summaryrefslogtreecommitdiffstats
path: root/debian/changelog
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--debian/changelog4664
1 files changed, 4664 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..a660286
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,4664 @@
+apache2 (2.4.57-2) unstable; urgency=medium
+
+ * Revert debian/* changes (Bookworm freeze)
+
+ -- Yadd <yadd@debian.org> Thu, 13 Apr 2023 07:26:51 +0400
+
+apache2 (2.4.57-1) unstable; urgency=medium
+
+ * New upstream version 2.4.57
+ * Drop 2.4.56-regression patches
+
+ -- Yadd <yadd@debian.org> Sat, 08 Apr 2023 06:57:16 +0400
+
+apache2 (2.4.56-2) unstable; urgency=medium
+
+ * Fix regression in mod_rewrite introduced in version 2.4.56
+ (Closes: #1033284)
+ * Fix regression in http2 introduced by 2.4.56 (Closes: #1033408)
+
+ -- Yadd <yadd@debian.org> Sun, 02 Apr 2023 06:54:25 +0400
+
+apache2 (2.4.56-1) unstable; urgency=medium
+
+ * New upstream version (Closes: #1032476, CVE-2023-27522, CVE-2023-25690)
+
+ -- Yadd <yadd@debian.org> Wed, 08 Mar 2023 06:44:05 +0400
+
+apache2 (2.4.55-1) unstable; urgency=medium
+
+ [ Hendrik Jäger ]
+ * disable ssl session tickets
+ * redundant example as already enabled in the default config
+ * logrotate indentation
+ * Update example how to prevent access to VCS directories
+
+ [ lintian-brush ]
+ * Update lintian override info to new format:
+ + debian/source/lintian-overrides: line 2, 4-5, 8
+ + debian/apache2-data.lintian-overrides: line 2-5
+ + debian/apache2-bin.lintian-overrides: line 3
+ + debian/apache2-doc.lintian-overrides: line 2
+ + debian/apache2.lintian-overrides: line 6
+ * Set upstream metadata fields: Repository-Browse.
+ * Update standards version to 4.6.2, no changes needed.
+
+ [ Yadd ]
+ * New upstream version (Closes: CVE-2006-20001, CVE-2022-36760,
+ CVE-2022-37436)
+
+ -- Yadd <yadd@debian.org> Wed, 18 Jan 2023 07:41:55 +0400
+
+apache2 (2.4.54-5) unstable; urgency=medium
+
+ [ Hendrik Jäger ]
+ * fix: one oom-killed thread should not take down the whole service
+ * fix: remove modelines
+ * fix: update clickjacking protection example
+ * fix: use tab for indentation, even in commented examples
+
+ [ Yadd ]
+ * Revert "Fix: confusing and impractical naming" (unbreak squid and haproxy
+ tests)
+
+ -- Yadd <yadd@debian.org> Tue, 29 Nov 2022 15:56:10 +0100
+
+apache2 (2.4.54-4) unstable; urgency=medium
+
+ [ Charles Plessy ]
+ * Replace mime-support transition package with media-types (Closes: #980275)
+
+ [ Hendrik Jäger ]
+ * fix mislead safety precautions: don't hide errors when enabling a module.
+ MR !20
+ * fix trailing spaces and indentation inconsistencies. MR !19 !21 !22
+ * Fix confusing and impractical naming: rename default-ssl.conf into
+ 000-default-ssl.conf. MR !23
+ * Fix confusing keyword: replace _default_ by *. MR !24
+
+ -- Yadd <yadd@debian.org> Thu, 24 Nov 2022 10:45:00 +0100
+
+apache2 (2.4.54-3) unstable; urgency=medium
+
+ [ Hendrik Jäger ]
+ * Do not enable global alias /manual
+ * mention not enabling /manual for the docs in the NEWS
+
+ -- Yadd <yadd@debian.org> Wed, 12 Oct 2022 09:20:52 +0200
+
+apache2 (2.4.54-2) unstable; urgency=medium
+
+ * Move cgid socket into a writeable directory (Closes: #1014056)
+ * Update lintian overrides
+ * Declare compliance with policy 4.6.1
+ * Install NOTICE in each package
+
+ -- Yadd <yadd@debian.org> Tue, 05 Jul 2022 15:49:58 +0200
+
+apache2 (2.4.54-1) unstable; urgency=medium
+
+ [ Simon Deziel ]
+ * Escape literal "." for BrowserMatch directives in setenvif.conf
+ * Use non-capturing regex with FilesMatch directive in default-ssl.conf
+
+ [ Ondřej Surý ]
+ * New upstream version 2.4.54 (Closes: #1012513, CVE-2022-31813,
+ CVE-2022-26377, CVE-2022-28614, CVE-2022-28615, CVE-2022-29404,
+ CVE-2022-30522, CVE-2022-30556, CVE-2022-28330)
+
+ [ Yadd ]
+ * Fix htcacheclean doc (Closes: #1010455)
+ * New upstream version 2.4.54
+
+ -- Yadd <yadd@debian.org> Thu, 09 Jun 2022 06:33:53 +0200
+
+apache2 (2.4.53-2) unstable; urgency=medium
+
+ * Clean useless Conflicts/Replace
+ * apache2-dev: add missing dependency on libpcre2-dev (Closes: #1007254)
+
+ -- Yadd <yadd@debian.org> Tue, 15 Mar 2022 15:27:39 +0100
+
+apache2 (2.4.53-1) unstable; urgency=medium
+
+ * New upstream version 2.4.53 (Closes: CVE-2022-22719,
+ CVE-2022-22720, CVE-2022-22721, CVE-2022-23943)
+ * Update copyright
+ * Patches:
+ + Drop fix-2.4.52-regression.patch, now included in upstream
+ + Refresh fhs_compliance.patch
+ + Update and disable child_processes_fail_to_start.patch
+ * Update test framework
+ * Back to unstable
+
+ -- Yadd <yadd@debian.org> Mon, 14 Mar 2022 17:10:39 +0100
+
+apache2 (2.4.52-3) experimental; urgency=medium
+
+ * Fix autopkgtest with libpcre2 (autopkgtest still fails due to an SSL
+ error)
+ * Set hardening=+all instead of hardening=+bindnow
+
+ -- Yadd <yadd@debian.org> Tue, 28 Dec 2021 21:20:05 +0100
+
+apache2 (2.4.52-2) experimental; urgency=medium
+
+ * Build with pcre2 (Closes: #1000114)
+
+ -- Yadd <yadd@debian.org> Tue, 28 Dec 2021 20:01:43 +0100
+
+apache2 (2.4.52-1) unstable; urgency=medium
+
+ * Refresh suexec-custom.patch
+ * Update lintian overrides
+ * Wrap long lines in changelog entries: 2.4.51-2.
+ * New upstream version 2.4.52 (Closes: CVE-2021-44224, CVE-2021-44790)
+ * Refresh patches
+
+ -- Yadd <yadd@debian.org> Mon, 20 Dec 2021 18:42:09 +0100
+
+apache2 (2.4.51-2) unstable; urgency=medium
+
+ * Add patch to have new macro_ignore_empty and macro_ignore_bad_nesting
+ parameters
+
+ -- Yadd <yadd@debian.org> Mon, 25 Oct 2021 18:37:03 +0200
+
+apache2 (2.4.51-1) unstable; urgency=medium
+
+ * New upstream version 2.4.51 (Closes: CVE-2021-41773, CVE-2021-42013)
+ * Fix apache2ctl (see https://github.com/oerdnj/deb.sury.org/issues/1659)
+
+ -- Yadd <yadd@debian.org> Thu, 07 Oct 2021 20:35:33 +0200
+
+apache2 (2.4.50-1) unstable; urgency=high
+
+ * New upstream version 2.4.50 (Closes: CVE-2021-41773, CVE-2021-41524)
+ * Remove patches already merged upstream
+
+ -- Ondřej Surý <ondrej@debian.org> Tue, 05 Oct 2021 13:25:23 +0200
+
+apache2 (2.4.49-4) unstable; urgency=medium
+
+ [ Ondřej Surý ]
+ * Add upstream patch to fix crash in 2.4.49
+
+ -- Yadd <yadd@debian.org> Fri, 01 Oct 2021 11:34:24 +0200
+
+apache2 (2.4.49-3) unstable; urgency=medium
+
+ [ Yadd ]
+ * Re-export upstream signing key without extra signatures.
+ * Drop transition for old debug package migration.
+
+ [ Moritz Muehlenhoff ]
+ * Fix CVE-2021-40438 regression
+
+ -- Yadd <yadd@debian.org> Thu, 30 Sep 2021 06:00:06 +0200
+
+apache2 (2.4.49-2) unstable; urgency=medium
+
+ [ Michiel Hazelhof ]
+ * Fix multi instance issue (Closes: #868861)
+
+ [ Philippe Ombredanne ]
+ * Fix GPL version typo in copyright file
+
+ -- Yadd <yadd@debian.org> Thu, 23 Sep 2021 13:55:55 +0200
+
+apache2 (2.4.49-1) unstable; urgency=medium
+
+ * Update upstream GPG keys
+ * New upstream version 2.4.51. Closes: CVE-2021-33193, CVE-2021-34798,
+ CVE-2021-36160, CVE-2021-39275, CVE-2021-40438, CVE-2021-41524,
+ CVE-2021-41773, CVE-2021-42013)
+ * Refresh patches
+
+ -- Yadd <yadd@debian.org> Thu, 16 Sep 2021 06:22:23 +0200
+
+apache2 (2.4.48-4) unstable; urgency=medium
+
+ * Fix mod_proxy HTTP2 request line injection (Closes: CVE-2021-33193)
+
+ -- Yadd <yadd@debian.org> Thu, 12 Aug 2021 11:37:43 +0200
+
+apache2 (2.4.48-3.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Direct init script reload output from logrotate to syslog, to
+ avoid mail-spamming the local admin (Closes: #990580)
+
+ -- Thorsten Glaser <tg@mirbsd.de> Sat, 10 Jul 2021 23:31:28 +0200
+
+apache2 (2.4.48-3) unstable; urgency=medium
+
+ * Fix debian/changelog
+
+ -- Yadd <yadd@debian.org> Sun, 20 Jun 2021 16:39:33 +0200
+
+apache2 (2.4.48-2) unstable; urgency=medium
+
+ * Back to unstable: Apache2 will follow upstream changes for Bullseye
+
+ [ Christian Ehrhardt ]
+ * d/t/control, d/t/check-http2: basic test for http2 (Closes: #884068)
+
+ -- Yadd <yadd@debian.org> Sat, 19 Jun 2021 17:50:29 +0200
+
+apache2 (2.4.48-1) experimental; urgency=medium
+
+ [ Daniel Lewart ]
+ * Update apache2.logrotate (Closes: #979813)
+
+ [ Andreas Hasenack ]
+ * Avoid test suite failure (Closes: #985012)
+
+ [ Yadd ]
+ * Update lintian overrides
+ * Re-export upstream signing key without extra signatures.
+
+ [ Ondřej Surý ]
+ * New upstream version 2.4.48 (Closes: CVE-2019-17567, CVE-2020-13938,
+ CVE-2020-13950, CVE-2020-35452, CVE-2021-26690, CVE-2021-26691,
+ CVE-2021-30641, CVE-2021-31618)
+
+ -- Ondřej Surý <ondrej@debian.org> Tue, 08 Jun 2021 08:29:35 +0200
+
+apache2 (2.4.47-1) experimental; urgency=medium
+
+ * Update upstream keys file
+ * New upstream version 2.4.47
+ * Refresh patches
+
+ -- Yadd <yadd@debian.org> Thu, 29 Apr 2021 08:03:33 +0200
+
+apache2 (2.4.46-6) unstable; urgency=medium
+
+ * Fix various low security issues (Closes: CVE-2020-13950, CVE-2020-35452,
+ CVE-2021-26690, CVE-2021-26691, CVE-2021-30641)
+
+ -- Yadd <yadd@debian.org> Thu, 10 Jun 2021 13:40:11 +0200
+
+apache2 (2.4.46-5) unstable; urgency=medium
+
+ * Fix "NULL pointer dereference on specially crafted HTTP/2 request"
+ (Closes: #989562, CVE-2021-31618)
+
+ -- Yadd <yadd@debian.org> Thu, 10 Jun 2021 11:57:38 +0200
+
+apache2 (2.4.46-4) unstable; urgency=medium
+
+ * Ignore other random another test failures (Closes: #979664)
+
+ -- Xavier Guimard <yadd@debian.org> Mon, 11 Jan 2021 11:58:23 +0100
+
+apache2 (2.4.46-3) unstable; urgency=medium
+
+ * Remove postinst/preinst hooks concerning old versions
+ * Clean include-binaries
+ * Enable verbose test output during autopkgtest
+ * Declare compliance with policy 4.5.1
+ * Add debian/gbp.conf
+ * Disable temporary 3 subtests (Closes: #979664)
+
+ -- Xavier Guimard <yadd@debian.org> Sun, 10 Jan 2021 22:43:21 +0100
+
+apache2 (2.4.46-2) unstable; urgency=medium
+
+ [ Jean-Michel Vourgère ]
+ * Man: Add missing options and see also in a2en*(8)
+
+ [ Xavier Guimard ]
+ * Bump debhelper compatibility level to 13
+ + Set debhelper-compat version in Build-Depends.
+ * Use dh_installsystemd rather than deprecated dh_systemd_enable
+ * Add extension .da for danish language in mime.conf (Closes: #972398)
+ * Automatically deflate application/wasm files (Closes: #972400)
+ * Use "graceful-stop" in systemd ExecStop (Closes: #974665)
+ * Re-export upstream signing key without extra signatures.
+ * Ignore lintian's national-encoding tag in test framework
+ * Add ${misc:Pre-Depends} in apache2 package
+ * Update lintian overrides
+ * Refresh patches
+ * Fix little spelling errors
+
+ -- Xavier Guimard <yadd@debian.org> Fri, 13 Nov 2020 16:59:01 +0100
+
+apache2 (2.4.46-1) unstable; urgency=medium
+
+ [ Xavier Guimard ]
+ * Add "Multi-Arch: same" to apache2-ssl-dev and libapache2-mod-md
+
+ [ Timo Tijhof ]
+ * Compress text/javascript with mod_deflate by default (Closes: #959195)
+
+ [ Xavier Guimard ]
+ * Add "Multi-Arch: same" to apache2-ssl-dev and libapache2-mod-md
+ * Update upstream keys
+ * New upstream version 2.4.46 (Closes: CVE-2020-11984, CVE-2020-11993,
+ CVE-2020-9490)
+
+ -- Xavier Guimard <yadd@debian.org> Sat, 08 Aug 2020 08:33:36 +0200
+
+apache2 (2.4.43-1) unstable; urgency=medium
+
+ [ Timo Aaltonen ]
+ * mod_ssl: Add patches to fix TLS 1.3 client cert authentication for POST
+ requests (Closes: #955348)
+
+ [ Moritz Schlarb ]
+ * Fix logrotate script for multi-instance (Closes: #914606)
+
+ [ Xavier Guimard ]
+ * New upstream version 2.4.43 (Closes: CVE-2020-1927, CVE-2020-1934)
+ * Refresh patches
+
+ -- Xavier Guimard <yadd@debian.org> Tue, 31 Mar 2020 08:02:12 +0200
+
+apache2 (2.4.41-5) unstable; urgency=medium
+
+ [ Xavier Guimard ]
+ * Avoid double mod_dav load (Closes: #951753)
+
+ [ Timo Aaltonen ]
+ * mod_proxy_ajp-add-secret-parameter.diff: Apply a patch from 2.4.x to fix
+ AJP with current tomcat.
+ (Closes: #954201)
+
+ -- Xavier Guimard <yadd@debian.org> Wed, 18 Mar 2020 21:06:49 +0100
+
+apache2 (2.4.41-4) unstable; urgency=medium
+
+ * Add gcc in chroot autopkgtest (fixes debci)
+
+ -- Xavier Guimard <yadd@debian.org> Fri, 07 Feb 2020 06:14:33 +0100
+
+apache2 (2.4.41-3) unstable; urgency=medium
+
+ * Don't use hardcoded libgcc_s.so.1 path in autopkgtest files. Thanks to
+ Aurelien Jarno (Closes: #950711)
+
+ -- Xavier Guimard <yadd@debian.org> Wed, 05 Feb 2020 13:18:04 +0100
+
+apache2 (2.4.41-2) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * Add *.load file for mod_socache_redis
+
+ [ Vagrant Cascadian ]
+ * Embeds path to EGREP in config_vars.mk (Closes: #948757)
+ * Sanitize CXXFLAGS/-ffile-prefix-map in config_vars.mk (Closes: #948759)
+
+ -- Xavier Guimard <yadd@debian.org> Mon, 13 Jan 2020 06:14:45 +0100
+
+apache2 (2.4.41-1) unstable; urgency=medium
+
+ * New upstream version 2.4.41 (Closes: CVE-2019-9517, CVE-2019-10081,
+ CVE-2019-10082, CVE-2019-10092, CVE-2019-10098)
+ * Update lintian overrides
+ * Remove README in usr/share/apache2
+ * Move httxt2dbm manpage in section 8
+ * Update test framework
+
+ -- Xavier Guimard <yadd@debian.org> Wed, 14 Aug 2019 06:42:29 +0200
+
+apache2 (2.4.39-2) unstable; urgency=medium
+
+ * Fix bad call of dh_link. Thanks to Daniel Baumann (Closes: #934640)
+
+ -- Xavier Guimard <yadd@debian.org> Mon, 12 Aug 2019 22:52:47 +0200
+
+apache2 (2.4.39-1) unstable; urgency=medium
+
+ [ Helmut Grohne ]
+ * Do not install /usr/share/apache2/build/config.nice (Closes: #929510)
+
+ [ Xavier Guimard ]
+ * New upstream version 2.4.39 (Closes: CVE-2019-0196, CVE-2019-0197,
+ CVE-2019-0211, CVE-2019-0215, CVE-2019-0217, CVE-2019-0220)
+ * Refresh patches
+ * Remove patches now included in upstream
+ * Replace duplicate doc files by links using jdupes
+ * Add bison in build dependencies
+
+ -- Xavier Guimard <yadd@debian.org> Mon, 12 Aug 2019 21:30:33 +0200
+
+apache2 (2.4.38-3) unstable; urgency=high
+
+ [ Marc Deslauriers ]
+ * SECURITY UPDATE: read-after-free on a string compare in mod_http2
+ - debian/patches/CVE-2019-0196.patch: disentangelment of stream and
+ request method in modules/http2/h2_request.c.
+ - CVE-2019-0196
+ * SECURITY UPDATE: privilege escalation from modules' scripts
+ - debian/patches/CVE-2019-0211.patch: bind the bucket number of each
+ child to its slot number in include/scoreboard.h,
+ server/mpm/event/event.c, server/mpm/prefork/prefork.c,
+ server/mpm/worker/worker.c.
+ - CVE-2019-0211
+ * SECURITY UPDATE: mod_ssl access control bypass
+ - debian/patches/CVE-2019-0215.patch: restore SSL verify state after
+ PHA failure in TLSv1.3 in modules/ssl/ssl_engine_kernel.c.
+ - CVE-2019-0215
+ * SECURITY UPDATE: mod_auth_digest access control bypass
+ - debian/patches/CVE-2019-0217.patch: fix a race condition in
+ modules/aaa/mod_auth_digest.c.
+ - CVE-2019-0217
+ * SECURITY UPDATE: URL normalization inconsistincy
+ - debian/patches/CVE-2019-0220-1.patch: merge consecutive slashes in
+ the path in include/http_core.h, include/httpd.h, server/core.c,
+ server/request.c, server/util.c.
+ - debian/patches/CVE-2019-0220-2.patch: fix r->parsed_uri.path safety
+ in server/request.c, server/util.c.
