Re: [ptxdist] [PATCH] lighttpd: Version bump, 1.4.74 -> 1.4.76

[Michael Olbrich <m.olbrich@pengutronix.de>]

On Tue, Jun 25, 2024 at 05:38:56PM +0200, Andreas Helmcke wrote:
> Hello Alex,
> 
> Am 25.06.24 um 09:32 schrieb Alexander Dahl:
> > Hello Andreas,
> > 
> > Am Mon, Jun 24, 2024 at 06:36:05PM +0200 schrieb Andreas Helmcke:
> >> Important changes
> >> - detect VU#421644 HTTP/2 CONTINUATION Flood
> >> - avoid CVE-2024-3094 xz supply chain attack
> >> - incrementally stronger TLS cipher defaults
> >>
> >> bugfixes
> >>
> >> Link: https://www.lighttpd.net/2024/4/12/1.4.76/
> >> Link: https://www.lighttpd.net/2024/3/13/1.4.75/
> >> Signed-off-by: Andreas Helmcke <ahelmcke@ela-soft.com>
> >> ---
> >>  rules/lighttpd.make | 12 ++++++++++--
> >>  1 file changed, 10 insertions(+), 2 deletions(-)
> >>  mode change 100644 => 100755 rules/lighttpd.make
> >>
> >> diff --git a/rules/lighttpd.make b/rules/lighttpd.make
> >> old mode 100644
> >> new mode 100755
> >> index 96382b86a..fcb543818
> >> --- a/rules/lighttpd.make
> >> +++ b/rules/lighttpd.make
> >> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIGHTTPD) += lighttpd
> >>  #
> >>  # Paths and names
> >>  #
> >> -LIGHTTPD_VERSION	:= 1.4.74
> >> -LIGHTTPD_MD5		:= f38c400232151c69cc608fca35e593a9
> >> +LIGHTTPD_VERSION	:= 1.4.76
> >> +LIGHTTPD_MD5		:= f9018cda389b1aa6dae4c5f962c20825
> >>  LIGHTTPD		:= lighttpd-$(LIGHTTPD_VERSION)
> >>  LIGHTTPD_SUFFIX		:= tar.xz
> >>  LIGHTTPD_URL		:= http://download.lighttpd.net/lighttpd/releases-1.4.x/$(LIGHTTPD).$(LIGHTTPD_SUFFIX)
> >> @@ -77,6 +77,14 @@ LIGHTTPD_CONF_OPT	:= \
> >>  	--without-maxminddb \
> >>  	--$(call ptx/wwo, PTXCONF_LIGHTTPD_LUA)-lua
> >>  
> >> +$(STATEDIR)/lighttpd.prepare:
> >> +	@$(call targetinfo)
> >> +	@$(call world/execute, LIGHTTPD, ./autogen.sh)
> >> +	@$(call world/prepare, LIGHTTPD)
> >> +	@$(call touch)
> > 
> > This probably works, but it is not the way ptxdist usually handles
> > this.  For packages not distributing ./configure you create a folder
> > in patches and symlink autogen.sh from the abovce folder.  See
> > dropwatch or evtest for example.
> 
> I don't particularly like this solution, because then with future
> updates (and these come regularly with lighttpd) yet another place has
> to be adapted which can also be easily overlooked.
> But if this is the usual way and there is no better solution (e.g. another 
> build system) then I'll do it this way.

I'm seeing a meson.build in the toplevel directory. So if you switch to
that we avoid the whole thing :-). (There is a CMakeLists.txt as well, but
I prefer meson. It works better for cross-compiling in my experience).

Michael

> > A short note in commit message about lighttpd not distributing
> > ./configure anymore would be nice.
> 
> You are right. I will add this.
>  
> > By chance, do you know how lighttpd is going forward on this?  I saw
> > buildroot switching to meson for building lighttpd.
> 
> I can only refer to the official documentation and there are examples
> for automake, cmake, meson and scons, without any particular way being
> advertised there.
> I am willing to convert this to another build system if that helps to
> avoid the patches.
> 
> Is one of them preferred with ptxdist?
> 
> Andreas
>  
> > Greets
> > Alex
> > 
> >> +
> >> +
> >> +
> >>  # ----------------------------------------------------------------------------
> >>  # Install
> >>  # ----------------------------------------------------------------------------
> >> -- 
> >> 2.43.0
> >>
> >>
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |