.5.3
 
 %description
 The Apache HTTP Server is a powerful, efficient, and extensible
@@ -180,14 +145,6 @@
 for the Apache HTTP server including the correct permissions
 for the directories.
 
-%package suexec
-Group: System Environment/Daemons
-Summary: suexec for the Apache HTTP Server
-
-%description suexec
-The httpd-suexec package contains the suexec module for the
-Apache HTTP Server.
-
 %package tools
 Group: System Environment/Daemons
 Summary: Tools for use with the Apache HTTP Server
@@ -201,10 +158,12 @@
 Summary: SSL/TLS module for the Apache HTTP Server
 Epoch: 1
 BuildRequires: openssl-devel
-Requires(post): openssl >= 1:1.0.1e, /bin/cat, /bin/hostname
-Requires(pre): httpd
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmn}%{__isa_name}%{__isa_bits}
+Requires(post): openssl, /bin/cat, hostname
+Requires(pre): httpd-filesystem
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 Obsoletes: stronghold-mod_ssl
+# Require an OpenSSL which supports PROFILE=SYSTEM
+Conflicts: openssl-libs < 1:1.0.1h-4
 
 %description -n mod_ssl
 The mod_ssl module provides strong cryptography for the Apache Web
@@ -214,7 +173,7 @@
 %package -n mod_proxy_html
 Group: System Environment/Daemons
 Summary: HTML and XML content filters for the Apache HTTP Server
-Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmn}%{__isa_name}%{__isa_bits}
+Requires: httpd = 0:%{version}-%{release}, httpd-mmn = %{mmnisa}
 BuildRequires: libxml2-devel
 Epoch: 1
 Obsoletes: mod_proxy_html < 1:2.4.1-2
@@ -226,8 +185,8 @@
 %package -n mod_ldap
 Group: System Environment/Daemons
 Summary: LDAP authentication modules for the Apache HTTP Server

httpd-2.4.10-sigint.patch Changed

@@ -1,7 +1,8 @@
-diff -ur httpd-2.4.27.orig/server/mpm/prefork/prefork.c httpd-2.4.27/server/mpm/prefork/prefork.c
---- httpd-2.4.27.orig/server/mpm/prefork/prefork.c	2017-06-05 14:09:49.000000000 +0200
-+++ httpd-2.4.27/server/mpm/prefork/prefork.c	2017-08-16 11:33:00.428237257 +0200
-@@ -220,6 +220,9 @@
+diff --git a/server/mpm/prefork/prefork.c b/server/mpm/prefork/prefork.c
+index 559f90a..a386a75 100644
+--- a/server/mpm/prefork/prefork.c
++++ b/server/mpm/prefork/prefork.c
+@@ -220,6 +220,9 @@ static void clean_child_exit(int code)
  {
      retained->mpm->mpm_state = AP_MPMQ_STOPPING;
  
@@ -11,7 +12,7 @@
      if (pchild) {
          apr_pool_destroy(pchild);
      }
-@@ -699,6 +702,13 @@
+@@ -699,6 +702,13 @@ static int make_child(server_rec *s, int slot, int bucket)
           */
          apr_signal(SIGHUP, just_die);
          apr_signal(SIGTERM, just_die);
@@ -25,4 +26,3 @@
          /* The child process just closes listeners on AP_SIG_GRACEFUL.
           * The pod is used for signalling the graceful restart.
           */
-Only in httpd-2.4.27/server/mpm/prefork: prefork.c.orig

httpd-2.4.25-detect-systemd.patch Added

@@ -0,0 +1,75 @@
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+diff -uap httpd-2.4.25/acinclude.m4.detectsystemd httpd-2.4.25/acinclude.m4
+--- httpd-2.4.25/acinclude.m4.detectsystemd
++++ httpd-2.4.25/acinclude.m4
+@@ -604,6 +604,30 @@
+   fi
+ ])
+ 
++AC_DEFUN(APACHE_CHECK_SYSTEMD, [                                                                        
++dnl Check for systemd support for listen.c's socket activation.
++case $host in
++*-linux-*)
++   if test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd; then
++      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd`
++   elif test -n "$PKGCONFIG" && $PKGCONFIG --exists libsystemd-daemon; then
++      SYSTEMD_LIBS=`$PKGCONFIG --libs libsystemd-daemon`
++   else
++      AC_CHECK_LIB(systemd-daemon, sd_notify, SYSTEMD_LIBS="-lsystemd-daemon")
++   fi
++   if test -n "$SYSTEMD_LIBS"; then
++      AC_CHECK_HEADERS(systemd/sd-daemon.h)
++      if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
++        AC_MSG_WARN([Your system does not support systemd.])
++      else
++        APR_ADDTO(HTTPD_LIBS, [$SYSTEMD_LIBS])
++        AC_DEFINE(HAVE_SYSTEMD, 1, [Define if systemd is supported])
++      fi
++   fi
++   ;;
++esac
++])
++
+ dnl
+ dnl APACHE_EXPORT_ARGUMENTS
+ dnl Export (via APACHE_SUBST) the various path-related variables that
+diff -uap httpd-2.4.25/configure.in.detectsystemd httpd-2.4.25/configure.in
+--- httpd-2.4.25/configure.in.detectsystemd
++++ httpd-2.4.25/configure.in
+@@ -234,6 +234,7 @@
+   AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
+   APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
++  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
+ else
+   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+ fi
+@@ -504,6 +510,8 @@
+     AC_DEFINE(HAVE_GMTOFF, 1, [Define if struct tm has a tm_gmtoff field])
+ fi
+ 
++APACHE_CHECK_SYSTEMD
++
+ dnl ## Set up any appropriate OS-specific environment variables for apachectl
+ 
+ case $host in
+@@ -668,6 +676,7 @@
+ APACHE_SUBST(BUILTIN_LIBS)
+ APACHE_SUBST(SHLIBPATH_VAR)
+ APACHE_SUBST(OS_SPECIFIC_VARS)
++APACHE_SUBST(HTTPD_LIBS)
+ 
+ PRE_SHARED_CMDS='echo ""'
+ POST_SHARED_CMDS='echo ""'
+--- httpd-2.4.25/Makefile.in.detectsystemd
++++ httpd-2.4.25/Makefile.in
+@@ -4,7 +4,7 @@
+ 
+ PROGRAM_NAME         = $(progname)
+ PROGRAM_SOURCES      = modules.c
+-PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(PCRE_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
++PROGRAM_LDADD        = buildmark.o $(HTTPD_LDFLAGS) $(PROGRAM_DEPENDENCIES) $(HTTPD_LIBS) $(EXTRA_LIBS) $(AP_LIBS) $(LIBS)
+ PROGRAM_PRELINK      = $(COMPILE) -c $(top_srcdir)/server/buildmark.c
+ PROGRAM_DEPENDENCIES = \
+   server/libmain.la \