+ - debian/patches/CVE-2019-0220-3.patch: maintainer mode fix in
+ server/util.c.
+ - CVE-2019-0220
+
+ [ Stefan Fritsch ]
+ * Pull security fixes from 2.4.39 via Ubuntu
+ * CVE-2019-0197: mod_http2: Fix possible crash on late upgrade
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 07 Apr 2019 20:15:40 +0200
+
+apache2 (2.4.38-2) unstable; urgency=medium
+
+ * Disable "reset" test in allowmethods.t (Closes: #921024)
+
+ -- Xavier Guimard <yadd@debian.org> Thu, 31 Jan 2019 21:54:05 +0100
+
+apache2 (2.4.38-1) unstable; urgency=medium
+
+ [ Jelmer Vernooij ]
+ * Reverted for now: Transition to automatic debug package (from: apache2-dbg)
+ * Trim trailing whitespace
+ * Use secure copyright file specification URI
+
+ [ Niels Thykier ]
+ * Add Rules-Requires-Root: binary-targets
+
+ [ Xavier Guimard ]
+ * Convert signing-key.pgp into signing-key.asc
+ * Add http2.conf (Closes: #880993)
+ * Remove unnecessary greater-than versioned dependency to dpkg-dev,
+ libbrotli-dev and libapache2-mod-md
+ * Declare compliance with policy 4.2.1
+ * Add spelling errors patch (reported)
+ * Fix some spelling errors in debian files
+ * Add myself to uploaders
+ * Refresh patches
+ * Bump debhelper compatibility level to 10
+ * debian/rules:
+ - Remove unnecessary dh argument --parallel
+ - use /usr/share/dpkg/pkg-info.mk instead of dpkg-parsechangelog
+ * Add upstream/metadata
+ * Replace MIT by Expat in debian/copyright
+ * debian/watch: use https url
+ * Add documentation links in systemd service files
+ * Team upload
+
+ [ Cyrille Bollu ]
+ * Put HTTP2 configuration within <IfModule !mpm_prefork></IfModule> tags as
+ it gets automatically de-activated upon apache 'startup when using
+ mpm_prefork.
+ * Updated http2.conf to inform user that they may want to change their
+ LogFormat directives.
+
+ [ Xavier Guimard ]
+ * New upstream version 2.4.38 (Closes: #920220, #920302, #920303,
+ CVE-2018-17189, CVE-2018-17199, CVE-2019-0190)
+ * Refresh patches
+ * Remove setenvifexpr.diff patch now included in upstream
+ * Replace libapache2-mod-proxy-uwsgi.{post*,prerm} by a maintscript
+ * Add a "sleep" in debian/tests/htcacheclean and skip result if "stop" failed
+ * Declare compliance with policy 4.3.0
+ * Fix homepage to https
+ * Update debian/copyright
+
+ -- Xavier Guimard <yadd@debian.org> Tue, 29 Jan 2019 23:49:49 +0100
+
+apache2 (2.4.37-1) unstable; urgency=medium
+
+ * New upstream version
+ - mod_ssl: Add support for TLSv1.3
+ * Add docs symlink for libapache2-mod-proxy-uwsgi. Closes: #910218
+ * Update test-framework to r1845652
+ * Fix test suite to actually run by creating a test user. It turns out
+ the test suite refuses to run as root but returns true even in that
+ case. It seems this has been broken since 2.4.27-4, where the test suite
+ had been updated and the debci test duration dropped from 15min to
+ 3min. Also, don't rely on the exit status anymore but parse the test
+ output.
+ * Backport a fix from trunk for SetEnvIfExpr. This fixes a test failure.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 03 Nov 2018 14:26:31 +0100
+
+apache2 (2.4.35-1) unstable; urgency=medium
+
+ * New upstream version 2.4.35
+ Security fix:
+ - CVE-2018-11763: DoS for HTTP/2 connections by continuous SETTINGS
+ Closes: #909591
+ * Fix lintian warning: Don't force xz in builddeb override.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 07 Oct 2018 12:54:58 +0200
+
+apache2 (2.4.34-1) unstable; urgency=medium
+
+ [ Ondřej Surý ]
+ * New upstream version 2.4.34
+ Security fixes:
+ - CVE-2018-1333: Denial of service in mod_http2. Closes: #904106
+ - CVE-2018-8011: Denial of service in mod_md. Closes: #904107
+ * Refresh patches for Apache2 2.4.34 release
+ * Update the suexec-custom.patch for 2.4.34 release
+
+ [ Stefan Fritsch ]
+ * Remove load order dependency introduced in mod_lbmethod_* in 2.4.34
+ * Remove debian/gbp.conf. Closes: #904641
+ * Fix typo in apache2_switch_mpm() in apache2-maintscript-helper.
+ Closes: #904150
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 27 Jul 2018 21:37:37 +0200
+
+apache2 (2.4.33-3) unstable; urgency=medium
+
+ * Add Breaks for libapache2-mod-proxy-uwsgi and libapache2-mod-md, too.
+ Closes: #894785
+ * mod_http2: Avoid high memory usage with large files, causing crashes on
+ 32bit archs. Closes: #897218
+ * Migrate from alioth to salsa.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 05 May 2018 11:34:47 +0200
+
+apache2 (2.4.33-2) unstable; urgency=medium
+
+ * Add Replaces: and transitional packages for libapache2-mod-proxy-uwsgi
+ and libapache2-mod-md.
+ Closes: #894760, #894761, #894785
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 22 Apr 2018 11:14:19 +0200
+
+apache2 (2.4.33-1) unstable; urgency=medium
+
+ * New upstream version.
+ Security fixes:
+ - CVE-2017-15710
+ Out of bound write in mod_authnz_ldap with AuthLDAPCharsetConfig enabled
+ - CVE-2018-1283
+ mod_session: CGI-like applications that intend to read from mod_session's
+ 'SessionEnv ON' could be fooled into reading user-supplied data instead.
+ - CVE-2018-1303
+ mod_cache_socache: Fix request headers parsing to avoid a possible crash
+ with specially crafted input data.
+ - CVE-2018-1301
+ core: Possible crash with excessively long HTTP request headers.
+ Impractical to exploit with a production build and production LogLevel.
+ - CVE-2017-15715
+ core: Configure the regular expression engine to match '$' to the end of
+ the input string only, excluding matching the end of any embedded
+ newline characters. Behavior can be changed with new directive
+ 'RegexDefaultOptions'.
+ - CVE-2018-1312
+ mod_auth_digest: Fix generation of nonce values to prevent replay
+ attacks across servers using a common Digest domain. This change
+ may cause problems if used with round robin load balancers. PR 54637
+ - CVE-2018-1302
+ mod_http2: Potential crash w/ mod_http2.
+
+ - mod_proxy_uwsgi: New UWSGI proxy submodule.
+ - mod_md: New experimental module for managing domains across virtual
+ hosts, implementing the Let's Encrypt ACMEv1 protocol to signup and
+ renew certificates.
+ - core: silently ignore a not existent file path when IncludeOptional
+ is used. Closes: #878920
+ - mod_ldap: Avoid possible crashes, hangs, and busy loops. Closes: #814980
+
+ * Fix lintian warnings:
+ - Include SupportApache-small.png in apache2-doc package instead of
+ linking to apache.org, to avoid privacy issues.
+ - Use /usr/share/dpkg/architecture.mk instead of setting DEB_*_GNU_TYPE
+ - Remove deprecated use of autotools_dev with dh.
+ - Add some overrides
+ * Bump standards-version to 4.1.2 (no changes)
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 30 Mar 2018 22:53:13 +0200
+
+apache2 (2.4.29-2) unstable; urgency=medium
+
+ * Add myself to Uploaders
+ * Bump required version of apr/apr-util to 1.6.0 (Closes: #879634)
+ * Run wrap-and-sort -a to canonicalize the debian/ directory
+ * Add Build-Depends on libbrotli-dev and enable brotli module
+
+ -- Ondřej Surý <ondrej@debian.org> Sun, 14 Jan 2018 11:01:58 +0000
+
+apache2 (2.4.29-1) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * Replace outdated dependency on dh-systemd
+
+ [ Ondřej Surý ]
+ * New upstream version 2.4.29
+ * Refresh quilt patches
+ * Add mod_ssl_md patch needed for libapache2-mod-md (Closes: #877343)
+ * Refresh patches on top of upstream release 2.4.29
+ * Fix Apache crash on restarts (ASF Bug 61558)
+ * Add deconfigure to the list of recognized scripts (Closes: #877524)
+
+ -- Ondřej Surý <ondrej@debian.org> Mon, 23 Oct 2017 14:46:55 +0000
+
+apache2 (2.4.27-6) unstable; urgency=high
+
+ * CVE-2017-9798: Don't allow new methods to be registered in .htaccess files
+ which could result in HTTP OPTIONS method leaking Apache's server memory.
+ Closes: #876109
+ * Fix argument escaping in apachectl. Closes: #876384
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 24 Sep 2017 00:08:01 +0200
+
+apache2 (2.4.27-5) unstable; urgency=medium
+
+ * Upload to unstable.
+ * Update "Breaks:" for openssl transition.
+ * Bump Standards-Version to 4.1.0. No changes needed.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 03 Sep 2017 17:18:57 +0200
+
+apache2 (2.4.27-4) experimental; urgency=medium
+
+ * Use 'invoke-rc.d' instead of init script in logrotate script.
+ Closes: #857607
+ * Make the apache-htcacheclean init script actually look into
+ /etc/default/apache-htcacheclean for its config. LP: #1691495
+ * mime.conf: Guard AddOutputFilter INCLUDES with proper <IfModule>.
+ LP: #1675184
+ * Use 'service' instead of init script in monit example config.
+ * Bump Standards-Version to 4.0.1. Other changes:
+ - change package priorities from extra to optional
+ * Use libprotocol-http2-perl in autopkgtest.
+ * Update test suite to svn r1804214.
+ * Various tweaks to the test suite autopkgtest to avoid having to skip
+ any test.
+ * Also remove -DBUILD_DATETIME and -fdebug-prefix-map from config_vars.mk
+ to avoid them being used by apxs.
+ * deflate.conf: Remove mention of MSIE6
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 08 Aug 2017 21:59:37 +0200
+
+apache2 (2.4.27-3) experimental; urgency=medium
+
+ * Switch to openssl 1.1. Again closes: #851094
+ * Add versioned breaks for gridsite, libapache2-mod-dacs because of
+ openssl transition.
+ * Provide new apache2-api-20120211-openssl1.1 virtual package and make
+ dh_apache2 generate a dependency on it if there is a build-dep on
+ apache2-ssl-dev.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 16 Jul 2017 23:11:07 +0200
+
+apache2 (2.4.27-2) unstable; urgency=medium
+
+ * Switch back to openssl 1.0 for now. The transition to 1.1 needs more
+ work and should go into experimental, first. Reopens: #851094
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 16 Jul 2017 23:01:10 +0200
+
+apache2 (2.4.27-1) unstable; urgency=medium
+
+ [ New upstream release ]
+ * Fix CVE-2017-9788: mod_auth_digest: Uninitialized memory reflection
+ Closes: #868467
+
+ [ Stefan Fritsch ]
+ * Switch to openssl 1.1. Closes: #851094
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 16 Jul 2017 10:39:15 +0200
+
+apache2 (2.4.25-4) unstable; urgency=high
+
+ * Backport security fixes from 2.4.26:
+ * CVE-2017-3167: Authentication bypass with ap_get_basic_auth_pw()
+ * CVE-2017-3169: mod_ssl NULL pointer dereference
+ * CVE-2017-7668: Buffer overrun in ap_find_token()
+ * CVE-2017-7679: mod_mime buffer overread
+ * CVE-2017-7659: mod_http2 NULL pointer dereference
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 20 Jun 2017 21:31:51 +0200
+
+apache2 (2.4.25-3) unstable; urgency=medium
+
+ * Fix detection of systemd to fix 'apache2ctl start' on sysv-init.
+ Closes: #852543
+ * Compile mod_bucketeer mod_case_filter mod_case_filter_in for benefit of
+ the test suite, but don't add *.load files because they don't have any
+ real-world use.
+ * Include the upstream test suite and a corresponding autopkgtest. This
+ is quite a hack but it may help quite a bit with security updates,
+ especially if stretch gets LTS support, too.
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 25 Jan 2017 23:59:26 +0100
+
+apache2 (2.4.25-2) unstable; urgency=medium
+
+ * Activate mod_reqtimeout in new installs and during updates from
+ before 2.4.25-2. It was wrongly not activated in new installs since
+ jessie. This made the default installation vulnerable to some DoS
+ attacks.
+ * Restart htcacheclean on updates and tighten dependency on apache2-utils
+ to ensure that apache2-utils cannot be upgraded without apache2.
+ Closes: #851122
+ * When running on systems with systemd, make 'apache2ctl start' invoke
+ systemctl instead. Otherwise systemd will think apache2 is not running
+ and ignore further commands like reload. Closes: #839227
+ * Avoid segfault in mpm_event if a signal is received too soon after start.
+ PR 60487
+ * Add test for some modules to be enabled.
+ * Remove mention of CVE-2016-5387 in 2.4.25-1 changelog. It was already
+ fixed in 2.4.23-2.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 14 Jan 2017 19:27:34 +0100
+
+apache2 (2.4.25-1) unstable; urgency=medium
+
+ [ New upstream release ]
+ * Security: CVE-2016-0736:
+ mod_session_crypto: Authenticate the session data/cookie with a MAC to
+ prevent deciphering or tampering with a padding oracle attack.
+ * Security: CVE-2016-2161:
+ mod_auth_digest: Prevent segfaults during client entry allocation when the
+ shared memory space is exhausted.
+ * Security: CVE-2016-8740:
+ mod_http2: Mitigate DoS memory exhaustion via endless CONTINUATION frames.
+ Closes: #847124
+ * Security: CVE-2016-8743:
+ Enforce HTTP request grammar corresponding to RFC7230 for request lines
+ and request headers, to prevent response splitting and cache pollution by
+ malicious clients or downstream proxies.
+ * The stricter HTTP enforcement may cause compatibility problems with
+ non-conforming clients. Fine-tuning is possible with the new
+ HttpProtocolOptions directive.
+ * mpm_event: Fix "scoreboard full" errors. Closes: #834708 LP: #1466926
+ * mod_http2: Many fixes and support for early pushes using the new
+ H2PushResource directive.
+
+ [ Stefan Fritsch ]
+ * Switch to debhelper compatibility level 9.
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 21 Dec 2016 23:46:06 +0100
+
+apache2 (2.4.23-8) unstable; urgency=medium
+
+ * Move the mod_ssl_openssl.h header and the dependency on libssl-dev to a
+ new package apache2-ssl-dev. Packages that interface with openssl
+ state from mod_ssl must build-depend on this new package.
+ This will help to disentangle the build-deps in the openssl transition.
+ Closes: #845033
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 20 Nov 2016 00:33:13 +0100
+
+apache2 (2.4.23-7) unstable; urgency=medium
+
+ * Make apache2-dev depend on openssl 1.0, too. Closes: #844160
+ * Move DefaultRuntimeDir and pid file for multi-instances to
+ /var/run/apache2-xxx. Thanks to Horst Platz for the debugging.
+ Closes: #838932 LP: #1627339
+ * Fix systemd unit naming for multi-instances.
+ * Tweak embedded .tar.gz some more to build reproducibly.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 13 Nov 2016 13:08:28 +0100
+
+apache2 (2.4.23-6) unstable; urgency=medium
+
+ * One more tweak for reproducible build. Thanks to Daniel Shahaf for the
+ patch. Closes: #839977
+ * Avoid building with openssl 1.1 for now. See #828236
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 09 Nov 2016 23:51:25 +0100
+
+apache2 (2.4.23-5) unstable; urgency=low
+
+ * Team upload.
+
+ [ Stefan Fritsch ]
+ * Tweak creation of .tar.gz embedded in preinst to get reproducible
+ build.
+
+ [ Raphaël Hertzog ]
+ * Add systemd unit files. Closes: #798430
+ * Improve a2enmod to enable apache-htcacheclean with systemctl and let
+ it enable 'apache-htcacheclean@instance.service' for multi-instance
+ support.
+ * Improve setup-instance to rely on the systemd apache2@instance.service for
+ multi-instance support.
+ * Drop /lib/systemd/system/apache2.service.d/forking.conf now that we have
+ proper native systemd support.
+ * Modify handling of /etc/init.d/apache-htcacheclean to have a usual
+ Default-Start value but instead we disable it manually in the postinst.
+ That way "systemctl enable apache-htcacheclean" works.
+ * Add some lintian overrides for non-problems (two update-rc.d calls in
+ postinst, and a .js file with a very long line).
+
+ -- Raphaël Hertzog <hertzog@debian.org> Thu, 29 Sep 2016 12:03:31 +0200
+
+apache2 (2.4.23-4) unstable; urgency=medium
+
+ * Fix pre-inst script for new installations. Closes: #834169
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 12 Aug 2016 21:44:31 +0200
+
+apache2 (2.4.23-3) unstable; urgency=low
+
+ * Fix conffiles that may have got the wrong content during upgrade from
+ wheezy to early jessie versions. Closes: #794933
+ * Also restore re-introduced *.load files for mod_ident, mod_imagemap, and
+ mod_cern_meta. These may have gone missing due to dpkg thinking they still
+ belong to apache2.2-common. Reported by Markus Waldeck.
+ * apache2-maintscript-helper: Make apache2_switch_mpm do nothing if the
+ local admin has disabled the requested mpm manually.
+ Closes: #827446, #799630
+ * Make mod_proxy_html depend on mod_xml2enc.
+ * dh_apache2: Make versioned recommends on apache2 less strict. There is
+ no advantage in recommending the current version. Closes: #784290
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 11 Aug 2016 21:40:35 +0200
+
+apache2 (2.4.23-2) unstable; urgency=high
+
+ * CVE-2016-5387: Sets environmental variable based on user supplied Proxy
+ request header.
+ Don't pass through HTTP_PROXY in server/util_script.c
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 21 Jul 2016 23:21:37 +0200
+
+apache2 (2.4.23-1) unstable; urgency=high
+
+ * New upstream release
+ - Security: CVE-2016-4979: Fix bypass of TLS client certificate
+ verification in mod_http2.
+ - new modules mod_proxy_http2 (experimental) and mod_proxy_hcheck
+ * Re-introduce mod_imagemap and mod_cern_meta. Closes: #786657
+ * Set SHELL=/bin/bash during configure to get reproducible builds regardless
+ of where /bin/sh points to.
+ * Use 'Require method' instead of Limit/LimitExcept in userdir.conf.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 05 Jul 2016 23:57:25 +0200
+
+apache2 (2.4.20-2) unstable; urgency=medium
+
+ * Fix crash in ap_get_useragent_host() triggered by mod_perl test.
+ Closes: #820824
+ * Fix race condition and logical error in init script. Thanks to Thomas
+ Stangner for the patch. Closes: #822144
+ * Remove links to manpages.debian.org in default index.html to avoid
+ broken robots doing a DoS on the site. Closes: #821313
+ * Fix a2enmod to run on perl 5.14 to simplify backports. Closes: #821956
+ * Bump Standards-Version (no changes necessary).
+ * Fix segfault with logresolve -c. Closes: #823259
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 28 May 2016 16:14:09 +0200
+
+apache2 (2.4.20-1) unstable; urgency=medium
+
+ * New upstream release
+ - mostly bugfixes and HTTP/2 improvements
+ * Build against lua 5.2 instead of 5.1. Closes: #820243
+ * Correct systemd-sysv-generator behavior by customizing some parameters.
+ This fixes 'systemctl status' returning incorrect results. Thanks to
+ Pierre-André MOREY for the patch. LP: #1488962
+ * On Linux, use pthread mutexes. On kfreebsd/hurd, continue using fctnl
+ because they lack robust pthred mutexes. LP: #1565744, #1527044
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 10 Apr 2016 14:03:41 +0200
+
+apache2 (2.4.18-2) unstable; urgency=low
+
+ * htcacheclean:
+ - split starting/stopping into separate init script 'apache-htcacheclean'
+ - move config from /etc/default/apache2 to /etc/default/apache-htcacheclean
+ - make a2enmod/a2dismod enable/disable htcacheclean with mod_cache_disk
+ - start htcacheclean as the apache2 run user/group
+ * Fix a2query -M not returning output if apache2 config is broken.
+ Fix missing quotes in apache2-maintscript-helper. Closes: #810500
+ * README.backtrace: Note that coredump directory needs to be owned by
+ www-data. Closes: #806697
+ * Remove ssl work-arounds for MSIE. Newer versions of IE work without them
+ and older versions are no longer supported by MS. Closes: #815852
+ * Give a hint about systemd in README.multiple-instances. Closes: #818904
+ * Don't treat mod_access_compat as essential. It's essentially broken,
+ anyway.
+ * Merge cross-compile tweaks for debian/rules from ubuntu.
+ * Merge autopkgtests from Ubuntu. Many thanks to Robie Basak.
+ Closes: #719245
+ * Fix duplicate-module-load test and make sure it fails if it cannot execute
+ apache2ctl.
+ * Bump Standards-Version (no changes necessary).
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 28 Mar 2016 21:58:54 +0200
+
+apache2 (2.4.18-1) unstable; urgency=medium
+
+ * New upstream release:
+ - mostly HTTP/2 improvements
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 19 Dec 2015 09:26:14 +0100
+
+apache2 (2.4.17-3) unstable; urgency=medium
+
+ * mpm_prefork: Fix segfault if started with -X. Closes: #805737
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 23 Nov 2015 19:52:09 +0100
+
+apache2 (2.4.17-2) unstable; urgency=medium
+
+ * Revert REDIRECT_URL to pre-2.4.17 behavior for now. The change broke
+ lots of web-apps. Closes: #803353
+ * Fix secondary-init-script to not source the main init script with 'set -e'.
+ Closes: #803177
+ * mod_http2: Write HTTP/2 into THE_REQUEST and the access log.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 31 Oct 2015 23:17:11 +0100
+
+apache2 (2.4.17-1) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * New upstream release:
+ - New experimental http2 module
+ * reproducible build: Make symbol sorting consistent over different locales
+ * Conflict with apache2.2-common and apache2.2-bin to get the transitional
+ packages removed. Closes: #768815
+ * Don't treat mpm_itk as MPM module in a2query. Closes: #791902
+ * Don't treat mpm_itk as MPM module in deferred actions in postinst.
+ Hopefully really closes: #789914
+ * Don't treat mpm_itk as MPM module in a2enmod.
+
+ [ Jean-Michel Vourgère ]
+ * Updated upstream keyring used to check source authenticity.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 24 Oct 2015 22:14:32 +0200
+
+apache2 (2.4.16-3) unstable; urgency=medium
+
+ [ Jean-Michel Vourgère ]
+ * Have apache2.postrm removes content of /var/lib/apache2, not the
+ directory itself. Closes: #793862
+ * d/p/reproducible_builds.diff: Sort exported symbols list.
+
+ [ Stefan Fritsch ]
+ * apxs: Don't pass --silent to libtool. Closes: #795820
+ * Remove default /var/www/html/index.html on package purge.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 18 Aug 2015 13:49:09 +0200
+
+apache2 (2.4.16-2) unstable; urgency=medium
+
+ * Make dh_apache2 add a versioned dependency on apache2-bin, for the
+ new symbols required for the CVE-2015-3185 fix.
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 07 Aug 2015 23:43:16 +0200
+
+apache2 (2.4.16-1) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * New upstream version, fixing the following security issues:
+ + CVE-2015-3183: Fix chunk header parsing defect.
+ + CVE-2015-3185: ap_some_auth_required() broken in apache 2.4 in an
+ unfixable way. Add a new replacement API ap_some_authn_required()
+ and ap_force_authn hook.
+
+ [ Jean-Michel Vourgère ]
+ * Allow "triggers-awaited" and "triggers-pending" states in addition to
+ "installed" when determining whether to defer actions or process
+ deferred actions. Thanks Colin Watson. Closes: #787103
+ * Allow a2dismod cgi on threaded mpms. Thanks Raul Dias. Closes:
+ #733979
+ * Remove pre-Jessie transition scripts, and remaining breaks.
+ * Made builds reproducible: d/rules set the date from the changelog in
+ CPPFLAGS, new reproducible_builds.diff patch to use it.
+ * Moved bash_completion from /etc to /usr/share/bash_completion. Added
+ links there for dynamic loading.
+ * Upgrade security.conf comments to 2.4 auth format. Thanks Werner
+ Detter. Closes: #789788
+ * apache2.postinst: Fixed tests on deferred mpm switch. Closes:
+ #789914
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 02 Aug 2015 00:44:07 +0200
+
+apache2 (2.4.12-2) unstable; urgency=medium
+
+ [ Jean-Michel Nirgal Vourgère ]
+ * d/control:
+ + Update Vcs-Browser.
+ * d/copyright:
+ + Change d/debhelper/dh_apache2 to dh_apache2.in.
+ + Drop paragraph about inexistant itk patches.
+
+ [ Stefan Fritsch ]
+ * Remove all the transitional packages:
+ apache2-mpm-worker, apache2-mpm-prefork, apache2-mpm-event,
+ apache2-mpm-itk, apache2.2-bin, apache2.2-common,
+ libapache2-mod-proxy-html, libapache2-mod-macro, apache2-suexec
+ This also fixes the dependency problems caused by a recent version
+ of debhelper (see #784803).
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 11 May 2015 22:07:26 +0200
+
+apache2 (2.4.12-1) unstable; urgency=medium
+
+ * New upstream version
+ * Add a patch for CVE-2015-0253 which was introduced in 2.4.11 which
+ was never shipped in Debian.
+ * Ship mod_proxy_html's default config file. Closes: #782022
+ * Fix typo in dh_apache2 man page. Closes: #781032
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 28 Apr 2015 22:54:41 +0200
+
+apache2 (2.4.10-11) unstable; urgency=medium
+
+ * core: Fix -D[efined] or <Define>[d] variables lifetime accross restarts.
+ This could cause all kinds of strange behavior. PR 56008. PR 57328
+ * mpm_event: Fix process deadlock when shutting down a worker. PR 56960
+ * mpm_event: Fix crashes due to various race conditions. Closes: #779078
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 31 Mar 2015 22:27:16 +0200
+
+apache2 (2.4.10-10) unstable; urgency=medium
+
+ * CVE-2015-0228: mod_lua: Fix denial of service vulnerability in
+ wsupgrade().
+ * Fix setup-instance example script to handle a2enconf/a2disconf.
+ LP: #1430936
+ * Tweak mention of mod_access_compat in NEWS.Debian. The module does
+ not really work in practice.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 15 Mar 2015 10:47:36 +0100
+
+apache2 (2.4.10-9) unstable; urgency=medium
+
+ * CVE-2014-8109: mod_lua: Fix handling of the Require line when a
+ LuaAuthzProvider is used in multiple Require directives with different
+ arguments.
+ * Include ask-for-passphrase script from Ubuntu with some tweaks. This
+ fixes asking for certificate passphrases if started via systemd.
+ Closes: #773405
+ * Fix init script to not wait 20s if passphrase was wrong.
+ * Also bump debhelper build-depends to get dh_installdeb with support for
+ symlink_to_dir. Closes: #770421
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 22 Dec 2014 20:24:36 +0100
+
+apache2 (2.4.10-8) unstable; urgency=medium
+
+ * Bump dpkg Pre-Depends to version that supports relative symlinks in
+ dpkg-maintscript-helper's symlink_to_dir. Closes: #769821
+ * mod_proxy_fcgi: Fix potential denial of service by malicious fcgi
+ script. (CVE-2014-3583). Fix similar bug in mod_authnz_fcgi even
+ though it does not seem to be exploitable.
+ * mpm_event: Fix use-after-free that may lead to a server crash.
+ * mod_ssl: Fix memory leak on graceful restart. Closes: #754492
+ * mod_ssl: Avoid crashes during startup or graceful restart due to
+ openssl using a callback to invalid memory. LP: #1366174
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 18 Nov 2014 15:18:18 +0100
+
+apache2 (2.4.10-7) unstable; urgency=medium
+
+ * Handle transitions of doc dirs and symlinks correctly during upgrade.
+ Use dpkg-maintscript-helper for this and remove existing explicit logic.
+ Closes: #767850
+ * Remove obsolete conffiles in apache2.2-common, instead doing this only in
+ apache2. This partially fixes #768815
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 09 Nov 2014 19:03:30 +0100
+
+apache2 (2.4.10-6) unstable; urgency=medium
+
+ * Disable SSLv3 in default config. Closes: #765347
+ * Pull changes from upstream 2.4.x branch up to r1632831
+ - Fixes an LDAP regression in 2.4.10
+ - mod_cache: Avoid sending 304 responses during failed revalidations.
+ PR 56881
+ - mod_status: Honor client IP address using mod_remoteip. PR 55886
+ * Fix typo in package description. Closes: #765500
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 21 Oct 2014 22:42:06 +0200
+
+apache2 (2.4.10-5) unstable; urgency=medium
+
+ * Remove one forgotten instance of ident.load in the preinst.
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 10 Oct 2014 00:20:09 +0200
+
+apache2 (2.4.10-4) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * Make apache2 depend on apache2-utils. This got lost somewhere in the
+ 2.4 update.
+ * Fix possible installation failure because of broken preinst script.
+ Closes: #764498
+ * Improve package descriptions. Closes: #763676
+
+ [ Arno Töll ]
+ * Add proper return codes to fail() conditions in a2query. Thanks to Ondřej
+ Surý for providing a patch.
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 09 Oct 2014 22:19:12 +0200
+
+apache2 (2.4.10-3) unstable; urgency=medium
+
+ * CVE-2014-3581: Fix a DoS in mod_cache.
+ * If apache2 is not configured yet, defer actions executed via
+ apache2-maintscript-helper. This fixes installation failures if a
+ module package is configured first. Closes: #745834
+ * Don't use a2query in preinst, as it may not be available yet.
+ Closes: #745812
+ * Include mod_authnz_fcgi. Closes: #762908
+ * Add some comments about SSLHonorCipherOrder in ssl.conf. Closes: #746359
+ * Remove misleading sentence in apache2-bin's description. Closes: #762645
+ * Remove trailing space in apache2/suexec/www-data. Closes: #719930
+ * Add NEWS entry for the logrotate change in 2.4.10-2.
+ * Bump Standards-version (no changes).
+ * Fix lintian warning: Tweak licence short names in copyright file.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 28 Sep 2014 22:37:02 +0200
+
+apache2 (2.4.10-2) unstable; urgency=medium
+
+ * Pull changes from upstream 2.4.x branch up to r1626207
+ + Security Fix for CVE-2013-5704: HTTP trailers could be used to
+ replace HTTP headers late during request processing, potentially
+ undoing or otherwise confusing modules that examined or modified
+ request headers earlier.
+ Adds "MergeTrailers" directive to restore legacy behavior.
+
+ * Switch to apache2 providing the httpd and httpd-cgi virtual packages.
+ The previously providing apache2-bin package lacks the configuration
+ files. Closes: #756361
+ * Keep fewer logs by default. Instead of 52 weekly logs, keep 14 daily
+ logs. The daily graceful restart also has the advantage of regenerating
+ things like TLS session ticket keys more often. Closes: #759382
+ * Clarify description of apache2 package. Closes: #755976
+ * In the maintainer script helper, print out Apache's error message if
+ the config check fails.
+ * Re-add mod_ident. It has still at least one user. LP: #1333388
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 21 Sep 2014 22:58:33 +0200
+
+apache2 (2.4.10-1) unstable; urgency=medium
+
+ [ Arno Töll ]
+ * New upstream version
+ + Refresh debian/patches/fhs_compliance.patch
+ + Security Fixes:
+ - CVE-2014-0117 mod_proxy: Fix DoS that could cause a crash
+ - CVE-2014-0226 Fix a race condition resulting in a heap overflow in
+ scoreboard handling
+ - CVE-2014-0118 mod_deflate: The DEFLATE input filter now limits the
+ length and compression ratio of inflated request to mitigate a
+ possible DoS
+ - CVE-2014-0231 mod_cgid: Fix a denial of service against CGI scripts
+ + Fixes SNI with certificate defined in global scope. (Closes: #751361)
+ * Warn users if they try to disable modules that we consider essential for
+ operation of the Apache web server (Closes: #709461)
+ * Drop libcap from our build-dependencies. That was needed for itk which we
+ gave source out to it's own package again.
+ * Provide apache2.2-common package to avoid upgrading problems for people
+ using --purge (apt) or --purge-unused (aptitude) even though that's
+ clearly discouraged. This caused disappearing of conffiles because we move
+ them from apache2.2-common to apache2 during the upgrade. Ugh. This was
+ not a bug in our packaging, but an unfortunately people blame us
+ nonetheless even though it's not all our fault. This alternative helps
+ those people, but at the same time means that incompatible modules aren't
+ force-removed by dpkg during the upgrade. Hopefully we catch all of them
+ with the Breaks relation coming along (Closes: #716880, #752922, #711925)
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 22 Jul 2014 23:16:20 +0200
+
+apache2 (2.4.9-2) unstable; urgency=medium
+
+ * Fix logic in postinst to detect existing index.* files in both
+ DocumentRoots, the old /var/www and the new /var/www/html. Also
+ change the compiled in default DocumentRoot to /var/www/html.
+ Closes: #743915
+ * Fix buffer overflows in suexec with very long (unix) usernames. Not
+ exploitable due to FORTIFY_SOURCE. And creating users usually requires
+ root privileges, anyway. Thanks to Luca Bruno for the report.
+ * Remove conflicts of mpm modules with mpm_itk, which isn't an mpm
+ anymore. Fixes a part of: #734865. libapache2-mpm-itk needs a fix, too.
+ * Remove obsolete warning in a2enmod about mpm-itk.
+ * Fix lintian warning: Remove image ref to w3.org, which is a privacy
+ breach.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 08 Jun 2014 10:38:04 +0200
+
+apache2 (2.4.9-1) unstable; urgency=medium
+
+ * New upstream version.
+ Security fixes:
+ - CVE-2013-6438: mod_dav: Fix DoS from crafted DAV WRITE requests.
+ - CVE-2014-0098: mod_log_config: Fix segfaults when logging truncated
+ cookies.
+ Notable new features:
+ - Support named groups and backreferences within the LocationMatch,
+ DirectoryMatch, FilesMatch and ProxyMatch directives.
+ - mod_proxy: Added support for unix domain sockets as the backend server
+ endpoint.
+ - mod_ssl: Add support for OpenSSL configuration commands by introducing
+ the SSLOpenSSLConfCmd directive.
+ - mod_authz_user, mod_authz_host, mod_authz_groupfile, mod_authz_dbm,
+ mod_authz_dbd, mod_authnz_ldap: Support the expression parser within the
+ require directives.
+ - mod_rewrite: Add RewriteOptions InheritDown, InheritDownBefore,
+ and IgnoreInherit.
+ - Bugfix in the build system to avoid problems with patched config.m4
+ files as in LP #1251939.
+ * Make default cipher list in ssl.conf more secure:
+ - Remove 'MEDIUM'. This disables RC4 and SEED. Also remove '!MD5' because
+ 'HIGH' does not include MD5.
+ - Remove the 'Speed-optimized SSL Cipher' configuration example because
+ it depends on RC4, which is considered insecure.
+ * Change init script short description to describe the service, not the
+ script. Closes: #738315
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 29 Mar 2014 22:50:32 +0100
+
+apache2 (2.4.7-1) unstable; urgency=low
+
+ New upstream version
+
+ [ Stefan Fritsch ]
+ * In logrotate and init script, don't hardcode path to htcacheclean.
+ Instead, put sbin directories in PATH. Also fix one missed reference
+ to disk_cache.load, missed in 2.4.6-3. Really closes: #718909
+ * Remove possiblity to override path to apache2 executable via envvars.
+ This is no longer necessary with MPMs as modules.
+ * Fix typo in serve-cgi-bin.conf. Closes: #723196
+ * Bump Build-Depends. 2.4.7 requires apr 1.5.
+
+ [ Arno Töll ]
+ * Fix "No default site enabled after fresh install if /etc/apache2
+ exists" by using a condition in preinst which actually works as expected.
+ Thanks to Jean-Michel Vourgère for triaging the issue and providing a
+ patch (Closes: #711493).
+ * Leave a2disconf with rc=0 when purging a configuration which does not
+ exist. (Closes: #718166)
+ * Explicitly express the dependency for mod_access_compat depending on
+ authn_core. Thanks Jean-Michel Vourgère for providing a patch (Closes:
+ #710412)
+ * Allow "apache2_invoke disconf" in postinst/preinst (Closes: #717693)
+ * Rework the default index.html file. Instead of a blank, minimalistic page
+ give a quick start guide, since nobody seems to read our docs. This site
+ is hopefully explaining the most important questions.
+ * Add a virtual provides line to the itk/worker/event/prefork transitional
+ packages so that people with an unusual (unsupported) Apache setup
+ can upgrade neatless in some corner cases (Closes: #728937)
+ * Drop the Apache ITK patches. The Apache ITK MPM is a standalone package
+ now and will be provided by libapache2-mpm-itk in future. The
+ apache2-mpm-itk package depends on this package from now on. Users of itk
+ are advised to consult the itk manual.
+ This also resolves a build-system problem that caused mod_unixd to be
+ initialized twice. (LP: #1251939)
+ * Remove Steinar H. Gunderson from uploaders, he will continue to support
+ itk in his own package in future. The remaining Apache team thanks Steinar
+ for all the work in the past.
+ * Change the Default Document root directory where files are served from
+ (Closes: #730372).
+ * Add GPG support to our watch file. Thanks to Daniel Kahn Gillmor
+ for this suggestion and for providing a patch (Closes: #732450)
+ * Refresh suexec-custom.patch.
+
+ -- Arno Töll <arno@debian.org> Thu, 02 Jan 2014 00:17:56 -1100
+
+apache2 (2.4.6-3) unstable; urgency=low
+
+ * Fix 'implicit declaration' compiler warnings.
+ * Fix module dependencies in lbmethod_*.load files. Closes: #717910
+ LP: #1205314
+ * Mark apache2-data as Multi-Arch: foreign. Closes: #718387
+ * Backport open_htaccess hook from upstream 2.4.x branch to allow
+ building mpm-itk as separate package.
+ * Improve comment for LogLevel in apache2.conf. Closes: #718677
+ * Fix comment in ports.conf. Closes: #718650
+ * Fix htcacheclean path and function name in init script. Closes: #718909
+ * Enable bindnow hardening compiler option, patch by Felix Geyer.
+ Closes: #714872
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 12 Aug 2013 20:15:38 +0200
+
+apache2 (2.4.6-2) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * Fix watch file
+ * Don't pass --silent to libtool, allowing blhc to check the compiler
+ options in the build logs.
+
+ [ Arno Töll ]
+ * Allow third party packages to use triggers if they use them in a
+ maintainer script invoking apache2-maintscript-helper (Closes: #717610)
+
+ -- Arno Töll <arno@debian.org> Tue, 23 Jul 2013 13:25:30 +0200
+
+apache2 (2.4.6-1) unstable; urgency=low
+
+ New upstream release:
+ * CVE-2013-1896: mod_dav: Fix a denial of service via MERGE request
+ (Closes: #717272)
+ * New modules mod_cache_socache, mod_proxy_wstunnel.
+ * mod_ssl: Add support for subjectAltName-based host name checking in proxy
+ mode (SSLProxyCheckPeerName).
+ * mod_lua: Many new functions.
