Re: [ptxdist] [PATCH] lighttpd: Version bump, 1.4.74 -> 1.4.76

[Andreas Helmcke <ahelmcke@ela-soft.com>]

Hello Alex,

Am 25.06.24 um 09:32 schrieb Alexander Dahl:
> Hello Andreas,
> 
> Am Mon, Jun 24, 2024 at 06:36:05PM +0200 schrieb Andreas Helmcke:
>> Important changes
>> - detect VU#421644 HTTP/2 CONTINUATION Flood
>> - avoid CVE-2024-3094 xz supply chain attack
>> - incrementally stronger TLS cipher defaults
>>
>> bugfixes
>>
>> Link: https://www.lighttpd.net/2024/4/12/1.4.76/
>> Link: https://www.lighttpd.net/2024/3/13/1.4.75/
>> Signed-off-by: Andreas Helmcke <ahelmcke@ela-soft.com>
>> ---
>>  rules/lighttpd.make | 12 ++++++++++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>  mode change 100644 => 100755 rules/lighttpd.make
>>
>> diff --git a/rules/lighttpd.make b/rules/lighttpd.make
>> old mode 100644
>> new mode 100755
>> index 96382b86a..fcb543818
>> --- a/rules/lighttpd.make
>> +++ b/rules/lighttpd.make
>> @@ -15,8 +15,8 @@ PACKAGES-$(PTXCONF_LIGHTTPD) += lighttpd
>>  #
>>  # Paths and names
>>  #
>> -LIGHTTPD_VERSION	:= 1.4.74
>> -LIGHTTPD_MD5		:= f38c400232151c69cc608fca35e593a9
>> +LIGHTTPD_VERSION	:= 1.4.76
>> +LIGHTTPD_MD5		:= f9018cda389b1aa6dae4c5f962c20825
>>  LIGHTTPD		:= lighttpd-$(LIGHTTPD_VERSION)
>>  LIGHTTPD_SUFFIX		:= tar.xz
>>  LIGHTTPD_URL		:= http://download.lighttpd.net/lighttpd/releases-1.4.x/$(LIGHTTPD).$(LIGHTTPD_SUFFIX)
>> @@ -77,6 +77,14 @@ LIGHTTPD_CONF_OPT	:= \
>>  	--without-maxminddb \
>>  	--$(call ptx/wwo, PTXCONF_LIGHTTPD_LUA)-lua
>>  
>> +$(STATEDIR)/lighttpd.prepare:
>> +	@$(call targetinfo)
>> +	@$(call world/execute, LIGHTTPD, ./autogen.sh)
>> +	@$(call world/prepare, LIGHTTPD)
>> +	@$(call touch)
> 
> This probably works, but it is not the way ptxdist usually handles
> this.  For packages not distributing ./configure you create a folder
> in patches and symlink autogen.sh from the abovce folder.  See
> dropwatch or evtest for example.

I don't particularly like this solution, because then with future
updates (and these come regularly with lighttpd) yet another place has
to be adapted which can also be easily overlooked.
But if this is the usual way and there is no better solution (e.g. another 
build system) then I'll do it this way.
 
> A short note in commit message about lighttpd not distributing
> ./configure anymore would be nice.

You are right. I will add this.
 
> By chance, do you know how lighttpd is going forward on this?  I saw
> buildroot switching to meson for building lighttpd.

I can only refer to the official documentation and there are examples
for automake, cmake, meson and scons, without any particular way being
advertised there.
I am willing to convert this to another build system if that helps to
avoid the patches.

Is one of them preferred with ptxdist?

Andreas
 
> Greets
> Alex
> 
>> +
>> +
>> +
>>  # ----------------------------------------------------------------------------
>>  # Install
>>  # ----------------------------------------------------------------------------
>> -- 
>> 2.43.0
>>
>>