httpd-2.4.25-r1738878.patch Added

@@ -0,0 +1,140 @@
+diff --git a/modules/proxy/ajp.h b/modules/proxy/ajp.h
+index c119a7e..267150a 100644
+--- a/modules/proxy/ajp.h
++++ b/modules/proxy/ajp.h
+@@ -413,12 +413,14 @@ apr_status_t ajp_ilink_receive(apr_socket_t *sock, ajp_msg_t *msg);
+  * @param sock      backend socket
+  * @param r         current request
+  * @param buffsize  max size of the AJP packet.
++ * @param secret    authentication secret
+  * @param uri       requested uri
+  * @return          APR_SUCCESS or error
+  */
+ apr_status_t ajp_send_header(apr_socket_t *sock, request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri);
++                             apr_uri_t *uri,
++                             const char *secret);
+ 
+ /**
+  * Read the ajp message and return the type of the message.
+diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
+index 67353a7..680a8f3 100644
+--- a/modules/proxy/ajp_header.c
++++ b/modules/proxy/ajp_header.c
+@@ -213,7 +213,8 @@ AJPV13_REQUEST/AJPV14_REQUEST=
+ 
+ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+                                           request_rec *r,
+-                                          apr_uri_t *uri)
++                                          apr_uri_t *uri,
++                                          const char *secret)
+ {
+     int method;
+     apr_uint32_t i, num_headers = 0;
+@@ -293,17 +294,15 @@ static apr_status_t ajp_marshal_into_msgb(ajp_msg_t *msg,
+                    i, elts[i].key, elts[i].val);
+     }
+ 
+-/* XXXX need to figure out how to do this
+-    if (s->secret) {
++    if (secret) {
+         if (ajp_msg_append_uint8(msg, SC_A_SECRET) ||
+-            ajp_msg_append_string(msg, s->secret)) {
++            ajp_msg_append_string(msg, secret)) {
+             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(03228)
+-                   "Error ajp_marshal_into_msgb - "
++                   "ajp_marshal_into_msgb: "
+                    "Error appending secret");
+             return APR_EGENERAL;
+         }
+     }
+- */
+ 
+     if (r->user) {
+         if (ajp_msg_append_uint8(msg, SC_A_REMOTE_USER) ||
+@@ -671,7 +670,8 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg,
+ apr_status_t ajp_send_header(apr_socket_t *sock,
+                              request_rec *r,
+                              apr_size_t buffsize,
+-                             apr_uri_t *uri)
++                             apr_uri_t *uri,
++                             const char *secret)
+ {
+     ajp_msg_t *msg;
+     apr_status_t rc;
+@@ -683,7 +683,7 @@ apr_status_t ajp_send_header(apr_socket_t *sock,
+         return rc;
+     }
+ 
+-    rc = ajp_marshal_into_msgb(msg, r, uri);
++    rc = ajp_marshal_into_msgb(msg, r, uri, secret);
+     if (rc != APR_SUCCESS) {
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00988)
+                "ajp_send_header: ajp_marshal_into_msgb failed");
+diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
+index f6fb473..f693f63 100644
+--- a/modules/proxy/mod_proxy.c
++++ b/modules/proxy/mod_proxy.c
+@@ -314,6 +314,12 @@ static const char *set_worker_param(apr_pool_t *p,
+                                 (int)sizeof(worker->s->upgrade));
+         }
+     }
++    else if (!strcasecmp(key, "secret")) {
++        if (PROXY_STRNCPY(worker->s->secret, val) != APR_SUCCESS) {
++            return apr_psprintf(p, "Secret length must be < %d characters",
++                                (int)sizeof(worker->s->secret));
++        }
++    }
+     else {
+         if (set_worker_hc_param_f) {
+             return set_worker_hc_param_f(p, s, worker, key, val, NULL);
+diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h
+index 8a0ad10..f92c185 100644
+--- a/modules/proxy/mod_proxy.h
++++ b/modules/proxy/mod_proxy.h
+@@ -352,6 +352,7 @@ PROXY_WORKER_HC_FAIL )
+ #define PROXY_WORKER_MAX_HOSTNAME_SIZE  64
+ #define PROXY_BALANCER_MAX_HOSTNAME_SIZE PROXY_WORKER_MAX_HOSTNAME_SIZE
+ #define PROXY_BALANCER_MAX_STICKY_SIZE  64
++#define PROXY_WORKER_MAX_SECRET_SIZE    64
+ 
+ /* RFC-1035 mentions limits of 255 for host-names and 253 for domain-names,
+  * dotted together(?) this would fit the below size (+ trailing NUL).
+@@ -443,6 +444,7 @@ typedef struct {
+     hcmethod_t      method;     /* method to use for health check */
+     apr_interval_time_t interval;
+     char      upgrade[PROXY_WORKER_MAX_SCHEME_SIZE];/* upgrade protocol used by mod_proxy_wstunnel */
++    char      secret[PROXY_WORKER_MAX_SECRET_SIZE]; /* authentication secret (e.g. AJP13) */
+ } proxy_worker_shared;
+ 
+ #define ALIGNED_PROXY_WORKER_SHARED_SIZE (APR_ALIGN_DEFAULT(sizeof(proxy_worker_shared)))
+diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
+index 051724e..e706518 100644
+--- a/modules/proxy/mod_proxy_ajp.c
++++ b/modules/proxy/mod_proxy_ajp.c
+@@ -193,6 +193,7 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+     apr_off_t content_length = 0;
+     int original_status = r->status;
+     const char *original_status_line = r->status_line;
++    const char *secret = NULL;
+ 
+     if (psf->io_buffer_size_set)
+        maxsize = psf->io_buffer_size;
+@@ -202,12 +203,15 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+        maxsize = AJP_MSG_BUFFER_SZ;
+     maxsize = APR_ALIGN(maxsize, 1024);
+ 
++    if (*conn->worker->s->secret)
++        secret = conn->worker->s->secret;
++
+     /*
+      * Send the AJP request to the remote server
+      */
+ 
+     /* send request headers */
+-    status = ajp_send_header(conn->sock, r, maxsize, uri);
++    status = ajp_send_header(conn->sock, r, maxsize, uri, secret);
+     if (status != APR_SUCCESS) {
+         conn->close = 1;
+         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r, APLOGNO(00868)

httpd-2.4.25-selinux.patch Added

@@ -0,0 +1,61 @@
+
+Log the SELinux context at startup.
+
+Upstream-Status: unlikely to be any interest in this upstream
+
+--- httpd-2.4.1/configure.in.selinux
++++ httpd-2.4.1/configure.in
+@@ -458,6 +458,11 @@ fopen64
+ dnl confirm that a void pointer is large enough to store a long integer
+ APACHE_CHECK_VOID_PTR_LEN
+ 
++AC_CHECK_LIB(selinux, is_selinux_enabled, [
++   AC_DEFINE(HAVE_SELINUX, 1, [Defined if SELinux is supported])
++   APR_ADDTO(HTTPD_LIBS, [-lselinux])
++])
++
+ AC_CACHE_CHECK([for gettid()], ac_cv_gettid,
+ [AC_TRY_RUN(#define _GNU_SOURCE
+ #include <unistd.h>
+--- httpd-2.4.1/server/core.c.selinux
++++ httpd-2.4.1/server/core.c
+@@ -58,6 +58,10 @@
+ #include <unistd.h>
+ #endif
+ 
++#ifdef HAVE_SELINUX
++#include <selinux/selinux.h>
++#endif
++
+ /* LimitRequestBody handling */
+ #define AP_LIMIT_REQ_BODY_UNSET         ((apr_off_t) -1)
+ #define AP_DEFAULT_LIMIT_REQ_BODY       ((apr_off_t) 0)
+@@ -4452,6 +4456,28 @@ static int core_post_config(apr_pool_t *
+     }
+ #endif
+ 
++#ifdef HAVE_SELINUX
++    {
++        static int already_warned = 0;
++        int is_enabled = is_selinux_enabled() > 0;
++        
++        if (is_enabled && !already_warned) {
++            security_context_t con;
++            
++            if (getcon(&con) == 0) {
++                
++                ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, NULL,
++                             "SELinux policy enabled; "
++                             "httpd running as context %s", con);
++                
++                already_warned = 1;
++                
++                freecon(con);
++            }
++        }
++    }
++#endif
++
+     return OK;
+ }
+