+ * mod_auth_basic: Add a generic mechanism to fake basic authentication
+ using the ap_expr parser (AuthBasicFake).
+ * mod_proxy: New BalancerInherit and ProxyPassInherit options.
+ * mod_authnz_ldap: Allow using exec: calls to obtain LDAP bind password.
+
+ [ Arno Töll ]
+ * Document our security model in our NEWS file and highlight we do not allow
+ access to /srv. Thanks to joeyh for pointing this out.
+ * Allow the use of apache2-maintscript-helper from a sub-function. We rely
+ on dpkg's arguments supplied in $1, $2 etc. This clashes with function
+ arguments supplied to to sh sub-function. Allow manual override in such
+ cases.
+ * Mention that the dh_apache2 conditional must be present in postrm too
+ (Closes: #716694)
+ * Fix "dh_apache2 ignores alternative httpd on conf files" by correctly
+ checking the supplied arguments, we were off by one (Closes: #717299).
+ * Reinstall index.html also on upgrades as it is removed during upgrades.
+ * Add mod_macro transitional package as it was promoted to core and does not
+ exist as individual package anymore (Closes: #706962)
+
+ [ Stefan Fritsch ]
+ * Don't fail package upgrade or removal just because the configuration is in
+ an inconsistent state (Closes: #716921, #717343, LP: #1202653).
+ * Improve error output of init script.
+ * Fix broken dependency information in several *.load files.
+ * Add mod_authn_core as dependency of the mod_auth_* modules.
+ (Closes: #717448)
+
+ -- Arno Töll <arno@debian.org> Sun, 21 Jul 2013 18:44:42 +0200
+
+apache2 (2.4.4-6) unstable; urgency=low
+
+ * Denote exact versions breaking gnome-user-share now that Gnome maintainers
+ have a fixed version in the works. That makes Gnome installable again.
+ * Update our gbp.conf for our big merge next -> master. The eagle has
+ landed, 2.4 is here.
+ * Push Standards version to 3.9.4 - no changes needed.
+ * Fix spelling errors in man pages.
+ * Update the git VCS pointer to its canonical location for anonymous
+ checkouts.
+ * Boost the description for the LSB init script to appease Lintian.
+ * Fix spurious warnings in the Apache2 bug report script (Closes: #711121,
+ #711480)
+ * Strip off file extensions from arguments to a2(en|dis)(site|conf|mod) so
+ that "a2ensite 000-default.conf" works, as well as "a2ensite 000-default"
+ (Closes: #711494)
+ * Fix "apache2-dev: dh-apache2 does not strip .conf extension" for modules
+ relying on the install heuristic, instead of writing an *.apache2 conf
+ file (Closes: #711483)
+ * Apply patch submitted by Robert Luberda and redirect all output of
+ apache2-maintscript-helper to stderr (Closes: #711478)
+ * Tell about essential operations in the init script (Closes: #711120)
+ * Fix indentation mess in the init script, and add modelines
+ * Make sure /etc/init.d/apache2 reload does not always return. Thanks to
+ Thorsten Glaser for suggesting a patch (Closes: #711117)
+ * Make apache2-maintscript-helper usable when sourced from weird
+ environments (e.g. Perl maintainer scripts). Thanks to Robert Luberda
+ for doing unexpected things, and providing patches for it, and to Axel
+ Beckert for demangling shell specifics (Closes: #711479)
+ * Fix "copyright file missing after upgrade (policy 12.5)" and add these for
+ MPM transitional packages (Closes: #710914)
+ * Fix "apache2.2-bin transitional package (binaries only) should not
+ depend on apache2 package (which runs a system daemon)". This happened by
+ accident added by debhelper since we are linking docs. We do to
+ apache2-bin instead (Closes: #711127)
+ * Refresh "upstream-fixes" patch
+ * Fix "Disabling strtoul violates C89 and C99 and is unnecessary" by
+ removing the symbol override in httpd.h(Closes: #711534)
+
+ -- Arno Töll <arno@debian.org> Fri, 07 Jun 2013 19:14:36 +0200
+
+apache2 (2.4.4-5) unstable; urgency=low
+
+ [ Arno Töll ]
+ * Fix compile issue on kfreebsd.
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 31 May 2013 10:19:18 +0200
+
+apache2 (2.4.4-4) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * Upload to unstable.
+ * Fix FTBFS on hurd caused by mpm-itk linking fix.
+ * Fix some lintian warnings:
+ - fix pod error
+ - add overrides for hardening-no-fortify-functions
+ - don't use /lib/init/vars.sh in init script
+ * Add note to README.Debian about CVE-2013-0966 if the document root is
+ on HFS+ or on ZFS with filename normalization.
+ * Add a note to README.Debian about how to change the max file limit.
+ Make apache2ctl print a message pointing to README.Debian if setting
+ the limit fails. (Closes: #706822)
+
+ [ Arno Töll ]
+ * Correct maintainer scripts by removing forgotten left-overs of our Squeeze
+ -> Wheezy renaming
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 30 May 2013 17:25:09 +0200
+
+apache2 (2.4.4-3) experimental; urgency=low
+
+ [ Arno Töll ]
+ * libapache2-mod-proxy-html is included in Apache 2.4 and not packaged
+ separately anymore. Thus, we are using the most recent version available
+ now (Closes: #695482).
+ * Fix "typo in mpm_event.load" by applying the patch provided by Bastian
+ Triller. Thanks (Closes: #704639)
+ * Replace some occurrences of "Squeeze" in our scripts. It's Wheezy time.
+ * Changes in dh_apache2:
+ + Add -e|--noenable option to dh_apache2 (Closes: #681544)
+ + Disable scripts in prerm, not postrm (Closes: #681546)
+ + However, still hook into postrm and purge state when required
+ + Call the postinst code always, not only during configure
+ (Closes: #681545)
+ + Fix "dh_apache2 postinst code needs to reload more" and reload the
+ web-server in postinst when upgrading (Closes: #702929)
+ * Let a2enmod purge state when calling -p for already disabled
+ configurations.
+ * Fix "don't assume apache2 is running 24 hours a day when rotating
+ logs": Only restart the webserver when it was previously running
+ (Closes: #707892)
+ * Properly return the conf/site configuration fragments enabled for Apache
+ when queried from a2query (Closes: #683212)
+ * Fix "/etc/init.d/apache2 start and restart need to wait until really
+ started" (Closes: #645460)
+ * Fix "apxs2 outputs "uninitialized value" warnings" by removing the double
+ declaration of variables in apxs. This problem was harmless, but noisy
+ (Closes: #707109)
+ * Make the DEBIAN_VERSION parsing in debian/rules more robust. Thanks to
+ Ondřej Surý for noticing and providing a patch.
+ * Fix "copyright file missing after upgrade (policy 12.5)" by linking to the
+ apache2 doc-dir when upgrading (Closes: #707795)
+
+ [ Stefan Fritsch ]
+ * Backport various fixes from upstream svn branch '2.4.x'.
+ * Remove paragraph about MaxMemFree in README.Debian. The issue should be
+ fixed in 2.4.
+ * Enable mod_authn_core when upgrading from wheezy (Closes: #702866)
+ * Bump libaprutil1-dev build dependency to get support for bcrypt password
+ hashes.
+ * Fix mod_mpm_itk.so not being linked to libcap.so (Closes: #702475)
+ * Make apache2-dev not depend on apache2.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 28 May 2013 22:47:26 +0200
+
+apache2 (2.4.4-2) experimental; urgency=low
+
+ * The "let's shorten up this discussion" release, and strip changelogs which
+ are not a direct ancestor of the 2.4 branch.
+ * Restart the server on upgrades. We need to make sure the new binary is
+ loading all symbols from the core again to make sure, upgrades don't break
+ the server.
+
+ -- Arno Töll <arno@debian.org> Sat, 09 Mar 2013 02:02:08 +0100
+
+apache2 (2.4.4-1) experimental; urgency=low
+
+ * New upstream release
+ - Fixes mod_log_forensic logging spurious '-' characters. Closes: #693292
+ - Responds with HTTP/1.0 when talking http to https port. Closes: #701117
+ - Fix various XSS flaws in modules (CVE-2012-3499, CVE-2012-4558)
+
+ [ Stefan Fritsch ]
+ * Add examples for X-Content-Type-Options and X-Frame-Options to
+ security.conf.
+ * Make dh_apache2 only accept shell function names as conditional, to avoid
+ problems with shell and sed special characters.
+ * Add Replaces for the old mpm packages to apache2-bin. Closes: #671683
+ * Add transitional package for libapache2-mod-proxy-html. Closes: #666816
+ - Override dh_gencontrol so that the package's version sorts later than
+ the existing version in Wheezy.
+ * Don't ship changelogs in the apache2.2-bin transitional package.
+ * CVE-2013-1048: Fix symlink vulnerability when creating /var/lock/apache2
+
+ [ Arno Töll ]
+ * Rewrite most parts of the init script to make it more readable and improve
+ visual feedback when fancy output is in use.
+ * Drop the dbmanage tool from apache2-utils. It is mostly unmaintained and
+ outdated. Users of mod_authn_dbm should use htdbm instead.
+ * Fix "Default /etc/apache2/mods-available/disk_cache.conf is incompatible
+ with ext3" by changing the default to more moderate values. Note, some file
+ systems have a hard limit of supported subdirectories (Closes: #682840).
+ Ported from our 2.2 tree targeted for Wheezy.
+ * Properly check return code of a2query in the apache2_invoke library
+ function. This caused reverse dependencies to fail for newly installed
+ modules previously.
+ * Implement -q (quiet) option for a2query (Closes: #681541).
+ * Properly honor -p/-N options as understood by debhelper (Closes: 681542).
+ Thanks Russ Allbery for the hint.
+ * Be more careful regarding link attacks when for the the cache disk
+ directory.
+ * Compress the data.tar in binary packages using xz to save some space on
+ installation medias (Debian only).
+ * Fix "invoke-rc.d apache2 status fails" by merging patch of Jean-Michel
+ Vourgère. Thanks! (Closes: #691365)
+ * Fix "copyright file missing after upgrade (policy 12.5)" - add link
+ manually when necessary in postinst (Closes: #691440)
+ * Document APACHE_ARGUMENTS in envvars (ported from our 2.2 branch, reported as #693299)
+ * Don't croak about lacking permissions in apache2ctl when the script is
+ executed as a non-privileged user
+
+ [ Bernhard R. Link ]
+
+ * Rearrane patches: Move all the patches or parts of patches touching non-itk
+ specific files (i.e. those from the upstream tarball) directly in the
+ debian/patches/series series. While this seperates the itk patches into two
+ heaps, it makes both more visible what changes happen to the general code (and
+ thus are also done to the other servers generated)
+
+ -- Arno Töll <arno@debian.org> Thu, 07 Mar 2013 01:24:51 +0100
+
+apache2 (2.4.2-2) experimental; urgency=low
+
+ [ Stefan Fritsch ]
+ * Explicitly enable mod_authz_core on upgrades. It can happen that it is
+ not pulled in by any of the enabled modules, but we need it in any case
+ for apache2.conf. Closes: #669876
+ * Don't ship the changelogs in the apache2-mpm-itk transitional package.
+
+ [ Arno Töll ]
+ * Add mode lines to various configuration files and scripts. Reformat
+ configuration files for consitency.
+ * Fix "Fix typographic errors in configuration file comments": Thanks to Oxan
+ van Leeuwen for providing a patch (Closes: #669269)
+ * Formulate several clarifications in PACKAGING, start versioning this document
+ and add normative read hints. Moreover, document the -m switch for a2enmod.
+ * Merge spelling and grammar fixes provided by Justin B Rye. Much appreciated!
+ * Change various state and run directories used by Apache from
+ /var/run/<basename> to /var/run/apache2/<basename>. This might change again
+ for Wheezy+1 to adopt /run.
+ * Use more exit status codes for a2query which allows to tell apart why a
+ module was disabled, also make its output more readable.
+ * Changes in apache2-maintscript-helper:
+ + Finally apache2_invoke may behave correctly and catch all cases
+ including upgrades from Squeeze.
+ + apache2_invoke: accepts a third argument to override the rc.d-action now
+ + support APACHE2_MAINTSCRIPT_DEBUG: When defined in the environment or in
+ /etc/apache2/envvars, debug output is displayed.
+ * Implement a -r switch for dh_apache2 which allows to force a reload of the
+ web server if required.
+
+ -- Arno Töll <arno@debian.org> Mon, 28 May 2012 17:36:03 +0200
+
+apache2 (2.4.2-1) experimental; urgency=low
+
+ * New upstream release
+
+ [ Arno Töll ]
+ * Drop update-alternative call in postrm. Our prerm script catches them
+ already anyway.
+ * Update my mail address.
+ * Fix "dh_apache2 does not set "x" bits on /usr/lib/apache2/modules/"
+ Set directory permissions to 755 by default (Closes: #666875). Thanks Axel
+ Beckert for the hint.
+ * Add /usr/share/doc/apache2/migrate-sites.pl, a script to assist users to
+ give sites a .conf suffix, add a hint to the NEWS file.
+ * Do stateful configuration handling by remembering who enabled when a
+ particular piece of configuration. That way in can be told under which
+ circumstances for example modules should be re-enabled. Thanks to Filip M.
+ Nowak who was providing a patch where my changes are built upon.
+ * Fix apxs to import LDFLAGS from config_vars.mk. Moreover, make it possible
+ to override LDFLAGS at compile time by defining LDLAGS in the environment,
+ just like it is possible for CFLAGS. This also means, config_vars.mk now
+ exports hardening build flags by default.
+ * Provide the virtual packages httpd and httpd-cgi again.
+
+
+ [ Stefan Fritsch ]
+ * Change default config to deny access to / in the file system and only
+ allow access to /var/www, /usr/share, and /usr/lib/cgi-bin. Closes: #341022
+ * Disable MultiViews in the default config.
+ * Update ssl default cipher config, add alternative speed optimized config.
+ Closes: #649020
+ * Move the configuration of /usr/lib/cgi-bin into a separate config file.
+ Closes: #589638
+ * Comment out per-vhost loglevel.
+ * Add section to security.conf that shows how to forbid access to VCS
+ directories. Closes: #548213
+ * Change the compiled in default of DocumentRoot to /var/www by updating
+ fhs_compliance.patch
+ * Re-add mpm_itk (version 2.4.1-pre01). This is still very experimental!
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 15 Apr 2012 20:50:28 +0200
+
+apache2 (2.4.1-3) experimental; urgency=low
+
+ [ Arno Töll ]
+ * apache2-suexec-{custom,pristine}: Fix argument order when removing
+ alternatives, do not remove alternatives on upgrades. Thanks Andreas
+ Beckmann for spotting the issue (Closes: #665002)
+ * Install suexec(8) link to /usr/share/man/man8/...
+ * Enable mod_version statically, drop associated module load file.
+ * Update PACKAGING hints and cope several questions raised among the
+ discussions with packagers. Thus, invocation of apache2-maintscript-helper
+ in maintainer scripts are covered now.
+ * Changes in dh_apache2:
+ + Invoke the maintscript helper postrm action for simple package removals,
+ too.
+ + Fix a bug which accidentally called "en{mod,site,conf}" instead of
+ "di{mod,site,conf}"
+ + Set the default conditional back to "true", now the maintainer script is
+ expected to cope itself with upgrades correctly
+ * Changes in apache2_maintscript_helper
+ + Provide apache2_action_needed, apache2_msg
+ + Parse maintainer script arguments to find out which script called us
+ + Support APACHE2_MAINTSCRIPT_HELPER_QUIET which, when set, omits any
+ visible output
+ + Break APIs: apache2_invoke accepts a single configuration file argument
+ only now. However, other than dh_apache2 no users of this feature were
+ known.
+ * Build the apache2.2-bin transitional package again, without it updates from
+ Squeeze are broken from some use cases
+ * Remove 2.2's postrm script only if we're actually upgrading.
+ This previously didn't have bad side-effects, but caused a disturbing
+ warning.
+
+ [ Stefan Fritsch ]
+ * Import lots of bug fixes from upstream svn: All code changes from branch
+ 2.4.x up to r1307835, plus r1294306 and r1307067 from trunk.
+ * CVE-2012-0216: Remove /usr/share/doc alias from default virtual hosts'
+ configs.
+ * Add 'Multi-Arch: foreign' to apache2-utils
+ * Make a2enconf and a2ensite warn if dependencies are not fullfilled.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 01 Apr 2012 21:11:51 +0200
+
+apache2 (2.4.1-2) experimental; urgency=low
+
+ [ Arno Töll ]
+ * Shift convert_docs script to a arch-indep target only. Debhelper does not
+ build apache2-doc on binary only builds causing a FTBS on binary-only (-B)
+ builds
+ * Raise debhelper build-dependency to 8.9.7~ due to the use of arch-indep
+ targets
+
+ [ Stefan Fritsch ]
+ * dh_apache2: Make autoscripts only run on upgrades by default. Bump
+ debhelper dependency of apache2-dev. Escape slashes in conditionals.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 20 Mar 2012 21:32:43 +0100
+
+apache2 (2.4.1-1) experimental; urgency=low
+
+ * Package the coming up 2.4 branch of Apache by packaging the current
+ GA release 2.4.1.
+ + Fix "IndexIgnore only allowes to add in vhost context, not replace"
+ (Closes: #296886)
+ + Fix "mod_status stats are wrong." (Closes: #519322)
+ + Fix "PNG DirectoryIndex icons transparancy messed up" (Closes: #233047)
+ + Fix "apache2-common: there should be a possibility to access the
+ parsed configuration" (Closes: #350285)
+ + Fix "AddOutputFilterByType is deprecated but used in deflate.conf"
+ (Closes: #601033)
+ + Fixes "Renegotiation on POST request fails intermittently"
+ (Closes: #601606)
+ + Allows configuring source address for proxy requests. (Closes: #465283)
+ + Supports CONNECT request through https. (Closes: #307298)
+ + New Upstream (2.4). (Closes: #662115)
+
+ * Refresh patches but leave all hunks unchanged where possible. Give all
+ * patches a ".patch" suffix, drop sequence numbers as they are not needed when
+ * using quilt. Notable changes are.
+ + [AT] 202_suexec-custom: Keep functionality as is, but rewrite smaller
+ parts of the patch to build two binaries: suexec-pristine and
+ suexec-custom (see below)
+ + [AT] 201_build_suexec-custom: Patch the makefile to build
+ "suexec-pristine" instead. Aside of that, refresh hunks.
+ + [AT] 010_fhs_compliance: Drop config.layout patches. These have been
+ applied upstream
+ + [JMV] Drop patches:
+ + 004_usr_bin_perl_0wnz_j00: printenv exemple doesn't refer to
+ /usr/local/bin/perl anymore
+ + 008_make_include_safe: Include doesn't support directory anymore.
+ Include dir/*.conf must be used.
+ + 009_apache2_has_dso: Upstream is no longer testing DSO is available. So
+ we don't need to remove that test anymore.
+ + [AT] customize_apxs.patch: Aggregate changes from various apxs2 patches,
+ drop obsolete hunks
+
+ [ Arno Töll ]
+
+ * Rewrite most parts of debian/rules / debhelper configuration.
+ + move cronjob and init script to debhelper configuration files
+ (apache2.cron.daily and apache2.init respectively)
+ + move man pages to debian/manpages
+ + Remove Ubuntu hacks in debian/rules, we expect them to carry Ubuntu
+ specifics in their own patch set, as it diverges already anyway.
+ + shake-up files installed in different packages
+ + Do not copy the source tree anymore, build package in place.
+ * Push standards version to 3.9.3 - no special changes required
+ * Refactor binary packages, now as things simplified. MPMs are simple
+ modules now, they can be bundled into the same binary package which do not
+ need to conflict with each other. Thus, Apache now primarily consists of the
+ following packages:
+ + apache2 - configuration files and init scripts, Debian specific helper
+ scripts
+ + apache2-bin - binaries and modules
+ + apache2-data - error pages and images
+ * Drop the ITK MPM entirely for now
+ * Consolidate development packages. As MPM packages are gone, we do not need
+ specific development packages either. Thus, drop all MPM specific apache2
+ development packages and provide a single apache2-dev package instead.
+ (Closes: #428095)
+ * Drop debian/source/options again: We do not need to ignore .svn directories
+ anymore since the new package management system is based on git and includes
+ the full source
+ * Rework the suexec mechanism. Now there are two suexec packages providing
+ alternatives through the update-alternatives mechanism. The untouched
+ upstream "suexec" binary is provided by the apache2-suexec-pristine package,
+ whereas the configurable suexec can be found in the apache2-suexec-custom
+ package. Both are providing the "suexec" binary which are managed by the
+ update-alternatives(9) mechanism.
+ This change is transparent to users at runtime and does not need any
+ configuration changes.
+ * Remove obsolete README.source file.
+ * Update doc-base metadata for the apache2-doc package
+ * Changes in the default configuration (not specific modules):
+ + On the head of the apache2.conf configuration file, give a short summary
+ how configuration of the Apache web server works in Debian.
+ + Drop NameVirtualHost entirely. It is deprecated (Closes: #511594)
+ + Remove DefaultType. It is deprecated.
+ + Replace Allow/Deny directives in the default configuration by using the
+ new Require directive. Load mod_access_compat if you rely on the old
+ syntax
+ + Replace LockFile by Mutex which consolidates all lock file
+ synchronization files among modules
+ + Update configuration to use the new IncludeOptional syntax
+ + Enable these modules by default: authz_core authz_host alias cgi dir
+ + Move MPM specific configuration to their respective configuration files.
+ Users can just load and unload MPMs like other modules, enable the worker
+ MPM by default
+ + Move per-site global configuration from conf.d to conf-available and
+ manage it similar to modules and sites. To do so, the new tools
+ "a2enconf" and "a2disconf" are provided. Moreover, such configuration
+ files need to have a .conf suffix now. The following configuration
+ files are enabled by default: charset localized-error-pages
+ other-vhosts-access-log security. These were enabled by default
+ previously, too (Closes: #620347, Closes: #605227).
+ This holds for apache2-doc as well, which is still enabled by default but
+ can be disabled easily anytime by using a2disconf (Closes: #604980).
+ + Give site configuration a .conf suffix, too. For example the default vhost
+ is called default.conf. Moreover, files without .conf suffix are ignored
+ upon startup. Please update your site links and confs. Also rename the
+ default vhost to 000-default.conf and don't do hacky things in a2enmod
+ anymore.
+ * Changes in a2enmod:
+ + Parse "Conflicts: " header to denote conflicts between modules which
+ cannot be loaded into the same Apache server.
+ + Remove dangling "module.conf" files, too. They were forgotten previously
+ if they existed and only the "module.load" file was removed.
+ + Extend the tool to support conf-available/conf-enabled directories (see
+ also configuration changes).
+ + Expect a .conf suffix for sites-enabled/sites-available configurations.
+ + Remove the default vhost special handling. Instead, we expect the default
+ host to be named appropripriately (for example 000-default.conf;
+ Closes: #605535).
+ * The following modules and associated configuration files were removed:
+ + mod_authz_default and mod_authn_default: Please use a proper
+ authentication module instead
+ + mod_mem_cache: Use mod_cache_disk instead
+ * The following modules and associated configuration files are provided (but
+ not enabled by default):
+ access_compat, allowmethods, authz_dbd, cache_disk, data, log_debug, lua
+ proxy_express, proxy_fcgi, proxy_fdpass, proxy_html, ratelimit, reflector
+ remoteip, request, session, session_cookie, session_crypto, session_dbd
+ (Closes: #400881)
+ * Provide a dh_apache2 debhelper which can be used by reverse dependencies to
+ install modules, module configuration files, site configuration files and
+ global configuration files which need to be registered to the Apache web
+ server.
+ Thus, dh_apache2 can be used for Apache web server modules and web
+ applications providing configuration files for Apache.
+ * Write apache2-maintscript-helper which packagers can use to interface in a
+ reliable way with the Apache 2 web server in maintainer scripts
+ * Document programming hints how to interface with the Apache 2 web server for
+ * packagers of web applications and module maintainer in
+ /usr/share/doc/apache2/PACKAGING.gz.
+ * Fix the watch file, thanks to Jean-Michel Vourgère for pointing out the
+ problem.
+ * Update debian/copyright and switch it to the copyright-format 1.0 (formerly
+ known as DEP5)
+
+ [ Stefan Fritsch ]
+
+ * Use "dh --with autotools_dev" instead of patching config.sub/config.guess.
+ * Only include conf.d/*.conf, not conf.d/*.
+ * Don't create httpd.conf anymore. Also, do a proper transition of existing
+ httpd.conf files to /etc/apache2/conf-available (Closes: #639383)
+ * Add "AddCharset" for .brf files in default mod_mime config.
+ (Closes: #402567)
+ * Update the README.Debian file
+
+ [ Jean-Michel Vourgère ]
+
+ * Update bash completion functions to reflect the new site setup. (Closes:
+ #657492)
+ * Migrate patches to DEP-3 format. For particular changes see the summary
+ above.
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 19 Mar 2012 10:46:02 +0100
+
+apache2 (2.2.22-3) unstable; urgency=low
+
+ * Fix "FTBFS: mkdir: cannot create directory `debian/build-tree/arch':
+ No such file or directory". Do not use internal rules targets which clash
+ with build target names ... (Closes: #667069)
+ * Drop apache2-dev virtual package. This had virtually no users but breaks our
+ experimental package in some cases (e.g. #666793)
+ * Push Standards version - no further changes
+ * Update my maintainer address
+
+ -- Arno Töll <arno@debian.org> Thu, 05 Apr 2012 13:21:42 +0200
+
+apache2 (2.2.22-2) unstable; urgency=low
+
+ [ Arno Töll ]
+ * Fix "Incorrect debhelper build dependency" by raising the build-dependency
+ of debhelper to 8.9.7 (Closes: #659148)
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 15 Mar 2012 00:02:31 +0100
+
+apache2 (2.2.22-1) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * New upstream release, urgency medium due to security fixes:
+ - Fix CVE-2012-0021: mod_log_config: DoS with '%{cookiename}C' log format
+ - Fix CVE-2012-0031: Unprivileged child process could cause the parent to
+ crash at shutdown
+ - Fix CVE-2012-0053: Exposure of "httpOnly" cookies in code 400 error
+ message.
+ * Move httxt2dbm to apache2-utils
+ * Adjust debian/control to point to new git repository.
+
+ [ Arno Töll ]
+ * Fix "typo in /etc/apache2/apache2.conf" (Closes: #653801)
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 01 Feb 2012 21:49:04 +0100
+
+apache2 (2.2.21-5) unstable; urgency=low
+
+ [ Arno Töll ]
+ * Fix build failures introduced as regregression by the previous build. Debian
+ buildds aren't rebuilding arch:all packages which caused problems for our
+ unconditional copying into binary package. I was warned.
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 29 Dec 2011 17:36:41 +0100
+
+apache2 (2.2.21-4) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+
+ * Security: Fix broken patch for CVE-2011-3607 (Integer overflow in
+ ap_pregsub).
+ * Optimize debian/rules again to improve build time by doing most work in a
+ single parallelized "build-%" target.
+
+ [ Arno Töll ]
+
+ * Fix "Suggest removing DefaultType from apache2.conf" change the DefaultType
+ from text/plain to None. This lets the browser guess a proper MIME type
+ instead of being forced to treat a given file according to our default type
+ (Closes: #440058)
+ * Fix "add pre-rotate hook to logrotate script" execute scripts in
+ /etc/logrotate.d/httpd-prerotate if available (Closes: #590096).
+ * Fix "Hide /icons index" Disables indexes on the icon directory. By upgrading
+ to Debian's 3.0/quilt source format also images don't need to be generated
+ at build time anymore. Hence, the icon date can no longer lead to
+ information disclosure (Closes: #649888).
+ * Upgrade package to 3.0/quilt.
+ + Remove uuencoded images, keep them in their binary format in debian/icons
+ + Upgrade to quilt from dpatch and refresh all patches by keeping all hunks
+ unchanged. Remove the `001_branding' patch by supplying -DPLATFORM at
+ build time where needed Move the 200_cp_suexec.dpatch patch and
+ 202_suexec-custom.dpatch patch to debian/rules. 200_cp_suexec.dpatch was a
+ script, not a patch which is not supported by quilt.
+ * Rewrite debian/rules and base it on dh(1).
+ + use overrides where possible, replace some debhelper calls by our own
+ implementation where needed. That's required since the Apache package is
+ compiled in parts several times for each MPM once.
+ + move some install operations to the their respective .install files
+ + Support dpkg-buildflags now, which also enables by default hardening
+ flags. Thus, remove them from their explicit appearance in debian/rules
+ + Remove DEB_BUILD_OPTIONS legacy support. It comes for free when using
+ dh(1)/dpkg-buildflags(1).
+ * Push debhelper compatibility to 8
+ * Remove unused Lintian overrides for the Debian source package remove and
+ redundant priorities in debian/control.
+ * Add myself to Uploaders
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 29 Dec 2011 12:09:14 +0100
+
+apache2 (2.2.21-3) unstable; urgency=medium
+
+ * Fix CVE-2011-4317: Prevent unintended pattern expansion in some
+ reverse proxy configurations. (Similar to CVE-2011-3368, but different
+ attack vector.)
+ * Fix CVE-2011-3607: Integer overflow in ap_pregsub could cause segfault
+ via malicious .htaccess.
+ * Mention dpkg-statoverride for changing permissions of suexec. LP: #897120
+ * Fix broken link in docs. Closes: #650528
+ * Remove Tollef Fog Heen, Thom May, and Peter Samuelson from uploaders.
+ Thanks for your work in the past.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 03 Dec 2011 18:54:03 +0100
+
+apache2 (2.2.21-2) unstable; urgency=high
+
+ * Fix CVE-2011-3368: Prevent unintended pattern expansion in some
+ reverse proxy configurations by strictly validating the request-URI.
+ * Correctly set permissions of suexec.load even if umask is 0002 during
+ build. LP: #872000
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 11 Oct 2011 22:54:47 +0200
+
+apache2 (2.2.21-1) unstable; urgency=low
+
+ * New upstream release.
+ - Fixes CVE-2011-3348: Possible denial of service in mod_proxy_ajp
+ if combined with mod_proxy_balancer
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 26 Sep 2011 18:16:11 +0200
+
+apache2 (2.2.20-1) unstable; urgency=low
+
+ * New upstream release.
+ * Fix some regressions related to Range requests caused by the CVE-2011-3192
+ fix. Closes: #639825
+ * Add build-arch and build-indep rules targets to make Lintian happy.
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 04 Sep 2011 21:50:22 +0200
+
+apache2 (2.2.19-2) unstable; urgency=high
+
+ * Fix CVE-2011-3192: DoS by high memory usage for a large number of
+ overlapping ranges.
+ * Reduce default KeepAliveTimeout from 15 to 5 seconds.
+ * Use "linux-any" in build-deps. Closes: #634709
+ * Improve reload message of a2enmod. Closes: #639291
+ * Improve description of the prefork MPM. Closes: #634242
+ * Mention .conf files in a2enmod man page. Closes: #634834
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 29 Aug 2011 17:08:17 +0200
+
+apache2 (2.2.19-1) unstable; urgency=low
+
+ * New upstream release.
+ - Makes apr-md5 the default algorithm for htpasswd, removing the 8
+ character limit of the crypt()-algorithm. Closes: #539246
+ - Fixes merging of IndexOptions. Closes: #394688
+ - Documents why order of ProxyPass and <Proxy> blocks matters in the
+ configuration. See "Workers" section in the mod_proxy documentation.
+ Closes: #560020
+ * For multiple instance setups, correctly determine the config dir in the
+ init script if it is called via a start/stop link. Closes: #627061
+ * Make a2enmod's restart hint more cut'n'paste friendly. LP: #770204
+ * Make it clear in README.multiple-instances that the MPMs are shipped
+ in the apache2.2-bin package.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 22 May 2011 10:21:21 +0200
+
+apache2 (2.2.17-3) unstable; urgency=low
+
+ * Fix compilation with OpenSSL without SSLv2 support. Closes: #622049
+ * Fix link errors with -no-add-needed/--no-copy-dt-needed-entries in
+ htpasswd/htdbm.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 10 Apr 2011 20:43:55 +0200
+
+apache2 (2.2.17-2) unstable; urgency=high
+
+ * New mpm_itk upstream version 2.2.17-01:
+ - Fix CVE-2011-1176: If NiceValue was set, the default with no
+ AssignUserID was to run as root:root instead of the default Apache user
+ and group, due to the configuration merger having an incorrect default
+ configuration. Closes: #618857
+ * Make exit code of '/etc/init.d/apache2 status' more LSB compatible.
+ Closes: #613969
+ * Set the default file descriptor limit to 8192 instead of whatever the
+ current limit is (usually 1024). Document how to change it in
+ /etc/apache2/envvars . Closes: #615632
+ * Fix typo in init script. Closes: #615866
+ * Add hint in README.Debian about 403 error with mod_dav PUT. Closes: #613438
+ * Remove some obsolete Depends and Replaces.
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 21 Mar 2011 23:01:17 +0100
+
+apache2 (2.2.17-1) unstable; urgency=low
+
+ * New upstream version
+ * Disable md5 in mod_ssl default cipher suite. Closes: #609126
+ * Fix order of comments in "worker" section in apache2.conf. Closes: #608488
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 15 Feb 2011 23:30:18 +0100
+
+apache2 (2.2.16-6) unstable; urgency=low
+
+ * Also add $named to the secondary-init-script example.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 01 Jan 2011 22:55:15 +0100
+
+apache2 (2.2.16-5) unstable; urgency=medium
+
+ * Add $named to the init script dependency header, since apache depends on
+ DNS in some configurations. Closes: #608437
+ * Update outdated description of /etc/apache2/magic in README.Debian.
+ Closes: #603586
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 31 Dec 2010 01:22:19 +0100
+
+apache2 (2.2.16-4) unstable; urgency=medium
+
+ * Increase the mod_reqtimeout default timeouts to avoid potential problems
+ with CRL-requesting browsers. Also extend the comments in reqtimeout.conf.
+ * Remove bogus comment in conf.d/security about default in the "release
+ after Lenny".
+ * Clarify comments in suexec-custom's default config file. LP: #673289
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 14 Nov 2010 19:05:55 +0100
+
+apache2 (2.2.16-3) unstable; urgency=high
+
+ * CVE-2010-1623: mod_reqtimeout: Fix potential DoS by high memory usage.
+ * Fix "Could not reliably determine the server's ..." error message in
+ README.Debian, to make it easier to search for it. Closes: #590528
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 09 Oct 2010 20:59:34 +0200
+
+apache2 (2.2.16-2) unstable; urgency=low
+
+ * Force -j1 for 'make install' to fix occasional FTBFS. Closes: #593036
+ * Add a note about the new behaviour of SSL/TLS renegotiation and the new
+ directive SSLInsecureRenegotiation to NEWS.Debian. Closes: #593334
+ * Support 'graceful' as alias for 'reload' in the init script.
+ * In README.Debian, suggest an Apache configuration change to get rid of the
+ "Could not reliably determine the server's fully qualified domain name"
+ warning, as alternative to changing DNS or /etc/hosts. Closes: #590528
+ * Add notes to README.Debian on how to reduce memory usage.
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 29 Aug 2010 15:29:21 +0200
+
+apache2 (2.2.16-1) unstable; urgency=medium
+
+ * Urgency medium for security fix.
+ * New upstream release:
+ - CVE-2010-1452: mod_dav, mod_cache: Fix denial of service vulnerability
+ due to incorrect handling of requests without a path segment.
+ - mod_dir: add FallbackResource directive, to enable admin to specify
+ an action to happen when a URL maps to no file, without resorting
+ to ErrorDocument or mod_rewrite
+ * Fix mod_ssl header line corruption because of using memcpy for overlapping
+ buffers. PR 45444. LP: #609290, #589611, #595116
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 24 Jul 2010 22:18:43 +0200
+
+apache2 (2.2.15-6) unstable; urgency=low
+
+ * Fix init script not correctly killing htcacheclean. Closes: #580971
+ * Add a separate entry in README.Debian about the need to use apache2ctl
+ for starting instead of calling apache2 directly. Closes: #580445
+ * Fix debug info to allow gdb loading it automatically. Closes: #581514
+ * Fix install target in Makefile created by apxs2 -n. Closes: #588787
+ * Fix ab sending more requests than specified by the -n parameter.
+ Closes: #541158
+ * Add apache2 monit configuration to apache2.2-commons examples dir.
+ Closes: #583127
+ * Build as PIE, since gdb in squeeze now supports it.
+ * Update the postrm script to also purge the version of /var/www/index.html
+ introduced in 2.2.11-7.
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 16 Jul 2010 23:41:08 +0200
+
+apache2 (2.2.15-5) unstable; urgency=low
+
+ * Conflict with apache package as we now include apachectl. Closes: #579065
+ * Remove conflicts with old apache 2.0 modules. The conflicts are not
+ necessary anymore as skipping a stable release is not supported anyway.
+ * Silence the grep in preinst.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 25 Apr 2010 10:46:09 +0200
+
+apache2 (2.2.15-4) unstable; urgency=low
+
+ * Move definition of other_vhosts_access.log to new config file
+ /etc/apache2/conf.d/other-vhosts-access-log, but disable it
+ if it has been disabled by the admin. Closes: #576572. LP: #507616
+ * Comment out the contents of mods-available/proxy.conf, as it just
+ is a nuisance for use of apache2 as a reverse proxy, which is much
+ more common than the use as forward proxy. Extend the comments
+ in the file.
+ * Change defaults or add example configs for some modules:
+ status.conf:
+ - enable ExtendedStatus by default
+ - enable ProxyStatus by default
+ - document SeeRequestTail directive
+ proxy_ftp.conf:
+ - set 'ProxyFtpDirCharset UTF-8' by default
+ ldap.conf:
+ - enable /ldap-status page, allow it from localhost by default
+ proxy_balancer.conf:
+ - add (disabled) example for /balancer-manager page
+ ssl.conf:
+ - document SSLStrictSNIVHostCheck directive
+ * Add symlink from apachectl to apache2ctl to be more compatible with
+ upstream. Apache httpd 1.3 hasn't been in Debian for some time.
+ * Simplify logrotate script. Closes: #576105
+ * Remove empty directory /usr/lib/debug/usr/sbin in mpm packages.
+ Closes: #576089
+ * Fix apxs2 to work with perl 5.12rc3. Closes: #577239
+ * Add source/format file to make lintian happy.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 20 Apr 2010 23:11:09 +0200
+
+apache2 (2.2.15-3) unstable; urgency=low
+
+ * mod_reqtimeout: backport bugfixes from upstream trunk up to r928881,
+ including a fix for mod_proxy CONNECT requests.
+ * mod_dav_fs: Use correct permissions when creating new files. LP: #540747
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 29 Mar 2010 22:16:24 +0200
+
+apache2 (2.2.15-2) unstable; urgency=low
+
+ * Make the Files ~ "^\.ht" block in apache2.conf more secure by adding
+ Satisfy all. Closes: #572075
+ * mod_reqtimeout: Various bug fixes, including:
+ - Don't mess up timeouts of mod_proxy's backend connections.
+ Closes: #573163
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 10 Mar 2010 21:06:06 +0100
+
+apache2 (2.2.15-1) unstable; urgency=low
+
+ * New upstream version:
+ - CVE-2010-0408: mod_proxy_ajp: Fixes denial of service vulnerability
+ - CVE-2009-3555: mod_ssl: Improve the mitigation against SSL/TLS protocol
+ prefix injection attack.