httpd-2.4.27-CVE-2017-9798.patch Added

httpd-2.4.27-r1808230.patch Added

@@ -0,0 +1,131 @@
+# ./pullrev.sh 1808230
+http://svn.apache.org/viewvc?view=revision&revision=1808230
+
+--- httpd-2.4.27/server/protocol.c
++++ httpd-2.4.27/server/protocol.c
+@@ -1708,62 +1708,88 @@
+         ctx->tmpbb = apr_brigade_create(r->pool, r->connection->bucket_alloc);
+     }
+ 
+-    /* Loop through this set of buckets to compute their length
+-     */
++    /* Loop through the brigade to count the length. To avoid
++     * arbitrary memory consumption with morphing bucket types, this
++     * loop will stop and pass on the brigade when necessary. */
+     e = APR_BRIGADE_FIRST(b);
+     while (e != APR_BRIGADE_SENTINEL(b)) {
++        apr_status_t rv;
++
+         if (APR_BUCKET_IS_EOS(e)) {
+             eos = 1;
+             break;
+         }
+-        if (e->length == (apr_size_t)-1) {
++        /* For a flush bucket, fall through to pass the brigade and
++         * flush now. */
++        else if (APR_BUCKET_IS_FLUSH(e)) {
++            e = APR_BUCKET_NEXT(e);
++        }
++        /* For metadata bucket types other than FLUSH, loop. */
++        else if (APR_BUCKET_IS_METADATA(e)) {
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For determinate length data buckets, count the length and
++         * continue. */
++        else if (e->length != (apr_size_t)-1) {
++            r->bytes_sent += e->length;
++            e = APR_BUCKET_NEXT(e);
++            continue;
++        }
++        /* For indeterminate length data buckets, perform one read. */
++        else /* e->length == (apr_size_t)-1 */ {
+             apr_size_t len;
+             const char *ignored;
+-            apr_status_t rv;
+-
+-            /* This is probably a pipe bucket.  Send everything
+-             * prior to this, and then read the data for this bucket.
+-             */
++        
+             rv = apr_bucket_read(e, &ignored, &len, eblock);
++            if ((rv != APR_SUCCESS) && !APR_STATUS_IS_EAGAIN(rv)) {
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
++                              "ap_content_length_filter: "
++                              "apr_bucket_read() failed");
++                return rv;
++            }
+             if (rv == APR_SUCCESS) {
+-                /* Attempt a nonblocking read next time through */
+                 eblock = APR_NONBLOCK_READ;
++                e = APR_BUCKET_NEXT(e);
+                 r->bytes_sent += len;
+             }
+             else if (APR_STATUS_IS_EAGAIN(rv)) {
+-                /* Output everything prior to this bucket, and then
+-                 * do a blocking read on the next batch.
+-                 */
+-                if (e != APR_BRIGADE_FIRST(b)) {
+-                    apr_bucket *flush;
+-                    apr_brigade_split_ex(b, e, ctx->tmpbb);
+-                    flush = apr_bucket_flush_create(r->connection->bucket_alloc);
++                apr_bucket *flush;
+ 
+-                    APR_BRIGADE_INSERT_TAIL(b, flush);
+-                    rv = ap_pass_brigade(f->next, b);
+-                    if (rv != APR_SUCCESS || f->c->aborted) {
+-                        return rv;
+-                    }
+-                    apr_brigade_cleanup(b);
+-                    APR_BRIGADE_CONCAT(b, ctx->tmpbb);
+-                    e = APR_BRIGADE_FIRST(b);
++                /* Next read must block. */
++                eblock = APR_BLOCK_READ;
+ 
+-                    ctx->data_sent = 1;
+-                }
+-                eblock = APR_BLOCK_READ;
+-                continue;
++                /* Ensure the last bucket to pass down is a flush if
++                 * the next read will block. */
++                flush = apr_bucket_flush_create(f->c->bucket_alloc);
++                APR_BUCKET_INSERT_BEFORE(e, flush);
+             }
+-            else {
+-                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(00574)
+-                              "ap_content_length_filter: "
+-                              "apr_bucket_read() failed");
+-                return rv;
+-            }
+         }
+-        else {
+-            r->bytes_sent += e->length;
++
++        /* Optimization: if the next bucket is EOS (directly after a
++         * bucket morphed to the heap, or a flush), short-cut to
++         * handle EOS straight away - allowing C-L to be determined
++         * for content which is already entirely in memory. */
++        if (e != APR_BRIGADE_SENTINEL(b) && APR_BUCKET_IS_EOS(e)) {
++            continue;
+         }
+-        e = APR_BUCKET_NEXT(e);
++
++        /* On reaching here, pass on everything in the brigade up to
++         * this point. */
++        apr_brigade_split_ex(b, e, ctx->tmpbb);
++        
++        rv = ap_pass_brigade(f->next, b);
++        if (rv != APR_SUCCESS) {
++            return rv;
++        }
++        else if (f->c->aborted) {
++            return APR_ECONNABORTED;
++        }
++        apr_brigade_cleanup(b);
++        APR_BRIGADE_CONCAT(b, ctx->tmpbb);
++        e = APR_BRIGADE_FIRST(b);
++        
++        ctx->data_sent = 1;
+     }
+ 
+     /* If we've now seen the entire response and it's otherwise

httpd-2.4.27-systemd.patch Added

@@ -0,0 +1,188 @@
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+diff -uap httpd-2.4.27/modules/arch/unix/config5.m4.systemd httpd-2.4.27/modules/arch/unix/config5.m4
+--- httpd-2.4.27/modules/arch/unix/config5.m4.systemd
++++ httpd-2.4.27/modules/arch/unix/config5.m4
+@@ -18,6 +18,16 @@
+   fi
+ ])
+ 
++APACHE_MODULE(systemd, Systemd support, , , all, [
++  if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
++    AC_MSG_WARN([Your system does not support systemd.])
++    enable_systemd="no"
++  else
++    APR_ADDTO(MOD_SYSTEMD_LDADD, [$SYSTEMD_LIBS])
++    enable_systemd="yes"
++  fi
++])
++
+ APR_ADDTO(INCLUDES, [-I\$(top_srcdir)/$modpath_current])
+ 
+ APACHE_MODPATH_FINISH
+diff -uap httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd httpd-2.4.27/modules/arch/unix/mod_systemd.c
+--- httpd-2.4.27/modules/arch/unix/mod_systemd.c.systemd
++++ httpd-2.4.27/modules/arch/unix/mod_systemd.c
+@@ -0,0 +1,161 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ * 
++ */
++
++#include <stdint.h>
++#include <ap_config.h>
++#include "ap_mpm.h"
++#include <http_core.h>
++#include <httpd.h>
++#include <http_log.h>
++#include <apr_version.h>
++#include <apr_pools.h>
++#include <apr_strings.h>
++#include "unixd.h"
++#include "scoreboard.h"
++#include "mpm_common.h"
++
++#include "systemd/sd-daemon.h"
++
++#if APR_HAVE_UNISTD_H
++#include <unistd.h>
++#endif
++
++static int shutdown_timer = 0;
++static int shutdown_counter = 0;
++static unsigned long bytes_served;
++static pid_t mainpid;
++
++static int systemd_pre_config(apr_pool_t *pconf, apr_pool_t *plog,
++                              apr_pool_t *ptemp)
++{
++    sd_notify(0,
++              "RELOADING=1\n"
++              "STATUS=Reading configuration...\n");
++    ap_extended_status = 1;
++    return OK;
++}
++
++static int systemd_pre_mpm(apr_pool_t *p, ap_scoreboard_e sb_type)
++{
++    int rv;
++
++    mainpid = getpid();
++
++    rv = sd_notifyf(0, "READY=1\n"
++                    "STATUS=Processing requests...\n"
++                    "MAINPID=%" APR_PID_T_FMT, mainpid);
++    if (rv < 0) {
++        ap_log_perror(APLOG_MARK, APLOG_ERR, 0, p, APLOGNO(02395)
++                     "sd_notifyf returned an error %d", rv);
++    }
++
++    return OK;
++}
++
++static int systemd_monitor(apr_pool_t *p, server_rec *s)
++{
++    ap_sload_t sload;
++    apr_interval_time_t up_time;
++    char bps[5];
++    int rv;
++
++    if (!ap_extended_status) {
++        /* Nothing useful to report if ExtendedStatus disabled. */
++        return DECLINED;
++    }
++    
++    ap_get_sload(&sload);
++    /* up_time in seconds */
++    up_time = (apr_uint32_t) apr_time_sec(apr_time_now() -
++                               ap_scoreboard_image->global->restart_time);
++
++    apr_strfsize((unsigned long)((float) (sload.bytes_served)
++                                 / (float) up_time), bps);
++
++    rv = sd_notifyf(0, "READY=1\n"
++                    "STATUS=Total requests: %lu; Idle/Busy workers %d/%d;"
++                    "Requests/sec: %.3g; Bytes served/sec: %sB/sec\n",
++                    sload.access_count, sload.idle, sload.busy,
++                    ((float) sload.access_count) / (float) up_time, bps);
++
++    if (rv < 0) {
++        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02396)
++                     "sd_notifyf returned an error %d", rv);
++    }
++
++    /* Shutdown httpd when nothing is sent for shutdown_timer seconds. */
++    if (sload.bytes_served == bytes_served) {
++        /* mpm_common.c: INTERVAL_OF_WRITABLE_PROBES is 10 */
++        shutdown_counter += 10;
++        if (shutdown_timer > 0 && shutdown_counter >= shutdown_timer) {
++            rv = sd_notifyf(0, "READY=1\n"
++                            "STATUS=Stopped as result of IdleShutdown "
++                            "timeout.");
++            if (rv < 0) {
++                ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, APLOGNO(02804)
++                            "sd_notifyf returned an error %d", rv);
++            }
++            kill(mainpid, AP_SIG_GRACEFUL);
++        }
++    }
++    else {
++        shutdown_counter = 0;
++    }
++
++    bytes_served = sload.bytes_served;
++
++    return DECLINED;
++}
++
++static void systemd_register_hooks(apr_pool_t *p)
++{
++    /* Enable ap_extended_status. */
++    ap_hook_pre_config(systemd_pre_config, NULL, NULL, APR_HOOK_LAST);
++    /* We know the PID in this hook ... */
++    ap_hook_pre_mpm(systemd_pre_mpm, NULL, NULL, APR_HOOK_LAST);
++    /* Used to update httpd's status line using sd_notifyf */
++    ap_hook_monitor(systemd_monitor, NULL, NULL, APR_HOOK_MIDDLE);
++}
++
++static const char *set_shutdown_timer(cmd_parms *cmd, void *dummy,
++                                      const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    shutdown_timer = atoi(arg);
++    return NULL;
++}
++
++static const command_rec systemd_cmds[] =
++{
++AP_INIT_TAKE1("IdleShutdown", set_shutdown_timer, NULL, RSRC_CONF,
++     "Number of seconds in idle-state after which httpd is shutdown"),
++    {NULL}
++};
++
++AP_DECLARE_MODULE(systemd) = {
++    STANDARD20_MODULE_STUFF,
++    NULL,
++    NULL,
++    NULL,
++    NULL,
++    systemd_cmds,
++    systemd_register_hooks,
++};

httpd-2.4.3-apctl-systemd.patch Changed

@@ -1,11 +1,13 @@
 
+Make apachectl run via systemctl.
+
+Note: "apachectl graceful" is documented to start httpd if not running.
+
 Upstream-Status: vendor specific patch
 
-diff --git a/support/apachectl.in b/support/apachectl.in
-index c6ac3ea..2599386 100644
---- a/support/apachectl.in
-+++ b/support/apachectl.in
-@@ -100,9 +100,24 @@ fi
+--- httpd-2.4.18/support/apachectl.in.apctlsystemd
++++ httpd-2.4.18/support/apachectl.in
+@@ -100,9 +100,28 @@ fi
  ERROR=$?
  }
  
@@ -24,7 +26,11 @@
 +    ERROR=$?
 +    ;;
 +graceful)
-+    /usr/bin/systemctl reload httpd.service
++    if /usr/bin/systemctl -q is-active httpd.service; then
++        /usr/bin/systemctl reload httpd.service
++    else
++        /usr/bin/systemctl start httpd.service
++    fi
 +    ERROR=$?
 +    ;;
 +graceful-stop)
@@ -32,7 +38,7 @@
      ERROR=$?
      ;;
  startssl|sslstart|start-SSL)
-@@ -114,10 +129,6 @@ startssl|sslstart|start-SSL)
+@@ -114,10 +133,6 @@ startssl|sslstart|start-SSL)
  configtest)
      testconfig
      ;;

00-base.conf Changed

00-mpm.conf Changed

00-optional.conf Changed

00-proxy.conf Changed

httpd-2.4.18.tar.bz2 Added

httpd-2.4.27-8.fc28.src.rpm Added

httpd.service Changed

@@ -1,22 +1,20 @@
-# It's not recommended to modify this file in-place, because it will be
-# overwritten during package upgrades.  If you want to customize, the best
-# way is to create a file "/etc/systemd/system/httpd.service",
-# containing
-#   .include /lib/systemd/system/httpd.service
-#   ...make your changes here...
-# For more info about custom unit files, see
-# http://fedoraproject.org/wiki/Systemd#How_do_I_customize_a_unit_file.2F_add_a_custom_unit_file.3F
+# See httpd.service(8) for more information on using the httpd service.
+
+# Modifying this file in-place is not recommended, because changes
+# will be overwritten during package upgrades.  To customize the
+# behaviour, run "systemctl edit httpd" to create an override unit.
+
+# For example, to pass additional options (such as -D definitions) to
+# the httpd binary at startup, create an override unit (as is done by
+# systemctl edit) and enter the following:
 
-# For example, to pass additional options (for instance, -D definitions) to the
-# httpd binary at startup, you need to create a file named
-# "/etc/systemd/system/httpd.service" containing:
-#	.include /lib/systemd/system/httpd.service
 #	[Service]
 #	Environment=OPTIONS=-DMY_DEFINE
 
 [Unit]
 Description=The Apache HTTP Server
 After=network.target remote-fs.target nss-lookup.target
+Documentation=man:httpd.service(8)
 
 [Service]
 Type=notify
@@ -24,13 +22,9 @@
 
 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND
 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful
-ExecStop=/bin/kill -WINCH ${MAINPID}
-# We want systemd to give httpd some time to finish gracefully, but still want
-# it to kill httpd after TimeoutStopSec if something went wrong during the
-# graceful stop. Normally, Systemd sends SIGTERM signal right after the
-# ExecStop, which would kill httpd. We are sending useless SIGCONT here to give
-# httpd time to finish.
-KillSignal=SIGCONT
+# Send SIGWINCH for graceful stop
+KillSignal=SIGWINCH
+KillMode=mixed
 PrivateTmp=true
 
 [Install]

httpd.service.xml Added

@@ -0,0 +1,214 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+  "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+
+]>
+
+
+<refentry>
+  <refentryinfo>
+    <title>httpd systemd units</title>
+    <productname>httpd</productname>
+    <author><contrib>Author</contrib><surname>Orton</surname><firstname>Joe</firstname><email>jorton@redhat.com</email></author>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>httpd.service</refentrytitle>
+    <manvolnum>8</manvolnum>
+  </refmeta>
+  
+  <refnamediv>
+    <refname>httpd.service</refname>
+    <refname>httpd.socket</refname>
+    <refpurpose>httpd unit files for systemd</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <para>
+      <filename>/usr/lib/systemd/system/httpd.service</filename>, 
+      <filename>/usr/lib/systemd/system/httpd.socket</filename>
+    </para>
+  </refsynopsisdiv>
+  
+  <refsect1>
+    <title>Description</title>
+
+    <para>This manual page describes the <command>systemd</command>
+    unit files used to integrate the <command>httpd</command> daemon
+    with <command>systemd</command>. Two unit files are available:
+    <command>httpd.service</command> allows the
+    <command>httpd</command> daemon to be run as a system service, and
+    <command>httpd.socket</command> allows httpd to be started via
+    socket-based activation. Most systems will use
+    <command>httpd.service</command>.</para>
+
+    <para>The <command>apachectl</command> command has been modified
+    to invoke <command>systemctl</command> for most uses, so for
+    example, running <command>apachectl start</command> is equivalent
+    to running <command>systemctl start httpd.service</command>.  This
+    ensures that the running httpd daemon is tracked and managed by
+    <command>systemd</command>.  In contrast, running
+    <command>httpd</command> directly from a root shell will start the
+    service outside of <command>systemd</command>; in this case,
+    default security restrictions described below (including, but not
+    limited to, SELinux) will not be enforced.</para>
+
+    <refsect2>
+      <title>Changing default behaviour</title>
+
+      <para>To change the default behaviour of the httpd service, an
+      <emphasis>over-ride</emphasis> file should be created, rather
+      than changing
+      <filename>/usr/lib/systemd/system/httpd.service</filename>
+      directly, since such changes would be lost over package
+      upgrades. Running <command>systemctl edit
+      httpd.service</command> or <command>systemctl edit
+      httpd.socket</command> as root will create a drop-in file in
+      <filename>/etc/systemd/system/httpd.service.d</filename> which
+      over-rides the system defaults.</para>
+
+      <para>For example, to set the <option>LD_LIBRARY_PATH</option>
+      environment variable for the daemon, run <command>systemctl edit
+      httpd.service</command> and enter:
+
+      <programlisting>[Service]
+Environment=LD_LIBRARY_PATH=/opt/vendor/lib</programlisting></para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Starting the service at boot time</title>
+
+      <para>The httpd.service and httpd.socket units are
+      <emphasis>disabled</emphasis> by default. To start the httpd
+      service at boot time, run: <command>systemctl enable
+      httpd.service</command>. In the default configuration, the
+      httpd daemon will accept connections on port 80 (and, if mod_ssl
+      is installed, TLS connections on port 443) for any configured
+      IPv4 or IPv6 address.</para>
+
+      <para>If httpd is configured to depend on any specific IP
+      address (for example, with a "Listen" directive) which may only
+      become available during startup, or if httpd depends on other
+      services (such as a database daemon), the service
+      <emphasis>must</emphasis> be configured to ensure correct
+      startup ordering.</para>
+
+      <para>For example, to ensure httpd is only running after all
+      configured network interfaces are configured, create a drop-in
+      file (as described above) with the following section:
+
+      <programlisting>[Unit]
+After=network-online.target
+Wants=network-online.target</programlisting>
+
+      See <ulink
+      url="https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/"/>
+      for more information on startup ordering with systemd.</para>
+
+    </refsect2>
+
+    <refsect2>
+      <title>Reloading and stopping the service</title>
+
+      <para>When running <command>systemctl reload
+      httpd.service</command>, a <emphasis>graceful</emphasis>
+      restart is used, which sends a signal to the httpd parent
+      process to reload the configuration and re-open log files. Any
+      children with open connections at the time of reload will
+      terminate only once they have completed serving requests. This
+      prevents users of the server seeing errors (or potentially
+      losing data) due to the reload, but means some there is some
+      delay before any configuration changes take effect for all
+      users.</para>
+
+      <para>Similarly, a <emphasis>graceful stop</emphasis> is used
+      when <command>systemctl stop httpd.service</command> is run,
+      which terminates the server only once active connections have
+      been processed.</para>
+
+      <para>To "ungracefully" stop the server without waiting for
+      requests to complete, use <command>systemctl kill
+      --kill-who=main httpd</command>; similarly to "ungracefully"
+      reload the configuration, use <command>systemctl kill
+      --kill-who=main --signal=HUP httpd</command>.</para>
+    </refsect2>
+
+    <refsect2>
+      <title>systemd integration and mod_systemd</title>
+
+      <para>The httpd service uses the <option>notify</option> systemd
+      service type. The <literal>mod_systemd</literal> module must be
+      loaded (as in the default configuration) for this to work
+      correctly - the service will fail if this module is not
+      loaded. <literal>mod_systemd</literal> also makes worker and
+      request statistics available when running <command>systemctl status
+      httpd</command>. See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information on systemd service types.</para>
+    </refsect2>
+    
+    <refsect2>
+      <title>Security and SELinux</title>
+
+      <para>The default SELinux policy restricts the httpd service in
+      various ways. For example, the default policy limits the ports
+      to which httpd can bind (using the <literal>Listen</literal>
+      directive), which parts of the filesystem can be accessed, and
+      whether outgoing TCP connections are possible. Many of these
+      restrictions can be adjusted using <command>semanage</command>
+      to change booleans or other types. See
+      <citerefentry><refentrytitle>httpd_selinux</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+      for more information.</para>
+
+      <para>The httpd service enables <emphasis>PrivateTmp</emphasis>
+      by default. The <filename>/tmp</filename> and
+      <filename>/var/tmp</filename> directories available within the
+      httpd process (and CGI scripts, etc) are not shared by other
+      processes. See
+      <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry>
+      for more information.</para>
+
+    </refsect2>
+
+  </refsect1>
+
+  <refsect1>
+    <title>Files</title>
+
+    <para><filename>/usr/lib/systemd/system/httpd.service</filename>,
+    <filename>/usr/lib/systemd/system/httpd.socket</filename>,
+    <filename>/etc/systemd/systemd/httpd.service.d</filename></para>
+  </refsect1>
+