+ - CVE-2010-0434: mod_headers: Fix potential information leak with threaded
+ MPMs.
+ - mod_reqtimeout: New module limiting the time waiting for receiving
+ a request from the client. This is a (partial) mitigation against
+ slowloris-type resource exhaustion attacks. The module is enabled by
+ default. Closes: #533661
+ - mod_ssl: Add SSLInsecureRenegotiation directive to allows insecure
+ renegotiation with clients which do not yet support the secure
+ renegotiation protocol. As this requires openssl 0.9.8m, bump
+ build dependency accordingly.
+ * Fix bash completion for a2ensite if the site name contains 'conf' or
+ 'load'. Closes: #572232
+ * Do a configcheck in the init script before doing a non-graceful restart.
+ Closes: #571461
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 07 Mar 2010 23:22:56 +0100
+
+apache2 (2.2.14-7) unstable; urgency=low
+
+ * Fix potential memory leaks related to the usage of apr_brigade_destroy().
+ * Add hints about correct mod_dav_fs configuration to README.Debian.
+ Closes: #257945
+ * Fix error in Polish translation of 404 error page. Closes: #570228
+ * Document ThreadLimit in apache2.conf's comments.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 20 Feb 2010 12:38:30 +0100
+
+apache2 (2.2.14-6) unstable; urgency=low
+
+ * Use environment variables APACHE_RUN_DIR, APACHE_LOCK_DIR, and
+ APACHE_LOG_DIR in the default configuration. If you have modified
+ /etc/apache2/envvars, make sure that these variables are set and exported.
+ * Add support for multiple apache2 instances to initscript and apache2ctl.
+ See /usr/share/doc/apache2.2-common/README.multiple-instances for details.
+ Closes: #353450
+ * Set default compiled-in ServerRoot to /etc/apache2 and make paths in
+ apache2.conf relative to ServerRoot.
+ * Move ab and logresolve from /usr/sbin to /usr/bin. Closes: #351450, #564061
+ * Fix symlinks in apache2-dbg package. Closes: #567076
+ * Fix mod_cache CacheIgnoreURLSessionIdentifiers handling. Closes: #556383
+ * Add new init script action graceful-stop (LP: #456381)
+ * Add more languages to mime.conf. To limit this to useful entries, we only
+ add those for which a translation of the Debian intaller exists. LP: #217964
+ * Unset $HOME in /etc/apache2/envvars.
+ * Change default config of mod_info and mod_status to use IP addresses
+ instead of hostnames. Otherwise the hostname is sometimes logged even with
+ 'HostnameLookup Off'. Closes: #568409
+ * Add a hook to apache2.2-common's postrm script that may come in handy
+ when upgrading to 2.4.
+ * Make bug script also display php extensions.
+ * Bump Standards-Version (no changes).
+ * Remove Adam Conrad from Uploaders. Thanks for your work in the past.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 07 Feb 2010 17:29:45 +0100
+
+apache2 (2.2.14-5) unstable; urgency=low
+
+ * Security: Further mitigation for the TLS renegotation attack
+ (CVE-2009-3555): Disable keep-alive if parts of the next request have
+ already been received when doing a renegotiation. This defends against
+ some request splicing attacks.
+ * Print a useful error message if 'apache2ctl status' fails. Add a comment
+ to /etc/apache2/envvars on how to change the options for www-browser.
+ Closes: #561496, #272069
+ * Improve function to detect apache2 pid in init-script (closes: #562583).
+ * Add hint README.Debian on how to pass auth info to CGI scripts.
+ Closes: #483219
+ * Re-introduce objcopy magic to avoid dangling symlinks to the debug info
+ in the mpm packages. Closes: #563278
+ * Make apxs2 use a2enmod and /etc/apache2/mods-available. Closes: #470178,
+ LP: #500703
+ * Point to README.backtrace in apache2-dbg's description.
+ * Use more debhelper functions to simplify debian/rules.
+ * Add misc-depends to various packages to make lintian happy.
+ * Change build-dep from libcap2-dev to libcap-dev because of package rename.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 02 Jan 2010 22:44:15 +0100
+
+apache2 (2.2.14-4) unstable; urgency=low
+
+ * Disable localized error pages again by default because they break
+ configurations with "<Location /> SetHandler ...". A workaround is
+ described in the comments in /etc/apache2/conf.d/localized-error-pages
+ (closes: #543333).
+ * mod_rewrite: Fix URLs in redirects with literal IPv6 hosts
+ (closes: #557015).
+ * Automatically listen on port 443 if mod_gnutls is loaded (closes: #558234).
+ * Add man page for split-logfile.
+ * Link with -lcrypt where necessary to fix a FTBFS with binutils-gold
+ (closes: #553946).
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 13 Dec 2009 20:05:37 +0100
+
+apache2 (2.2.14-3) unstable; urgency=low
+
+ * Backport various mod_dav/mod_dav_fs fixes from upstream trunk svn. This
+ includes:
+ - Make PUT replace files atomically (closes: #525137).
+ - Make MOVE not delete the destination if the source file disappeared in
+ the meantime (closes: #273476).
+ NOTE: The format of the DavLockDB has changed. The default DavLockDB will
+ be deleted on upgrade. Non-default DavLockDBs should be deleted manually.
+ * Fix output of "/etc/init.d/apache2 status" (closes: #555687).
+ * Update the comment about SNI in ports.conf (closes: #556932).
+ * Set redirect-carefully for Konqueror/4.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 21 Nov 2009 10:20:54 +0100
+
+apache2 (2.2.14-2) unstable; urgency=medium
+
+ * Security:
+ Reject any client-initiated SSL/TLS renegotiations. This is a partial fix
+ for the TLS renegotiation prefix injection attack (CVE-2009-3555).
+ Any configuration which requires renegotiation for per-directory/location
+ access control is still vulnerable.
+ * Allow RemoveType to override the types from /etc/mime.types. This allows
+ to use .es and .tr for Spanish and Turkish files in mod_negotiation.
+ Closes: #496080
+ * Fix 'CacheEnable disk http://'. Closes: #442266
+ * Fix missing dependency by changing killall to pkill in the init script.
+ LP: #460692
+ * Add X-Interactive header to init script as it may ask for the ssl key
+ passphrase. Closes: #554824
+ * Move httxt2dbm man page into apache2.2-bin, which includes httxt2dbm, too.
+ * Enable keepalive for MSIE 7 and newer in default-ssl site and README.Debian
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 07 Nov 2009 14:37:37 +0100
+
+apache2 (2.2.14-1) unstable; urgency=low
+
+ * New upstream version:
+ - new module mod_proxy_scgi
+ * Disable hardening option -pie again, as gdb in Debian does not support
+ it properly and it is broken on mips*.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 29 Sep 2009 20:55:05 +0200
+
+apache2 (2.2.13-2) unstable; urgency=high
+
+ * mod_proxy_ftp security fixes (closes: #545951):
+ - DoS by malicious ftp server (CVE-2009-3094)
+ - missing input sanitization: a user could execute arbitrary ftp commands
+ on the backend ftp server (CVE-2009-3095)
+ * Add entries to NEWS.Debian and README.Debian about Apache being stricter
+ about certain misconfigurations involving name based SSL virtual hosts.
+ Also make Apache print the location of the misconfigured VirtualHost when
+ it complains about a missing SSLCertificateFile statement. Closes: #541607
+ * Add Build-Conflicts: autoconf2.13 (closes: #541536).
+ * Adjust priority of apache2-mpm-itk to extra.
+ * Switch apache2.2-common and the four mpm packages from architecture all to
+ any. This is stupid but makes apache2 binNMUable again (closes: #544509).
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 16 Sep 2009 20:55:02 +0200
+
+apache2 (2.2.13-1) unstable; urgency=low
+
+ * New upstream release:
+ - Fixes segfault with mod_deflate and mod_php (closes: #542623).
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 31 Aug 2009 20:28:56 +0200
+
+apache2 (2.2.12-1) unstable; urgency=low
+
+ * New upstream release:
+ - Adds support for TLS Server Name Indication (closes: #461917 LP: #184131).
+ (The Debian default configuration will be changed to use SNI in a later
+ version.)
+ - Fixes timefmt config in SSI (closes: #363964).
+ - mod_ssl: Adds SSLProxyCheckPeerExpire and SSLProxyCheckPeerCN directives
+ to enable stricter checking of remote server certificates.
+ * Make mod_deflate not compress the content for HEAD requests. This is a
+ similar issue as CVE-2009-1891.
+ * Enable hardening compile options.
+ * Switch default LogFormat from %b (size of file sent) to %O (bytes actually
+ sent) (closes: #272476 LP: #255124)
+ * Add the default LANG=C to /etc/apache2/envvars and document it in
+ README.Debian (closes: #511878).
+ * Enable localized error pages by default if the necessary modules are
+ loaded. Move the config for it from apache2.conf to
+ /etc/apache2/conf.d/localized-error-pages (closes: #467004). Clarify the
+ required order of the aliases in the comment (closes: #196795).
+ * Change default for ServerTokens to 'OS', to not announce the exact module
+ versions to the world (LP: #205996)
+ * Make a2ensite and friends ignore the same filenames as apache does for
+ included config files, even if LANG is not C.
+ * Merge source packages apache2 and apache2-mpm-itk (current itk version is
+ 2.2.11-02). This removes the binNMU mess necessary for every apache2 upload
+ (closes: #500885, #512084). Add Steinar to Uploaders. Remove apache2-src
+ package, which is no longer necessary.
+ * Ship our own version of the magic config file (taken from file 4.17-5etch3)
+ which is still compatible with mod_mime_magic (closes: #483111).
+ * Add ThreadLimit to the default config and put ThreadsPerChild and
+ MaxClients into the correct order so that Apache does not complain
+ (closes: #495656).
+ Also add a configuration block for the event MPM in apache2.conf.
+ * Fix HTTP PUT with mod_dav failing to detect an aborted connection
+ (closes: #451563).
+ * Change references to httpd.conf in apache2-doc to apache2.conf
+ (closes: #465393).
+ * Clarify the recommended permissions for SSL certificates in README.Debian
+ (closes: #512778).
+ * Document in README.Debian how to name files in conf.d to avoid conflicts
+ with packages (closes: #493252)
+ * Remove 2.0 -> 2.2 upgrade logic from maintainer scripts.
+ * Remove other_vhosts_access.log on package purge.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 04 Aug 2009 11:02:34 +0200
+
+apache2 (2.2.11-7) unstable; urgency=low
+
+ * Security fixes:
+ - CVE-2009-1890: denial of service in mod_proxy
+ - CVE-2009-1891: denial of service in mod_deflate (closes: #534712)
+ * Add symlinks for the debug info to the mpm packages.
+ * Be slightly more informative in the default index.html without pointing
+ to Apache or Debian (LP: #89364)
+ * Remove dependency on net-tools, which is no longer necessary
+ (closes: #535849)
+ * Bump Standards-Version (no changes)
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 10 Jul 2009 22:42:57 +0200
+
+apache2 (2.2.11-6) unstable; urgency=high
+
+ * CVE-2009-1195: mod_include allowed to bypass IncludesNoExec for Server
+ Side Includes (closes: #530834).
+ * Fix postinst scripts (closes: #532278).
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 08 Jun 2009 19:22:58 +0200
+
+apache2 (2.2.11-5) unstable; urgency=low
+
+ * Move all binaries into a new package apache2.2-bin and make
+ apache2.2-common depend on it. This allows to
+ - run apache as user process only, e.g. with gnome-user-share.
+ Closes: #468690
+ - run multiple instances of apache with different MPMs. This configuration
+ is not supported in any way, though. Closes: #517572
+ * Switch to debhelper compatibility level 7 and remove some code duplication
+ in debian/rules.
+ * Override some Lintian warnings about old autotools helper files and being
+ not binNMUable (apache2 is not binNMUable anyway, because of the
+ apache2 <-> apache2-mpm-itk dependency).
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 22 May 2009 19:30:20 +0200
+
+apache2 (2.2.11-4) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * Disable TRACE method by default (closes: #492130).
+ * Compress some more mime types with mod_deflate by default. This may cause
+ problems with MSIE 6, but that browser should now be considered obsolete.
+ Closes: #397526, #521209
+ * Various backports from upstream svn branches/2.2.x:
+ - CVE-2009-1191: mod_proxy_ajp: Avoid delivering content from a previous
+ request which failed to send a request body
+ - Fix FollowSymlinks / SymlinksIfOwnerMatch ignored with
+ server-side-includes PR 45959 (closes: #524474)
+ - Fix mod_rewrite "B" flag breakage PR 45529 (closes: #524268)
+ - Fix mod_deflate etag handling PR 45023 (LP: #358314)
+ - Fix mod_ldap segfault if LDAP initialization failed PR 45994
+ * Allow apache2-mpm-itk as alternate dependency in apache2 meta package
+ (closes: #527225).
+ * Fix some misuse of command substitution in the init script. Thanks to
+ Jari Aalto for the patch. (Closes: #523398)
+ * Extend the gnome-vfs DAV workaround to gvfs (closes: #522845).
+ * Add more info to check_forensic man page (closes: #528424).
+ * Make "apache2ctl help" point to help on apache2 args (closes: #528425).
+ * Lintian warnings:
+ - fix spelling error in apache2-utils description
+ - tweak debian/copyright to make lintian not complain about pointers to GPL
+ - bump standards-version (no changes)
+
+ [ Peter Samuelson ]
+ * Adjust sections to match recent ftpmaster overrides.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 19 May 2009 22:55:27 +0200
+
+apache2 (2.2.11-3) unstable; urgency=low
+
+ * Rebuild against apr-util 1.3, to fix undefined symbol errors in mod_ldap
+ (see #521899). This also creates the dependencies on the new external
+ libaprutil1-dbd-* and libaprutil1-ldap packages.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 31 Mar 2009 21:07:26 +0200
+
+apache2 (2.2.11-2) unstable; urgency=low
+
+ * Report an error instead instead of segfaulting when apr_pollset_create
+ fails (PR 46467). On Linux kernels since 2.6.27.8, the value in
+ /proc/sys/fs/epoll/max_user_instances needs to be larger than twice the
+ value of MaxClients in the Apache configuration. Closes: #511103
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 16 Jan 2009 19:01:59 +0100
+
+apache2 (2.2.11-1) unstable; urgency=low
+
+ [Thom May]
+ * New Upstream Version (Closes: #508186, LP: #307397)
+ - Contains rewritten shmcb code which should fix alignment problems on
+ alpha (Closes: #419720).
+ - Notable new features: chroot support, mod_proxy improvements.
+
+ [Ryan Niebur]
+ * fix segfault in ab when being verbose on ssl sites (Closes: #495982)
+ * remove trailing slash for DocumentRoot (Closes: #495110)
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 14 Dec 2008 09:34:24 +0100
+
+apache2 (2.2.9-11) unstable; urgency=low
+
+ * Regression fix from upstream svn for mod_proxy:
+ Prevent segmentation faults by correctly adjusting the lifetime of the
+ buckets read from the proxy backend. PR 45792
+ * Fix from upstream svn for mpm_worker:
+ Crosscheck that idle workers are still available before using them and
+ thus preventing an overflow of the worker queue which causes a SegFault.
+ PR 45605
+ * Add a comment to ports.conf to point to NEWS.Debian.gz in case of
+ upgrading problems.
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 26 Nov 2008 23:10:22 +0100
+
+apache2 (2.2.9-10) unstable; urgency=low
+
+ * Regression fix from upstream svn for mod_proxy_http:
+ Don't trigger a retry by the client if a failure to read the response line
+ was the result of a timeout.
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 01 Oct 2008 11:50:18 +0200
+
+apache2 (2.2.9-9) unstable; urgency=medium
+
+ * Revert the attempted fix for #496080 because it did not work due to
+ upstream PR 38330. Instead, document the problem and possible workarounds
+ in README.Debian.
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 12 Sep 2008 11:39:15 +0200
+
+apache2 (2.2.9-8) unstable; urgency=low
+
+ * Fix Spanish language support which was broken by .es being added to
+ /etc/mime.types for application/ecmascript. (Closes: #496080)
+ * Correct description of ServerTokens in /etc/apache2/conf.d/security.
+ (Closes: #497362)
+ * Clarify how to use apache2ctl to pass arbitrary arguments to
+ apache2. (LP: #259363)
+ * Add hints to README.Debian about the messages
+ "NameVirtualHost *:80 has no VirtualHosts" and
+ "File does not exist: /htdocs".
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 11 Sep 2008 09:17:33 +0200
+
+apache2 (2.2.9-7) unstable; urgency=low
+
+ * Fix XSS in mod_proxy_ftp (CVE-2008-2939).
+ * Fix mod_proxy_http losing the query string with noescape (PR 45247).
+ * Make the balancer manager work in Opera and MSIE (PR 45578).
+ * Fix mod_headers "edit" removing multiple headers with the same name (PR
+ 45333).
+ * Also describe how to get a backtrace from a running process in
+ README.backtrace.
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 08 Aug 2008 19:27:40 +0200
+
+apache2 (2.2.9-6) unstable; urgency=high
+
+ * Urgency high for RC bug fix.
+ * Fix SIGBUS on SPARC by preventing gcc from optimizing some memcpy calls
+ away. (Closes: #485525)
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 20 Jul 2008 10:17:19 +0200
+
+apache2 (2.2.9-5) unstable; urgency=medium
+
+ * Urgency medium to get this into testing before the freeze.
+ * Remove IPv6 patch that was necessary for very old kernels but creates
+ problems on systems with current kernels and net.ipv6.bindv6only = 1.
+ Apache will now always create its sockets with IPV6_V6ONLY set to 0.
+ (Closes: #391280)
+
+ -- Stefan Fritsch <sf@debian.org> Mon, 07 Jul 2008 21:20:48 +0200
+
+apache2 (2.2.9-4) unstable; urgency=low
+
+ * Make postinst more quiet. (Closes: #489153)
+ * Add Turkish language support. (Closes: #489224)
+ * Remove duplicate comments in sites-available/default-ssl. (Closes: #489383)
+ * Describe in NEWS.Debian how to revert to the old NameVirtualHost config.
+ (Closes: #489215)
+ * Redirect apache2 bug reports to apache2.2-common, to get useful dependency
+ information.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 06 Jul 2008 10:38:37 +0200
+
+apache2 (2.2.9-3) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * Move NameVirtualHost directive to ports.conf and switch from "*" to
+ "*:80". (Closes: #314606, #486286)
+ * Comment out the CacheEnable line in disk_cache.conf. It would have caused
+ problems with Etch to Lenny upgrades.
+ * Change the minimum user id for suexec back to 100, the new value of 1000
+ was too disruptive for existing configurations. (Closes: #488821)
+ * Add a default SSL virtual host. (Closes: #267477)
+ - Use snakeoil certificate by default (if ssl-cert is installed).
+ (Closes: #293524, #446765)
+ - Document this in README.Debian.
+ (Closes: #293469, #293519, #398520, #395823)
+ - Add MSIE workarounds. (Closes: #421802)
+ - Add ssl-cert to Recommends.
+ * Add a new config file /etc/apache2/conf.d/security with some vaguely
+ security related diectives. (Closes: #260063)
+ * Adjust mod_userdir accordingly. Also add "AllowOverride Indexes" for the
+ home directories.
+ * Disable SSLv2 by default. It is insecure. Also only enable ciphers with
+ key lengths of at least 128 bit.
+ * Make the init script complain about a missing $APACHE_PID_FILE during
+ "start", too, and not only during "stop" or "restart". This makes it more
+ obvious that /etc/apache2/envvars has to be updated. (Closes: #473982)
+ * Add hint about the "..., using 127.0.0.1 for ServerName" warning to
+ README.Debian. (Closes: #457708)
+ * Add hint about the "could not create rewrite_log_lock" error message to
+ README.Debian. (Closes: #450831)
+ * Remove empty dir from apache2-doc to fix Lintian warning.