httpd.socket Changed

index.html Changed

@@ -1,6 +1,6 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
 
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 	<head>
 		<title>Test Page for the Apache HTTP Server on Fedora</title>
 		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
@@ -103,25 +103,27 @@
 
 					<p>For example, if you experienced problems while visiting www.example.com, you should send e-mail to "webmaster@example.com".</p>
 
-					<p>Fedora is a distribution of Linux, a popular computer operating system. It is commonly used by hosting companies because it is free, and includes free web server software. Many times, they do not set up their web server correctly, and it displays this "test page" instead of the expected website. 
+					<p>Fedora is a distribution of Linux, a popular computer operating system. It is commonly used by hosting companies because it is free, and includes free web server software. Many times, they do not set up their web server correctly, and it displays this "test page" instead of the expected website.</p>
 
-					<p>Accordingly, please keep these facts in mind:
+					<p>Accordingly, please keep these facts in mind:</p>
+					<ul>
 					<li>Neither the Fedora Project or Red Hat has any affiliation with any website or content hosted from this server (unless otherwise explicitly stated).</li>
 					<li>Neither the Fedora Project or Red Hat has "hacked" this webserver, this test page is an included component of Apache's httpd webserver software.</li>
+					</ul>
 
-					<p>For more information about Fedora, please visit the <a href="http://fedoraproject.org/">Fedora Project website</a>.</p>
+					<p>For more information about Fedora, please visit the <a href="https://getfedora.org/">Fedora Project website</a>.</p>
 					<hr />
 				</div>
 
 				<div class="content-column-right">
 					<h2>If you are the website administrator:</h2>
 
-					<p>You may now add content to the directory <tt>/var/www/html/</tt>. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file <tt>/etc/httpd/conf.d/welcome.conf</tt>.</p>
+					<p>You may now add content to the directory <code>/var/www/html/</code>. Note that until you do so, people visiting your website will see this page, and not your content. To prevent this page from ever being used, follow the instructions in the file <code>/etc/httpd/conf.d/welcome.conf</code>.</p>
 
 					<div class="logos">
 						<p>You are free to use the images below on Apache and Fedora powered HTTP servers. Thanks for using Apache and Fedora!</p>
 
-						<p><a href="http://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="http://fedoraproject.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
+						<p><a href="https://httpd.apache.org/"><img src="/icons/apache_pb2.gif" alt="[ Powered by Apache ]"/></a> <a href="https://getfedora.org/"><img src="/icons/poweredby.png" alt="[ Powered by Fedora ]" width="88" height="31" /></a></p>
 					</div>
 				</div>
 			</div>

manual.conf Changed

mirrors Added

pullrev.sh Changed

sources Added

ssl.conf Changed

@@ -1,6 +1,6 @@
 #
 # When we also provide SSL we have to listen to the 
-# the HTTPS port in addition.
+# standard HTTPS port in addition.
 #
 Listen 443 https
 
@@ -69,46 +69,36 @@
 #   Enable/Disable SSL for this virtual host.
 SSLEngine on
 
-#   SSL Protocol support:
-# List the enable protocol levels with which clients will be able to
-# connect.  Disable SSLv2 access by default:
-SSLProtocol all -SSLv2
+#   List the protocol versions which clients are allowed to connect with.
+#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
+#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
+#   protocol or later should remain in use.
+SSLProtocol all -SSLv3
+SSLProxyProtocol all -SSLv3
+
+#   User agents such as web browsers are not configured for the user's
+#   own preference of either security or performance, therefore this
+#   must be the prerogative of the web server administrator who manages
+#   cpu load versus confidentiality, so enforce the server's cipher order.
+SSLHonorCipherOrder on
 
 #   SSL Cipher Suite:
 # List the ciphers that the client is permitted to negotiate.
 # See the mod_ssl documentation for a complete list.
 # The OpenSSL system profile is configured by default.  See
 # update-crypto-policies(8) for more details.
-SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
-        EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 \
-        EECDH EDH+aRSA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"
-
-#SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 \
-#        EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 \
-#        EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS"
-#
-#SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
-#
-#SSLCipherSuite PROFILE=DEFAULT
-
-#   Speed-optimized SSL Cipher configuration:
-#   If speed is your main concern (on busy HTTPS servers e.g.),
-#   you might want to force clients to specific, performance
-#   optimized ciphers. In this case, prepend those ciphers
-#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
-#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
-#   (as in the example below), most connections will no longer
-#   have perfect forward secrecy - if the server's key is
-#   compromised, captures of past or future traffic must be
-#   considered compromised, too.
-#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
-#SSLHonorCipherOrder on 
-
-#   Server Certificate:
-# Point SSLCertificateFile at a PEM encoded certificate.  If
-# the certificate is encrypted, then you will be prompted for a
-# pass phrase.  Note that a kill -HUP will prompt again.  A new
-# certificate can be generated using the genkey(1) command.
+SSLCipherSuite PROFILE=SYSTEM
+SSLProxyCipherSuite PROFILE=SYSTEM
+
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that restarting httpd will prompt again.  Keep
+#   in mind that if you have both an RSA and a DSA certificate you
+#   can configure both in parallel (to also allow the use of DSA
+#   ciphers, etc.)
+#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
+#   require an ECC certificate which can also be configured in
+#   parallel.
 SSLCertificateFile /etc/pki/tls/certs/localhost.crt
 
 #   Server Private Key:
@@ -116,6 +106,7 @@
 #   directive to point at the key file.  Keep in mind that if
 #   you've both a RSA and a DSA private key you can configure
 #   both in parallel (to also allow the use of DSA ciphers, etc.)
+#   ECC keys, when in use, can also be configured in parallel
 SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
 
 #   Server Certificate Chain:
@@ -124,7 +115,7 @@
 #   certificate chain for the server certificate. Alternatively
 #   the referenced file can be the same as SSLCertificateFile
 #   when the CA certificates are directly appended to the server
-#   certificate for convinience.
+#   certificate for convenience.
 #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
 
 #   Certificate Authority (CA):
@@ -184,9 +175,9 @@
 #     This enables optimized SSL connection renegotiation handling when SSL
 #     directives are used in per-directory context. 
 #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
-<Files ~ "\.(cgi|shtml|phtml|php3?)$">
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
     SSLOptions +StdEnvVars
-</Files>
+</FilesMatch>
 <Directory "/var/www/cgi-bin">
     SSLOptions +StdEnvVars
 </Directory>
@@ -198,13 +189,13 @@
 #   approach you can use one of the following variables:
 #   o ssl-unclean-shutdown:
 #     This forces an unclean shutdown when the connection is closed, i.e. no
-#     SSL close notify alert is send or allowed to received.  This violates
+#     SSL close notify alert is sent or allowed to be received.  This violates
 #     the SSL/TLS standard but is needed for some brain-dead browsers. Use
 #     this when you receive I/O errors because of the standard approach where
 #     mod_ssl sends the close notify alert.
 #   o ssl-accurate-shutdown:
 #     This forces an accurate shutdown when the connection is closed, i.e. a
-#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     SSL close notify alert is sent and mod_ssl waits for the close notify
 #     alert of the client. This is 100% SSL/TLS standard compliant, but in
 #     practice often causes hanging connections with brain-dead browsers. Use
 #     this only for browsers where you know that their SSL implementation
@@ -225,5 +216,5 @@
 CustomLog logs/ssl_request_log \
           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
 