+ * Always pass -g to gcc instead of relying on dpkg-buildpackage to set
+ CFLAGS. We always want the debug info for the apache2-dbg package.
+
+ [ Ryan Niebur ]
+ * Upgraded to policy 3.8.0
+ - added support for noopt in DEB_BUILD_OPTIONS
+ - added a README.source
+ - added support for parallel in DEB_BUILD_OPTIONS
+ * Dropped XS- from the Vcs fields in control
+
+ -- Stefan Fritsch <sf@debian.org> Wed, 02 Jul 2008 10:15:57 +0200
+
+apache2 (2.2.9-2) unstable; urgency=low
+
+ * Make the init script use normal 'stop' instead of 'graceful-stop' again:
+ With graceful-stop, it can take a long time until all child processes have
+ closed their listening sockets and there is no way for the init script to
+ know when it is save to start apache again. This could make the restart of
+ apache fail. (Closes: #486629, #463338)
+ * Improve package descriptions, thanks to Justin B Rye. (Closes: #486855)
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 21 Jun 2008 12:22:17 +0200
+
+apache2 (2.2.9-1) unstable; urgency=low
+
+ * New upstream release. Notable changes:
+ - mod_proxy_http: Better handling of excessive interim responses from
+ origin server to prevent potential denial of service and high memory
+ usage (CVE-2008-2364).
+ - mod_proxy_balancer: Prevent CSRF attacks against the balancer-manager
+ (CVE-2007-6420).
+ - Worker / Event MPM: Fix race condition in pool recycling that leads to
+ segmentation faults under load. (Closes: #484800)
+ - mod_proxy: Keep connections to the backend persistent in the HTTPS case.
+ - mod_proxy: Support environment variable interpolation in reverse
+ proxying directives.
+ - mod_headers: Add 'merge' option to avoid duplicate values within the
+ same header.
+ - mod_substitute: The default is now flattening the buckets after each
+ substitution. The newly added 'q' flag allows for the quicker, more
+ efficient bucket-splitting.
+ * Shorten the init script's waiting period during 'restart' from 10 to 4
+ seconds. This should still be plenty to allow the apache processes to
+ close their listening sockets. Make the wait even shorter if apache dies
+ faster. (Closes: #479136)
+ * Fix some lintian warnings:
+ - Add some missing patch descriptions.
+ - Point to /usr/share/common-licenses instead of including the license in
+ the copyright file.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 14 Jun 2008 08:29:41 +0200
+
+apache2 (2.2.8-5) unstable; urgency=low
+
+ * Replace a2{en,dis}{mod,site} by a rewritten version that
+ - supports wildcards (Closes: #373969).
+ - can be influenced with environment variables (Closes: #349716).
+ - checks existing symlinks for correctness (Closes: #409970).
+ - allows to remove dead symlinks (Closes: #480893).
+ * Move suexec suid helper program to a separate package apache2-suexec,
+ which is not installed by default. Provide an alternative version of
+ suexec, which can be customized with a config file. This can be found in
+ the apache2-suexec-custom package. Closes: #312252, #266835
+ * Some more suexec fixes:
+ - Fix race condition when changing directories.
+ - Accept only /var/www/*, and not /var/www*. The same for public_html/*
+ instead of public_html* (CVE-2007-1742).
+ - Raise the minimum userid that suexec may change to from 100 to 1000.
+ * Enable mod_deflate in new installs.
+ * Include config.nice in apache2-src. This hopefully allows apache2-mpm-itk
+ to drop the build-dependency on apache2-prefork-dev.
+ * Mention environment variables in apache2 and apache2ctl man pages and point
+ to README.Debian. (Closes: #475150)
+ * Drop unneeded build-dep on libtool.
+ * Drop obsolete apache2-mpm-perchild package (closes: #477522).
+ * Don't fail in postinst if there is a dangling symlink /var/www/index.html.
+ * Fix typo in bug number in 2.2.8-3 changelog entry.
+ * Use dh_lintian in debian/rules.
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 31 May 2008 17:02:03 +0200
+
+apache2 (2.2.8-4) unstable; urgency=high
+
+ * Urgency high for DoS vulnerability fix.
+ * Fix memory leak in mod_ssl with zlib compression.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 13 May 2008 22:31:37 +0200
+
+apache2 (2.2.8-3) unstable; urgency=low
+
+ * mod_cache: Handle If-Range correctly if the cached resource was stale
+ (closes: #470652).
+ * mod_autodindex: Use UTF-8 as character set for filenames in the default
+ configuration. Change this in autoindex.conf if you are still using
+ ISO-8859-1.
+ * Introduce APACHE_RUN_DIR and APACHE_LOCK_DIR in apache2ctl. Also, make it
+ use APACHE_RUN_USER instead of APACHE2_RUN_USER, to be consistent with
+ apache2.conf.
+ * Add 'status' function to init script (adapted from patch by Dustin
+ Kirkland).
+ * Don't build the modules three times. We are only shipping one set of them,
+ anyway. (Inspired by the Fedora package.)
+ * Remove Fabio M. Di Nitto from the uploaders field (thanks for your work).
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 14 Mar 2008 10:57:19 +0100
+
+apache2 (2.2.8-2) unstable; urgency=low
+
+ * Provide a fallback access log (other_vhosts_access.log) and a suitable
+ LogFormat (vhost_combined) for VirtualHosts that don't define their own
+ log file. (Closes: #313430)
+ * Fix broken symlink to README.Debian.gz and typos in the file
+ (closes: #461462).
+ * Improve generation of password salts in htpasswd (closes: #469271).
+ * Point VCS tags in debian control to trunk, to make them useful with
+ debcheckout.
+ * Add missing ${APACHE_ARGUMENTS} to *) case in apache2ctl.
+ * In upgrades from etch, replace /etc/apache2/default without asking also in
+ the NO_START=1 case, in order to not break piuparts (closes: #466367).
+ * Print file name where "Useless use of AllowOverride" occurred.
+ (Closes: #410334)
+ * Make bugreport script source /etc/apache2/envvars before calling apache2.
+ * Add note about MSIE SSL workaround to README.Debian.
+ * Don't ship empty /var/www/apache2-default in apache2-doc.
+ (Closes: #469145)
+ * mod_autoindex: Use the bomb icon only for the name 'core', not for
+ '*core'. (Closes: #467480)
+ * Include module name in a2enmod error messages (closes: #461341).
+
+ -- Stefan Fritsch <sf@debian.org> Sat, 08 Mar 2008 12:28:14 +0100
+
+apache2 (2.2.8-1) unstable; urgency=low
+
+ * New upstream version:
+ - Fixes cross-site scripting issues in
+ o mod_imagemap (CVE-2007-5000)
+ o mod_status (CVE-2007-6388)
+ o mod_proxy_balancer's balancer manager (CVE-2007-6421)
+ - Fixes a denial of service issue in mod_proxy_balancer's balancer manager
+ (CVE-2007-6422).
+ - Fixes mod_proxy URL encoding in error messages (closes: #337325).
+ - Adds explicit charset to the output of various modules to work around
+ possible cross-site scripting flaws affecting web browsers that do not
+ derive the response character set as required by RFC2616. For
+ mod_proxy_ftp there is now the new ProxyFtpDirCharset directive to
+ specify something else than ISO-8859-1 (CVE-2008-0005).
+ - Adds mod_substitute which performs inline response content pattern
+ matching (including regex) and substitution (like mod_line_edit).
+ - Adds "DefaultType none" option.
+ - Adds new "B" option to RewriteRule to suppress URL unescaping.
+ - Adds an "if" directive for mod_include to test whether an URL is
+ accessible, and if so, conditionally display content.
+ - Adds support for mod_ssl to the event MPM.
+ * Move the configuration of User, Group, and PidFile to
+ /etc/apache2/envvars. This makes it easier to use these settings in
+ scripts. /etc/apache2/envvars can now also be used to influence apache2ctl
+ (inspired by Marc Haber's patch). (Closes: #349709, #460105, #458085)
+ * Make apache2ctl check the configuration syntax before trying to restart
+ apache, to match the behaviour documented in the man page.
+ (Closes: #459236)
+ * Convert docs to be directly viewable with a browser (and not use content
+ negotiation).
+ * Add doc-base entry for the documentation. (closes: #311269)
+ * Don't ship default files in /var/www, but copy a sample file to
+ /var/www/index.html on new installs. Also remove the now unneeded
+ RedirectMatch line from sites-available/default.
+ (Closes: #411774, #458093)
+ * Add some information to README.Debian (Apache wiki, default virtual host)
+ * Build with LDFLAGS=-Wl,--as-needed to drop a lot of unnecessary
+ dependencies, easing library transitions (closes: #458857).
+ * Add icons for OpenDocuments, add sharutils to Build-Depends for uudecode.
+ Patch by Nicolas Valcárcel. (Closes: #436441)
+ * Add reportbug script to list enabled modules.
+ * Fix some lintian warnings:
+ - Pass --no-start to dh_installinit instead of omitting the debhelper token
+ in various maintainer scripts. Also move the update-rc.d call to
+ apache2.2-common.
+ - Add Short-Description to init script.
+ * Remove unused apache2-mpm-prefork.prerm from source package and clean up
+ debian/rules a bit.
+ * Don't ship NEWS.Debian with apache2-utils, as the contents are only
+ relevant for the server.
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 17 Jan 2008 20:27:56 +0100
+
+apache2 (2.2.6-3) unstable; urgency=low
+
+ * Allocate fewer bucket brigades in case of a flush bucket. This might help
+ with the memory leaks reported in #399776 and #421557.
+ * Escape the HTTP method in error messages to avoid potential cross site
+ scripting vulnerabilities (CVE-2007-6203).
+ * Update 053_bad_file_descriptor_PR42829.dpatch to avoid a race condition.
+ * Redirect /doc/apache2-doc/manual/ to /manual/ in the apache2-doc config
+ (Closes: #450867).
+ * Add icons for .ogg and .ogm (Closes: #255443).
+ * Add comment about how to log X-Forwarded-For (Closes: #425008).
+ * Make mod_proxy_balancer not depend on mod_cache.
+ * Add Homepage field to debian/control.
+ * Add/fix some lintian overrides, fix some warnings.
+ * Bump Standards-Version (no changes).
+
+ -- Stefan Fritsch <sf@debian.org> Fri, 07 Dec 2007 22:38:59 +0100
+
+apache2 (2.2.6-2) unstable; urgency=low
+
+ * Avoid calling apr_pollset_poll() and accept_func() when the listening
+ sockets have already been closed on graceful stop or reload. This
+ hopefully fixes processes not being killed (closes: #445263, #447164)
+ and the "Bad file descriptor: apr_socket_accept: (client socket)"
+ error message (closes: #400918, #443310)
+ * Allow logresolve to process long lines (Closes: #331631)
+ * Remove duplicate config examples (Closes: #294662)
+ * Include README.backtrace describing how to create a backtrace
+ * Add CVE reference to 2.2.6-1 changelog entry
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 18 Oct 2007 19:35:40 +0200
+
+apache2 (2.2.6-1) unstable; urgency=low
+
+ * New upstream release
+ - fixes mod_proxy DoS for threaded MPMs (CVE-2007-3847)
+ - fixes spurious warning for valid wildcard certificates (Closes: #414855)
+ - adds warning that htpasswd is not setuid safe (Closes: #356285)
+ - adds Type and Charset options to IndexOptions directive,
+ allowing a workaround for buggy browsers affected by CVE-2007-4465
+ - adds new ProxyPassMatch directive
+ * Add index.htm to the default DirectoryIndex configuration
+ (Closes: #439375)
+ * Use apache2ctl in init script (Closes: #439027)
+ * make init script less noisy (Closes: #438950)
+ * improve NEWS entry (Closes: #440084)
+
+ -- Stefan Fritsch <sf@debian.org> Thu, 06 Sep 2007 23:54:42 +0200
+
+apache2 (2.2.4-3) unstable; urgency=low
+
+ [ Stefan Fritsch ]
+ * enable default site on new installs again (Closes: #436341)
+ * make mod_authn_dbd depend on mod_dbd
+ * make a2dissite return 0 if a site is already disabled (Closes: #435398)
+ * make a2 scripts print errors to stderr (Closes: #435400)
+ * move TypesConfig directive from apache2.conf to mime.conf
+ (Closes: #434248)
+
+ [ Adam Conrad ]
+ * Special case apache2-dbg magic in debian/rules, so we don't do
+ this on Ubuntu, which has an archive of detached debug packages.
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 07 Aug 2007 20:49:28 +0200
+
+apache2 (2.2.4-2) unstable; urgency=low
+
+ * Modularize config: Move module specific configuration from apache2.conf
+ to mods-available/*conf (Closes: #338472)
+ * Remove the NO_START kludge. Now you have to use rc*.d symlinks to disable
+ apache2. (Closes: #408462, #275561)
+ * Create run and lock directores in apache2ctl to make it work on fresh
+ installations before the first call of the init script. Together with
+ the previous item, this closes: #418499
+ * Disable AddDefaultCharset again (Closes: #397886)
+ * Make ports.conf, conf.d/charset, and /etc/default/apache2 conffiles
+ managed by dpkg
+ * Listen on port 443 by default if mod_ssl is loaded (Closes: #404598)
+ * Add logic to start htcacheclean as daemon or cronjob. The configuration
+ is in /etc/default/apache2
+ * Fix security issues:
+ - CVE-2007-3304: prevent parent process to send SIGUSR1 to arbitrary
+ processes
+ - CVE-2006-5752: XSS in mod_status
+ * Add init.d dependency info from insserv overrides to /etc/init.d/apache2
+ * Replace apachectl with apache2ctl in docs (Closes: #164493)
+ * Add usage message to apache2ctl (Closes: #359008)
+ * Make -dev packages priority extra
+ * Add secure example cipher/protocol configuration to ssl.conf
+ * Update watch file (Closes: #433552)
+ * Bump dh_compat to 5
+ * Add new package apache2-dbg with debugging symbols
+ * Fix mod_cache returning 304 instead of 200 on HEAD requests
+
+ -- Stefan Fritsch <sf@debian.org> Tue, 03 Jul 2007 21:23:40 +0200
+
+apache2 (2.2.4-1) unstable; urgency=medium
+
+ [ Stefan Fritsch ]
+ * Urgency medium for security fix
+ * Fix CVE-2007-1863: DoS in mod_cache
+ * New upstream version (Closes: #427050)
+ - Fixes "proxy: error reading status line from remote server"
+ (Closes: #410331)
+ * Fix CVE-2007-1862: mod_mem_cache DoS (introduced in 2.2.4)
+ * Change logrotate script to use reload instead of restart.
+ (Closes: #298689)
+ * chmod o-rx /var/log/apache2 (Closes: #291841)
+ * chmod o-x suexec (Closes: #431048)
+ * Update patch for truncated mod_cgi 500 responses from upstream SVN
+ (Closes: #412580)
+ * Don't use AddDefaultCharset for our docs (Closes: #414429)
+ * fix options syntax in sites-available/default (Closes: #419539)
+ * Move conf.d include to the end of apache2.conf (Closes: #305933)
+ * Remove log, cache, and lock files on purge (Closes: #428887)
+ * Ship /usr/lib/cgi-bin (Closes: #415698)
+ * Add note to README.Debian how to read docs (Closes: #350822)
+ * Document pid file name (Closes: #350286)
+ * Update Standards-Version (no changes needed)
+ * Fix some lintian warnings, add some overrides
+ * Start apache when doing a "restart" even if it was not running
+ (Closes: #384682)
+ * reload config in apache2-doc postinst (Closes: #289289)
+ * don't fail in prerm if apache is not running (Closes: #418536)
+ * Suggest apache2-doc and www-browser (Closes: #399056)
+ * Make init script always display a warning if NO_START=1 since
+ VERBOSE=yes is not the default anymore (Closes: #430116)
+ * Replace apache2(8) man page with a more current version
+ * Add httxt2dbm(8) man page
+ * Show -X option in help message (Closes: #391817)
+ * remove sick-hack-to-update-modules
+ * don't depend on procps on hurd (Closes: #431125)
+
+ [ Peter Samuelson ]
+ * Add shlibs:Depends to apache2.2-common.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 01 Jul 2007 19:57:51 +0200
+
+apache2 (2.2.3-5) unstable; urgency=low
+
+ [ Tollef Fog Heen ]
+ * Fix up apache2-src so the .tar.gz contains an apache2 top level
+ directory.
+ * Make apache2 MPMs provide and conflict with apache2-mpm so other
+ packages can provide MPMs too.
+ * Get rid of 2.1 references from descriptions. (Closes: #400981)
+
+ [ Thom May ]
+ * Let the init script cope with multiple pid files correctly. Probably we
+ shouldn't be doing this at all, but we might as well do it properly!
+ (Closes: #396162)
+ * Add a sensible autoindex default config
+ * Add patch from upstream to ensure that mod_cgi 500 responses aren't
+ truncated (Closes: #412580)
+ * Use graceful-stop to shutdown apache to ensure we cope nicely with long
+ running or blocked children
+
+ [ Peter Samuelson ]
+ * Ship apache2 manpage in apache2.2-common. (Closes: #391813)
+ * Rearrange init script so that 'force-reload' is the same as 'reload'.
+ (Closes: #401053)
+ * Add Build-Depends: mawk. (Closes: #403682)
+ * Add a needed <IfModule mod_include.c> guard to apache2.conf.
+ (Closes: #407307)
+ * Stop shipping /var/run/apache2/ as it is created at runtime anyway.
+ * Move the /var/lock/apache2 owner fix from the apache2.2-common
+ postinst to the init script, as /var/lock may not persist across
+ reboots. (Closes: #420101)
+
+ [ Stefan Fritsch ]
+ * Add Build-Depends: libssl-dev, zlib1g-dev (Closes: #399043)
+ * Add XS-Vcs-* to debian/control
+ * Improve handling of empty $MODNAME in a2enmod (Closes: #422589)
+ * Treat apache2-mpm-itk as prefork in a2enmod (Closes: #412602)
+ * Re-add README.Debian and describe
+ - the config dir layout (closes: #419552)
+ - which files are ignored by Include
+ - when and how to change "restart" to "reload" in the logrotate script
+ * When purging, remove {mods,sites}-enabled symlinks and the config files
+ created by postinst (Closes: #397789)
+ * Fix suexec to log after a cgi error (Closes: #312385)
+ * Add watch file
+ * Add AddType for .bz2 (Closes: #416322)
+ * Make init script messages conform better to policy (Closes: #390348)
+ and exit with failure if called with unknown parameter (Closes: #412407)
+ * Fix segfault in mod_proxy_ftp when FTP server sends back no spaces
+ (Closes: #413727)
+ * Ship /etc/apache2/conf.d/apache2-doc (Closes: #418464)
+ * Tell the user when selecting cgid instead of cgi (Closes: #428058)
+ * Add a2ensite/a2dissite man pages (Closes: #322385)
+ * Comment out CacheEnable by default, to prevent filling up /var.
+ Document the problem in README.Debian and NEWS.Debian, point to
+ htcacheclean and give a warning when doing a2enmod disk_cache
+ (Closes: #423653).
+ * Add myself to Uploaders.
+
+ -- Stefan Fritsch <sf@debian.org> Sun, 10 Jun 2007 18:54:29 +0200
+
+apache2 (2.2.3-4) unstable; urgency=high
+
+ * High-urgency upload for RC bugfixes.
+ * Ack NMUs - thanks Andi, Steve.
+ * Add myself to Uploaders.
+ * Refactor apache2.2-common.postinst slightly, to account for sarge
+ upgrades (since it's a new package name, rather than an upgrade).
+ (Closes: #396782, #415775)
+ * If mod_proxy was configured in sarge, add proxy_http and
+ disk_cache modules, which used to be included in the mod_proxy config.