-</VirtualHost>                                  
+</VirtualHost>

upstream Added

upstream-key.gpg Added

@@ -0,0 +1,4981 @@
+This file contains the PGP keys of various developers that work on
+the Apache HTTP Server and its subprojects.
+
+Please don't use these keys for email unless you have asked the owner
+because some keys are only used for code signing.
+
+Please realize that this file itself or the public key servers may be
+compromised.  You are encouraged to validate the authenticity of these keys in
+an out-of-band manner.  For information about our validation and signing
+policies, please read http://httpd.apache.org/dev/verification.html.
+
+Apache users: pgp < KEYS
+Apache developers: 
+        (pgpk -ll <your name> && pgpk -xa <your name>) >> this file.
+      or
+        (gpg --fingerprint --list-sigs <your name>
+             && gpg --armor --export <your name>) >> this file.
+
+Apache developers: please ensure that your key is also available via the
+PGP keyservers (such as pgpkeys.mit.edu).
+
+Type Bits/KeyID    Date       User ID
+pub  1024/2719AF35 1995/05/13 Ben Laurie <ben@algroup.co.uk>
+                              Ben Laurie <ben@gonzo.ben.algroup.co.uk>
+
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: 2.6.3ia
+
+mQCNAi+0jQEAAAEEAK7oX0FeNncaHfa1v+V7SMUviAm8qB8orWG0zvja4ZtSrHVg
+/PMwppUh44t5ERA9lltRBdHu30+YSh8a1dYt1XOD83nknzj9rhtpFAPqyywlLVhN
+VY3PVLyMbULw27aEAGc+StFqrDoUQ0+j9QU/YH/IyVN9rBaJyhsIDEUnGa81AAUR
+tB5CZW4gTGF1cmllIDxiZW5AYWxncm91cC5jby51az6JARUDBRAyb2Doc3AsNzyk
+Yh0BARa6CACUBnsP9Vb+T/PvNYKVQBIODz+90tz5GozWwCVfPVSaRd8Dz+oF1sFs
+YCz/KuxqBhL5PkiCuSMfOVlPA5nirjoktMF/af5saZqhPr5rvr67Z1OzZnVDvWe4
+DhFrn8EoLrY5YNJhUwfINnZqyKaQu8TW6p4caLkTCW0KM+4ztTe74xRG9NeE+K0+
+0RMpAF3jEY36LGRjq6miazt2bVZQDTl6CuWE+gAaFlX2ojV7e1xdxVvpBIEc34MP
+g9ORJ0evx1QilMt1VyGcS/pe4IQgjdJqjU/4fzqFZkT2nntQMbV9kQyNe2+qfqP7
+giTryIanmBAfd3oOCTsRz2VKPfdhCqCRiQB1AwUQMRdzEEyr2GZv4ALJAQEuhAL6
+A8I84BR+87uNAHD0ZJkTM73WdyMEGvAKBvrZK/g0VLYj0NtgkSuRJfrXnGkuh27I
+ZrjfL952Q/mXgMtHhJHJ9YfenGFWSEDHnolNzKOzTQJpE01IZ3nWv7ezA9N1LZVC
+iQCVAgUQMROrdRsIDEUnGa81AQEUNgQAlvyjt534RDQd2AYGoZriaFzjaL7dTCRH
+4b1zxuWBNWf3pI4W0iwU02Q5rEWEmY5DLl6/ie+vcQKOWSqXVgnM/s6EARdKEN56
+d6PzkwszgfEybDYrcAxReJcTCcV8ItJer/iqpBLgtaxyUpI77NvKcDGHp6BgYpnv
+1lNkH0FISK+JAJUDBRAwtzlWdGx7qH+PTVkBARFWA/99NTCMihlOZS7LmHDVic/q
+H1K1DVdMcv0iL39+7Pq4+AA/ET8dWIgcjaIreSqAZTpjwU1pMPaWgecDD1rEMCYX
+R+JoofLJ24BLcSlpXJ/gWMifYNxqdDeMRkw/aW/kaXQJWIz+oDYNuOyi5VvB6faF
+6Lm7P5cw1mX0I5rYc3woh7QoQmVuIExhdXJpZSA8YmVuQGdvbnpvLmJlbi5hbGdy
+b3VwLmNvLnVrPokAlQIFEDEXgCUbCAxFJxmvNQEBiL8D/3MLjfHGvuByqP1VFQrF
+QeMNd2aIQuC7ys3lkDvrLkkPJQANua0/MdDaZk6F5pCGcTmmmaJOjcOcCheD7FU5
+w9zxkQGR3Swr3opFHSr/CkEl83jRy3oq1MFydWoGajQjIr/c23X8zr+XntPyO6VX
+q5He4RrTiXeAEFBzz+J+R+EQ
+=zh1u
+-----END PGP PUBLIC KEY BLOCK-----
+
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec+ 1024 0xA99F75DD 1997-01-24 ---------- RSA             Sign & Encrypt 
+f16    Fingerprint16 = F7 E5 6D 20 58 AA B0 65  ED 0D B1 66 03 BA 9C C6
+uid  Rodent of Unusual Size <Ken.Coar@Golux.Com>
+uid  Rodent of Unusual Size <coar@Apache.Org>
+uid  Rodent of Unusual Size <Coar@Raleigh.IBM.Com>
+uid  Rodent of Unusual Size <Ken.Coar@MeepZor.Com>
+uid  Rodent of Unusual Size <Ken@Coar.Org>
+uid  Ken A L Coar <Coar@DECUS.Org>
+uid  Rodent of Unusual Size <Coar@DECUS.Org>
+uid  Rodent of Unusual Size <coar@ACM.Org>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQCNAzLpIyUAAAEEAN9KC8CxTeozPYJjsnhFpJ14d4Hhf2M6OTgqPQFRHOswM/3j
+B7IW0s+HwVyQ5/SjIlo+8ur9X7yaj1FS2GQmKD1x9LKeHRAoosBIs33okRtoeDRy
+ufTaTyQTwLklxClWm3JEef4xZioun1mtWbpz0yVEOCSZcRvtnJrNPMCpn3XdAAUR
+tCtSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxLZW4uQ29hckBHb2x1eC5Db20+iQCV
+AwUQNiiZ2JrNPMCpn3XdAQGlgwP+JLlZvNV/fJ2azKIwjibDa4n2LUDxa7ofKboU
+QL+D7FD24zQcmzmkBQm/BL/FSUtxZasJkvdVbU98N3G4h3C4AyErfQOFcrepyGAB
+M88onQ1DbQ6tiUA3gw9gIB+2l1C5R8wBOtlwoRJM4GFvjjtRp+KaQqvN3f+lLMMt
+hKYB70mJAJUDBRAz3QWlms08wKmfdd0BAQMfBAC1c+9gr7ELthxwzYGTB7LiBk+p
+UABsPG/hT9z/cTGN8YQbK6VXV74sPAaeyD/t56xFUI9CRktZCinXp2cxvbNTe3Q0
+MLtD/PlCSRsgwsEIoM+1An1S3qOXWiGBXoXl/DgRzz9GVnB04m5/SP9XLE4Tmz+1
+X/Gu4TJnRjZZxN4xoYkAPwMFEDb44af9b4jGIdCnGxECiFUAnR3RORpXVyclwFEl
+euOwoynPQbY6AJ9H5rwHnz4gkE+AVp95++HmyeDkYIkAlQMFEDb45Ogxpj2W7BQL
+gQEBaS4D/R+EzfuRPiX5LgV7C70xtplIgS1iK+h0ddkPAr3P3zPxY0AEOjM81hiz
+Ol2Kf0TUMhhcLqO0UjNK9EyIHpO+Bf7pQoV050XYvcIwzNyVez5VCbDM7JA+vVeG
+/Pb+O/tPyEs7peSpdJAP4Kbg4Eu4b6+1QTLKrBCTWkEuNHABOuzDiQCVAwUQNzs2
+CairDeBjG1dJAQGb7AQAzHChrwaosl01sLcmlItrsqmzSFL5hbLor9Wh8UjVeYxX
+FMVgTQGs/AwN1B0W8PApOsz8mg0pSJm8VPHv+pc4Z9eNhUokfUsRJ4LHjREpr3Gh
++5LoZ53nk1f62VQSOCxOOJ50cAH2rqv/ym9EVCaZ7evfHIR7/KH5+sVpcs14c/2J
+AEYEEBECAAYFAjhv6QUACgkQF1lVzkO+5qgYaACfaA4rC0EaP5yxR0wEYiGmgy6O
+ZhMAoNt4cGFIMI3x2VI9hyi/ZoUiu0zOiQA/AwUQOtYm5d26ZLosMS0vEQK8VgCf
+Tw+RZ/xUlB/5YfyrK9fb/VKGm0wAoK3bRHDa/MMxxFtO2c0SqOKxbTKGiQBGBBAR
+AgAGBQI7FOmzAAoJEJcWsik7qjrgJlwAnjRjnKXy4jj1pAFnFFUebJ/+Ur8kAJ4+
+DTV/SegKBL3jSua5ISqm+LBOjokARgQQEQIABgUCO4p7LQAKCRC/S9DmBJ24edNS
+AKD4ddoiLbPhQkQtGHjy9BlwUSdg3ACg+1fpy3UjWHzCWqWYSh33aneZuXa0KFJv
+ZGVudCBvZiBVbnVzdWFsIFNpemUgPGNvYXJAQXBhY2hlLk9yZz6JAJUDBRA2KJmI
+ms08wKmfdd0BAT3yBADEDHAn++77n7bLA/u9QYM2LBQHnXdw5Is8YGHpHcNZVDA8
+CtRTOdub8rhe9qgsid/jEry0hT9Sygfx/ry5ntjmF12ltnxBDPdZuU2DaHaIh/zB
+UAv0hyaQeAXEYiV9J75GrDkTj5Jrrnd623uyIRoMZPKYb+oqsZ4HjIe/w+CDfokA
+PwMFEDb44bT9b4jGIdCnGxECzDAAoNR8md7KvzarecOh/6NpTb5r8JXJAJ0aJtTz
+soNXpLaVwSMiGdm5ts2qOYkAlQMFEDb45PYxpj2W7BQLgQEBxKID/11Dft+UeLdd
+kIDFjaJGrIOfQ11y+QlJWaQ2Him/qNzNP8w8ZJ/meAb4PMSeQOI3PVKulf8vMp3Z
+0Jh2irfn1ycqsui4kDe6azvd5PultRKTRljtwVIDuqsrVMVq/zNAC2bN6CUnkkdZ
+2O7a5qIkDDYnyRzAEwKhJxleWrXYHiIhiQCVAwUQNzs2GqirDeBjG1dJAQHcYgP/
+eRCEQW5DJ6JQol5HQ26UnjBfQGdXsRvpT6gFNCDy/Nv+b886WC9j99T3IU+AztXf
+OPfPh7oU/2yC0VOmSaZS9SQ/PuuFdNhMggR8Q7goWothdBsMOUyO3iYrQCRnV3mL
+NsOT+/gpSt9diLujs7SpiQeHZmQaNMQUrJPBp7tTbsaJAD8DBRA61ibv3bpkuiwx
+LS8RAvHXAJ95ifArYzouYPB3clib/568TqHeVQCgxgEb1xJ4AgjZibMl34g+19wb
+G3CJAEYEEBECAAYFAjsU6ocACgkQlxayKTuqOuCaDwCfTHOoCNtoYenYgqa2LgUC
+62mEqFUAn25xLhvjjODMpWry5uAA2NR1k00KtC1Sb2RlbnQgb2YgVW51c3VhbCBT
+aXplIDxDb2FyQFJhbGVpZ2guSUJNLkNvbT6JAJUDBRA2KKJpms08wKmfdd0BAWcz
+A/9xfbUofCDogPs2gbMQrGx9kT90SBEYcWnlPq/Ocj1871ZlnYeYhJaMSOuLnMAC
+Ze9AbadYRgVVwXWhamH+d0uAvCw98ixmI9emPUsPuiifk8Re8mWQV+kcOqIbjE45
+FtsZYFy/WyqTHp2OSl/JcugwPfrlhrMW4q6selY/ABBEkokAPwMFEDb44b/9b4jG
+IdCnGxECNOMAn3K6caoKqMtKGrqRwoFaCPjBgOi5AKCc1dP5HAtyFloQGxS2fAwJ
+p9Dp8okAlQMFEDb45QAxpj2W7BQLgQEBX1gD/1O/9VxXp2a8yrlV2qJ6xJ9U3fCL
+/OVUTrgDgzw/219jeXgiG0CAM0ApZ7NSqk95aRSKZqWoJvTY5K+P4RuGoMJ1JYjQ
+i2fXiCSHo4fDF2RPTXxqCorQq6M8csJqpQykiUQRd6HfKSURk1WRfvGqi2iwiCQG
+ipqd0kmzyQ2WSEjviQA/AwUQOtYm9926ZLosMS0vEQKW5wCgiIdzdam+8MnCpvrp
+5ooDS+XqJi0AoL6kVPnu/uDN4WVIIaO3rOYeW+SViQBGBBARAgAGBQI7FOqHAAoJ
+EJcWsik7qjrg+S4An1wT/kE/gbX3qmG3oEGY78r56mM0AJwOEJ5QA1bl/wDeHeyH
+tHd2qw/lVbQtUm9kZW50IG9mIFVudXN1YWwgU2l6ZSA8S2VuLkNvYXJATWVlcFpv
+ci5Db20+iQCVAwUQN7GHT5rNPMCpn3XdAQHIuQP9G3RaObWL3iI2xoIWs3s6L0LF
+noFv/RrK0NHEDy0YEm9LqeVp86F9QvOA+kh3ySfVPtxbwsMAswAkqbvWNi7U2Xz0
+V9KJmnEnJFLmjHoTBNpahTGFTnOxcH4X+57mAAzbCWyXFvGsT2b8orset0QVqDhV
+hwOLGKLlXWzDiQdrY1+JAD8DBRA61icB3bpkuiwxLS8RAkGnAJ9m1mvfaHA5Z3FU
+JyzUpuS7xd4NcQCg5XMoJgXHC1Gngqn6jAh+Dn3TDVqJAEYEEBECAAYFAjsU6ocA
+CgkQlxayKTuqOuCHpACfU7nZUI2Pj5dS46VZpVygxMl6dAEAnA751ZlwgIYWnZyh
+uqKcJzbwdV2fiQA/AwUQOt88Av1viMYh0KcbEQKqwgCgyDsKH89EE1W7/b8cfns3
+OrI+3DUAoNBYnQdsW6Uk45iQWyODnV3jUIgQtCVSb2RlbnQgb2YgVW51c3VhbCBT
+aXplIDxLZW5AQ29hci5Pcmc+iQCVAwUQN7Gd35rNPMCpn3XdAQHcoQQArrWwFNeS
+A5Yu1nEXevfStfkSUQqzA6qsREPgrczIOgsCfDR/RA/1P7GcxiOvY5mtckuvgkP0
+A9atWkCFX4A0UzerKAKaSirUd/V6Dm8w3hOR/e66I/rbQifZoV/KqvofRsxESV4U
++uXoBsleePwhpmDarpx1BlMJrjwhDDmGaVaJAD8DBRA61icL3bpkuiwxLS8RAn9y
+AJ0YXmF4g4/6GVCilTjxhZWL6acAvgCgwfYFTgB7gdCg9+3LL2jsc6bC4OCJAEYE
+EBECAAYFAjsU6ocACgkQlxayKTuqOuDA9gCeLlDfQW6ryZS8S00/LKsdvdVF0R4A
+nipUMGGyTIHYvgX+SI8vfZu3lUwwiQA/AwUQOt88D/1viMYh0KcbEQI9bgCg7T2u
+7Hzf/HG7s+m5So67+ixdngYAnjTlgTJNKSRLspsZVVumNM9YgxdjtB1LZW4gQSBM
+IENvYXIgPENvYXJAREVDVVMuT3JnPokAlQMFEDNNn5SazTzAqZ913QEByxcD/RkT
+z31D9IdedFAd8dseUv7TZkSSnZNctg5fZSlxL8kOWQKzclLFmEmnxRkTsIm/jtLF
+g2B8rEtKCfvbnOIvUFVIJLYtLPgBEWPFRrDpBx0eaLdWmogD534En/gsc5Yh1XTB
+G4Vveq39iZPcuP1Zc/fhmsNTvdgsdpbLyDquYH+riQA/AwUQNNhoI1F+HqlP3KvB
+EQJbxQCgxoQqL3hPPRxUhG3jFPIfiMGokUgAoPXYHWM63hFwomWAkaN6qSAHPKe/
+iQA/AwUQM9vDdGfM5V5WR8xwEQL2iQCdFQX3I1x2K94zlI740/VKtpv+2g8An3Wk
+FnyJR/3SJA88j/cujVv7kLX0iQBGBBARAgAGBQI2treyAAoJEBPfD2hdwuxYIq4A
+oKI1iXIAvt6KWLnde4nH4fJYvT58AJ99QNGbxthzYLnyFL3M/6jmQIk4b4kARgQQ
+EQIABgUCNu/SaQAKCRBrQHp6H3FQjZO3AKDQQnUS2qMjw3D/Oy6UlMVxZEYPUgCe
+LsZj8ZIUcKkfuhtKycVaIK2wC9mJAEYEEBECAAYFAjhJyKwACgkQURMkRYnG89BU
+PgCfa7gmUGgguVXend9EzB1h1TqQErYAoJai8ymv6wYxUXR8/OjoY9eB3CIJiQA/
+AwUQNvjhlv1viMYh0KcbEQKGGgCdFsmDuwfAnU9UFyxhSoyvdkcOcwYAoLp5e1SL
+6ZmIvITFg++VkDvR/j4UiQCVAwUQNvjkzzGmPZbsFAuBAQFdWgP/bv9a9t3J/xZY
+44wb0holsJFuZWOVYKeF9RFIWd0sJXut7yUeWZ5g760eFSEX0QDHfiq3KOT3XO9l
+hcNnDRBInMbBnawbBneLpzM58ZaRnw10HwsOl49Ekc9nHZBBM47mqy1BlGXMi+Yk
+Kh3W2MsuitHkAYwZuNalrqYhqghwooeJAD4DBRA61icU3bpkuiwxLS8RAuD2AKDr
+q4JAQFljMpudc569P131/RjPrwCYqxVlo0cbfFBihV06y5LHjQEd44kARgQQEQIA
+BgUCOxTqhwAKCRCXFrIpO6o64HEaAJ4wLnOLuRX5U21MFOUzIZOumrItcACdH9DA
+YvOpnnkjPNSNGjaI1oh2w9+0J1JvZGVudCBvZiBVbnVzdWFsIFNpemUgPENvYXJA
+REVDVVMuT3JnPokAPwMFEDb44dT9b4jGIdCnGxECfaUAoLEJ3t6nXT15EskyH+83
+pKZe4zkIAKClLlJ7vTuZ5fcjOsqVURNrs4o/cIkAlQMFEDb45Qoxpj2W7BQLgQEB
+QjQD/3DOozCF5e6JkMXJ5HGVrAxbDpRs4SJCrLFX3GuTeGsVCniOf0WTy6+cXuod
+zu1ZbRVlji9YKO2ufoWvH6AEPEVnHYp25T0dtMya/mwEI010dCrj4oXTaYikz2lu
+WTDPgKcHk+mYNDHREOOcN0/CO6RWTZIhok3Su4zBYL0YTg/RiQA/AwUQOtYnG926
+ZLosMS0vEQJe2gCg+51l8oZ1DQAL5hzKeW3pY5Vg2gkAoMlzmol5cvtxt9wFyrjw
+L39LL0fstCVSb2RlbnQgb2YgVW51c3VhbCBTaXplIDxjb2FyQEFDTS5Pcmc+iQCV
+AwUQOsoapprNPMCpn3XdAQHxkAP7BJ4KshrO4m+T2/l5OepLDQAGWxIg5XK05upw
+mgNPO6enptNjT+Quu78GYOKgVQww3eQoIlxFiEQ7Kccc0gFBhZVoqhrZ7mALrY5l
+HPN5Gy68PlpZ7LJoeYm694LlbwcWa2IAs2K7pfWft/36t3LRBt3NKOyOFVSCGPoi
+U+LiZuuJAD8DBRA61icj3bpkuiwxLS8RAhflAKCyngJ8wc9VaBIA+qaMFxCdGbIw
+egCfbseHoGcorOi0OS6B2ev8hZbJt1aJAEYEEBECAAYFAjsU6ocACgkQlxayKTuq
+OuDvlgCfcKf4eO+Y/ojSavGhITOWjBxgPG8Anja9yfJLediLcTlQwsycsWVMx3wh
+iQA/AwUQOt88GP1viMYh0KcbEQIyoQCeIFtr399fYt4MqRBfvGo59oE3A5sAn0yV
+t89HbY/x/sBXuksvBGxFGhgs
+=GI5x
+-----END PGP PUBLIC KEY BLOCK-----
+
+Type Bits KeyID      Created    Expires    Algorithm       Use
+sec  1024 0x302DA568 2001-02-13 ---------- DSS             Sign & Encrypt 
+f20    Fingerprint20 = DE29 FB39 71E7 1543 FD2D  C049 508E AEC5 302D A568
+sub  1024 0x04E15F28 2001-02-13 ---------- Diffie-Hellman                 
+f20    Fingerprint20 = C41F 1F5C 6485 0100 B21B  EB14 A14E 77B6 04E1 5F28
+uid  Rodent of Unusual Size (DSA) <Ken.Coar@Golux.Com>
+uid  Rodent of Unusual Size (DSA) <coar@Apache.Org>
+uid  Rodent of Unusual Size (DSA) <Coar@Raleigh.IBM.Com>
+uid  Rodent of Unusual Size (DSA) <Ken.Coar@MeepZor.Com>
+uid  Rodent of Unusual Size (DSA) <Ken@Coar.Org>
+uid  Rodent of Unusual Size (DSA) <coar@ACM.Org>
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+Version: PGPfreeware 5.0i for non-commercial use
+
+mQGiBDqJD0sRBADmh5EfoFA8VC/c7+BlG5l4+RBIcYlkvYFZcLbS2fPgkHDndrrp
+5xIeYCFvnnRSVGkQbAfl4Gj62fGcyaI9QIbLAByGeqSoM+DbiEzIyR+QQNpBq+bo
+V1JWaXiuI8d4sdf5ZyTH2nT1EUWVPiBgeXHYtdnjoh7IpG5ETH2miBs7swCgvcJr
+y3Lwa8FfgVtCXFeI5E8wAm0EALOtxh6HwJbTWGAFJFA9RWw2oShLmovYGtdnxcY+
+wHX12oCkanKd26Nr09O+onh/xiQ0mSql3v6SUPnCfyC/qCLeuO2w4vspDlFMbBP0
+I+XFUt16Owldxvmy5fHvhChs7YSZqkVCMx5i+NTvyd51P9aELFG6A/7x3z/tpmyn
+Be8wBAC8l29qjxJSNDsIMMf0cw8STUtNKN9SknKVpQektHb+x+3wreUESPByrgfl
+cTm7y1ulg8rVazynsSVjMCRtmZIfboV2mhsgOu08aZ3bXPpWiHSJ5NR97jdH8s3I
+xuiyQ84PHHVjyLAIh28nAkIvbPRtgt7M581dPpKknHvqz1sW6LQxUm9kZW50IG9m
+IFVudXN1YWwgU2l6ZSAoRFNBKSA8S2VuLkNvYXJAR29sdXguQ29tPokAVgQTEQIA
+FgUCOokPSwQLCgQDAxUDAgMWAgECF4AACgkQUI6uxTAtpWj/KACfccB9nTN1VpGP
+zL2c11ya9ApunAsAn0zhuYOoDZsUCbKooUIg4zH3+nFziQBWBBMRAgAWBQI6iQ9L