+ (Closes: #407171)
+
+ -- Peter Samuelson <peter@p12n.org> Tue, 27 Mar 2007 07:06:49 -0500
+
+apache2 (2.2.3-3.3) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * High-urgency upload for RC bugfix.
+ * apache2.2-common should depend on procps, since it will fail to create
+ httpd.conf if it's not installed. Closes: #398535.
+
+ -- Steve Langasek <vorlon@debian.org> Mon, 5 Feb 2007 01:55:57 -0800
+
+apache2 (2.2.3-3.2) unstable; urgency=high
+
+ * Non-maintainer upload.
+ * 043_ajp_connection_reuse: Patch from upstream Bugzilla, fixing a critical
+ issue with regard to connection reuse in mod_proxy_ajp.
+ Closes: #396265
+
+ -- Andreas Barth <aba@not.so.argh.org> Sat, 9 Dec 2006 21:05:45 +0000
+
+apache2 (2.2.3-3.1) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Enable authz_user by default, fix silent authentication breakage.
+ Closes: #397310
+ * Add default modules if coming from earlier than this version.
+ Closes: #392349, #392352, #392701, #393913, #396678, #395976
+ * Re-Enable modules cern_meta, dumpio and ext_filter. Closes: #391393
+
+ -- Andreas Barth <aba@not.so.argh.org> Fri, 10 Nov 2006 15:44:33 +0100
+
+apache2 (2.2.3-3) unstable; urgency=medium
+
+ [ Peter Samuelson ]
+ * a2dismod: exit 0 if a module exists but is already disabled.
+ * Ship a2enmod.8 and a2dismod.8 again, and expand them a bit.
+ (Closes: #270551)
+
+ [ Tollef Fog Heen ]
+ * Build apache2-src package.
+ * Do not AddDefaultCharset if we are proxying. Closes: #277526
+ * Do not forcefully link against libdb4.3 and other libs.
+ * Enable the same list of modules as we had in 2.0 (by default) and do
+ that for all older versions than 2.2.3-3 to fix upgrade issues people
+ have had. Closes: #392349
+ * Set default IndexWidth to *.
+ * Clean up CPPFLAGS and CFLAGS, including making all of CFLAGS a
+ superset of CPPFLAGS. Also make sure to include -I switches with
+ absolute paths so the apache headers are useful.
+ * Warn when not starting HTTPD due to missing apache binary.
+ Closes: #384128
+ * Provide sample disk and memory cache configurations. Closes: #278564
+ * Provide dir.conf. Closes: #392356
+ * Add alternate dependency from apache to apache2-mpm-event
+ * On reload, make the init script exit 1 with an error message if the
+ configuration is broken. Closes: #316858
+ * Add default deflate.conf compressing text/html, text/plain and
+ text/xml. Closes: #349016
+ * Add { and } around the usage format in the init script to make the
+ init script bash completion happier. Closes: #350606
+
+ [ Adam Conrad ]
+ * Update our php4 and php5 conflicts, to reflect the reality that each
+ were uploaded and built again while apache2.2 was in the new queue.
+ Closes: #392189
+ * Migrate kill symlinks from K91 to K09 (closes: #376503)
+ * Make apache2 depend on the current version of the MPMs, as it used
+ to in the 2.0.x series (and make it binNMU-safe) (closes: #394658)
+ * Make sure that the RedirectMatch in sites-available/default continues
+ to be commented out for Ubuntu, while having it uncommented for Debian.
+
+ [ Thom May ]
+ * Fix permissions on suexec (Closes: #391918)
+ * This is Debian, not Ubuntu (Closes: #393277)
+
+ -- Adam Conrad <adconrad@0c3.net> Sat, 7 Oct 2006 17:57:04 +1000
+
+apache2 (2.2.3-2) unstable; urgency=low
+
+ * Make sure to ship /var/log/apache2 in the apache2.2-common package.
+ Closes: #390786
+ * Install suexec.8 as suexec2.8. Closes: #390774
+ * Make sure that we never ship .svn directories in any binary packages.
+ Closes: #390785
+ * Not only chmod -x /usr/sbin/apache2 in apache2.2-common.preinst, chmod
+ +x it in same's postinst too. Closes: #390794
+ * We now ship htcacheclean in apache2-utils. Closes: #376680
+ * Try to stop old apaches in preinst of the mpms. Closes: #390893
+ * Make apache2-mpm-{worker,prefork} conflict with apache2-mpm-event and
+ apache2-common.
+ * rm -f /var/lib/dpkg/info/apache2-common.postrm. So apache2-common can
+ be purged. Yes, we're on crack. Closes: #390823
+ * Make apache2-utils's Replaces on apache2-common be unversioned.
+ Closes: #391018
+ * Stop shipping cern_meta.load, dumpio.load and ext_filter.load. Thanks
+ to Stephane Chazelas for noticing. Closes: #391393
+
+ -- Tollef Fog Heen <tfheen@debian.org> Tue, 3 Oct 2006 10:03:48 +0200
+
+apache2 (2.2.3-1) unstable; urgency=low
+
+ * Remove mention of AddDefaultCharset from apache2.conf as this is now
+ in /etc/apache2/conf.d/charset.
+ * Rename apache2-common to apache2.2-common. Conflict and replace old
+ version. This is to force modules to be uninstalled until versions
+ compiled against 2.2 are provided.
+ * Remove Daniel Stone from list of uploaders.
+ * We no longer ship 035_HEAD_Content-Length_Fix_From_CVS. Closes: #298143
+ * Don't start the server on reload. Closes: #316321
+ * Install S91/K09 links, not S91/K91, also only support not starting
+ through defaults file to cover upgrades from old
+ installations. Closes: #359977, #349655
+ * Big cleanup by using dh_install properly rather than loads of hacks in
+ debian/rules.
+ * No longer ship compat symlinks for ab, etc. Those are installed as
+ ab, htpasswd and similar.
+ * Remove apache2-mpm-{event,worker}-{prerm,preinst,postinst} in clean,
+ as those are copies of other files.
+ * Add build-depends for libapr1-dev (>= 1.2.7-6) to make sure we get a
+ version which ships a useful apr-config --apr-libtool.
+ * chmod -x /usr/sbin/apache2 on upgrades from before 2.2 to avoid
+ problems stopping apache due to some dpkg bug.
+ * Add Conflicts for broken modules which didn't depend on
+ apache2-common.
+
+ -- Tollef Fog Heen <tfheen@debian.org> Thu, 17 Aug 2006 14:02:58 +0200
+
+apache2 (2.2.3-1~exp.r170) experimental; urgency=low
+
+ [ Jeroen van Wolffelaar ]
+ * Staging upload to experimental of subversion revision r170
+
+ [ Thom May, Tollef Fog Heen, Fabio M. Di Nitto and Adam Conrad ]
+ * New Upstream Release. Closes: #344072
+ http://httpd.apache.org/docs/2.2/new_features_2_2.html has a list of
+ new features and changes.
+ - Fixes LFS support. Closes: #341460, #285337, #241223
+ - Fixes off-by-one error in mod_rewrite ldap schema handling
+ (CVE-2006-3747)
+ - Fixes XSS issue in mod_imap/mod_imagemap (CVE-2005-3352).
+ Closes: #343467.
+ - mpm_perchild no longer exists, so closing bugs for perchild.
+ Closes: #236193, #238586
+ - Fixes PHP POST with SSLVerifyClient. Closes: 353443
+ * Build-depend on lsb-release and pick up the branding from there.
+ * Build-depend on apr-util 1.0 which is now in a separate source
+ package.
+ * Mangle the Debian layout to be more FHS compatible
+ * No longer build-conflict with libgdbm-dev
+ * Use external PCRE
+ * Make apache2-utils stop providing apache2-utils. Also make it stop
+ conflicting with itself.
+ * Rename default site from default-site to just default.
+ * Try to migrate modules which used to be built-in:, alias, mime,
+ authz_host, autoindex, dir, env, negotiation, setenvif, status.
+ * Mod imap has been renamed to imagemap, ditto for auth_ldap =>
+ authnz_ldap. Cope with that in postinst.
+ * Stop globbing in apache2.conf.
+ Closes: #337817, #340955, #348189, #379015, #368497
+ * Don't install CHANGES into the apache2 package. It's just a
+ metapackage.
+ * Add rudimentary rdeps handling to a2dismod. Closes: #273929
+ * Stop providing apache-utils.
+ * Cope with /var/run and /var/lock on tmpfs.
+ * Remove all subdirs in srclib as we are using external libraries for
+ those anyway. Also remove test/zb.c. Closes: 340538
+ * Make ssl.conf not block on /dev/random, but rather use /dev/urandom.
+ * Make apache2-common depend on lsb-base, thanks to Gleb Arshinov
+
+ -- Jeroen van Wolffelaar <jeroen@wolffelaar.nl> Tue, 15 Aug 2006 16:17:33 +0200
+
+apache2 (2.0.55-4.1) unstable; urgency=high
+
+ * Non-maintainer upload. Urgency set to high due to security fixes.
+ * Added '052_mod_rewrite_CVE-2006-3747' to fix the off-by-one bug in
+ mod_rewrite.
+ [CVE-2006-3747]. (Closes: #380182)
+ * Added '053_restore_prefix_fix' to allow rebuilding from source.
+ (Closes: #374160)
+ * Added '054_apr_sendfile' to allow building for Hurd.
+ (Closes: #349416)
+ * Added '055_expect_CVE-2006-3918' to fix XSS attack in Expect headers.
+ [CVE-2006-3918]. (Closes: #381376)
+ * Added bash-completion script from Guillaume Rousse.
+ (Closes: #299855)
+
+ -- Steve Kemp <skx@debian.org> Sat, 5 Aug 2006 21:35:53 +0000
+
+apache2 (2.2.0-1) UNRELEASED; urgency=low
+
+ * New upstream release.
+
+ -- Fabio M. Di Nitto <fabbione@fabbione.net> Thu, 26 Jan 2006 13:46:08 +0100
+
+apache2 (2.0.55-4) unstable; urgency=low
+
+ * Add 050_mod_imap_CVE-2005-3352 to escape untrusted referer headers in
+ mod_imap before outputting HTML to avoid XSS attacks; see CVE-2005-3352
+ * Add 051_mod_ssl_CVE-2005-3357 to avoid a remote denial of service in
+ threaded MPMs when making a non-SSL connection to an SSL-enabled port
+ on a server with a custom 400 error document defined; see CVE-2005-3357
+ * Clean up our use of trailing slashes on directories in debian/rules, so
+ the newer, pickier, obviously very improved coreutils doesn't bite us.
+ * Remove some cruft from apache2-common's postinst, dealing with upgrade
+ scenarios from versions older than those released in Sarge or Warty.
+ * Use "SHELL := sh -e" in debian/rules, so the build will stop on shell
+ errors, instead of blundering on to later make targets (closes: #340761)
+ * Recreate /var/run/apache2 and /var/lock/apache2 in our init script, in
+ case the user has /var/run and /var/lock on tmpfs, which is fasionable.
+ * Make our init script a /bin/bash script instead of a /bin/sh script, so
+ we can abuse it with regex globbing (#348189, #347962, #340955, #342008)
+ * Take patch from Adrian Bridgett to output errors from our config test
+ in the init script, but only do so when we're VERBOSE (closes: #339323)
+ * In the spirit of the LSB, make our init script exit 2 when called with
+ incorrect arguments, and exit 4 when asked for status (closes: #330275)
+ * Fix the default site to not mix configuration syntax (closes: #345922)
+ * Mention apxs2 in the apache2-*-dev long descriptions (closes: #307921)
+
+ -- Adam Conrad <adconrad@0c3.net> Sat, 26 Nov 2005 19:06:32 +1100
+
+apache2 (2.0.55-3) unstable; urgency=low
+
+ * Brown paper bag release: Tidy up CFLAGS and APR configure call to make
+ sure that what we link to agrees with what apu-config tells others to do.
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 24 Oct 2005 13:02:52 +1000
+
+apache2 (2.0.55-2) unstable; urgency=low
+
+ * Mess with 010_more_fhs_compliancy to nail down the compiled default for
+ cgisock to match with the default shipped in the config file, so people
+ don't get confused if they miss including cgid.conf (closes: #316477)
+ * Make the compiled-in PidFile match the config file for similar reasons.
+ * Add 049_apr_tables_HEAD_cleanup, resolving an issue where merging two
+ tables from different resource pools would leave you with the contents
+ of only one, rather than both. This patch also cleans up some broken
+ pointer arithmetic and type casting along the way (closes: #251800)
+ * Specify the DocumentRoot without a trailing slash (closes: #311317)
+ * Fix the manpage to point at proper locations (closes: #307665, #332619)
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 23 Oct 2005 13:24:39 +1000
+
+apache2 (2.0.55-1) unstable; urgency=low
+
+ * New upstream bugfix and security release, superseding these patches:
+ - Drop 041_util_ldap_fix.patch, util_ldap seems to be unbroken.
+ - Drop 043_ssl_off_by_one_CAN-2005-1268, fixed upstream.
+ - Drop 044_content_length_CAN-2005-2088, fixed upstream.
+ - Drop 045_byterange_CAN-2005-2728, fixed upstream.
+ - Drop 046_verify_client_CAN-2005-2700, fixed upstream.
+ - Resolves a serious memory leak in the worker MPM; see CVE-2005-2970
+ - Add 048_reverse_proxy_fix, to resolve a regression in 2.0.55 with
+ mod_proxy, mod_ssl and HTTP POST requests (upstream bug #37145)
+ * New release builds cleanly with OpenSSL 0.9.8 (closes: #332791, #333363)
+ * Fix up our built-in version of DBS to use find's -{max,min}depth
+ arguments in a way that doesn't make find whine like a spoiled child.
+ * Merge Ubuntu and Debian packaging, bringing in patch 047 (closes: #327269)
+ - Comment out the / -> /apache2-default/ redirect, as user feedback seems
+ to indicate that it's just too bloody confusing for most people.
+ - New installations (only) now get an AddDefaultCharset UTF-8 directive.
+ * Build-depend on lsb-release, and use it in debian/rules to determine which
+ distribution we're building on, dropping the 007_debian_advertising patch.
+ * Drop debconf dependency entirely; we don't even use it (closes: #331741)
+ * Finally support DEB_BUILD_OPTIONS="noopt debug" properly in debian/rules.
+ * Adjust mime_magic.conf to point at the new FHS location of magic.mime.
+ * Drop the apache2-mpm-threadpool transitional package; Sarge is released.
+ * Try a bit harder to find the *CORRECT* PidFile directive in the init
+ script, instead of the old "rgrep and pray" method (closes: #303076)
+ * Make init script to always use apache2ctl consistently (closes: #316303)
+ * Build (and have -dev packages depend on) libdb4.3 instead of libdb4.2.
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 17 Oct 2005 13:00:13 +1000
+
+apache2 (2.0.54-5ubuntu2) breezy; urgency=low
+
+ * Add 047_ssl_reneg_with_body, which adds a (bounded) buffer of request
+ body data to provide a limited but safe fix for the mod_ssl renegotiation
+ vs requests-with-bodies bug, as occurs with POST and SVN (Ubuntu #14991)
+
+ -- Adam Conrad <adconrad@ubuntu.com> Tue, 4 Oct 2005 11:53:01 +1000
+
+apache2 (2.0.54-5ubuntu1) breezy; urgency=low
+
+ * Resynchronise with Debian, bringing in several security patches.
+
+ -- Adam Conrad <adconrad@ubuntu.com> Mon, 5 Sep 2005 20:40:31 +1000
+
+apache2 (2.0.54-5) stable-security; urgency=high
+
+ * Add 043_ssl_off_by_one_CAN-2005-1268, fixing an off-by-one error in SSL
+ certificate validation; see CAN-2005-1268 (closes: #320048, #320063)
+ * Add 044_content_length_CAN-2005-2088, resolving an issue in mod_proxy
+ where, when a response contains both Transfer-Encoding and Content-Length
+ headers, the connection can be used for HTTP request smuggling and HTTP
+ request spoofing attacks; see CAN-2005-2088 (closes: #316173)
+ * Add 045_byterange_CAN-2005-2728, to resolve a denial of service in apache
+ when large byte ranges are requested; see CAN-2005-2728 (closes: #326435)
+ * Add 046_verify_client_CAN-2005-2700, resolving an issue where the context
+ of the SSLVerifyClient directive is not honoured within a <Location>
+ nested in a <VirtualHost>, and is left unenforced; see CAN-2005-2700
+
+ -- Adam Conrad <adconrad@0c3.net> Fri, 2 Sep 2005 22:26:28 +1000
+
+apache2 (2.0.54-4) unstable; urgency=low
+
+ * Alter 041_util_ldap_fix.patch to revert util_ldap.c to the known
+ good version from 2.0.53 (closes: #308648, and re-fixes #307567)
+
+ -- Adam Conrad <adconrad@0c3.net> Wed, 11 May 2005 20:15:38 -0600
+
+apache2 (2.0.54-3) unstable; urgency=medium
+
+ * Add 042_htdigest_CAN-2005-1344 to fix a buffer overflow in
+ htdigest, which is described in CAN-2005-1344 (closes: #307134)
+ * Add 041_util_ldap_fix.patch from upstream bug #34618 to fix
+ issues with mod_auth_ldap sometimes segfaulting and sometimes
+ locking up and spinning the CPU to oblivion (closes: #307567)
+ * Alter 011_fix_ap-config to make apr-config point us at the system
+ libtool, and make libapr0-dev depend on libtool (closes: #306481)
+ * Alter 008_make_include_safe to prevent apache2 from including dpkg
+ conffile leftovers (.dpkg-old et al) (closes: #304786, #296728)
+
+ -- Adam Conrad <adconrad@0c3.net> Thu, 5 May 2005 03:45:24 -0600
+
+apache2 (2.0.54-2) unstable; urgency=low
+
+ * Set suexec2's ownership properly, so it's actually executable by
+ apache2 with the newly-restrictive permissions (closes: #305242)
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 18 Apr 2005 22:09:42 -0600
+
+apache2 (2.0.54-1) unstable; urgency=low
+
+ * New upstream bugfix-only release (closes: #305121)
+ * Fix debian/watch file to only look at apache 2.0.x, so we stop being
+ told about the 2.1 beta releases (and I'll notice new 2.0.x releases)
+ * Drop o+rx permissions from suexec2; while it has code in place to
+ make sure the caller is www-data, if that code should be buggy,
+ filesystem permissions will help mitigate fallout (closes: #301045)
+ * Update the 003_build_with_autoconf_2.5 patch to make sure both
+ apr and apr-util have an AC_PREREQ for autoconf 2.50, so we don't get
+ weird autoconf mix-and-match FTBFS issues (closes: #301819)
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 17 Apr 2005 23:10:18 -0600
+
+apache2 (2.0.53-5ubuntu5) hoary; urgency=low
+
+ * Fix the init script to not exit with an error when asked to
+ stop a daemon that isn't running (Was the root cause of #8374)
+
+ -- Adam Conrad <adconrad@0c3.net> Fri, 1 Apr 2005 16:30:56 +0000
+
+apache2 (2.0.53-5ubuntu4) hoary; urgency=low
+
+ * Make sure package removals don't fail even if the init script
+ doesn't stop apache2 (Ubuntu #8374)
+
+ -- Adam Conrad <adconrad@0c3.net> Fri, 1 Apr 2005 15:07:20 +0000
+
+apache2 (2.0.53-5ubuntu3) hoary; urgency=low
+
+ * Add dependency on lsb-base (>= 1.3-9ubuntu2) to guarantee
+ availability of lsb init functions (Ubuntu #7765)
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 27 Mar 2005 21:55:41 -0700
+
+apache2 (2.0.53-5ubuntu2) hoary; urgency=low
+
+ * Really remove /etc/apache2/conf.d/charset on purge, rather
+ than just writing about it in the changelog.
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 27 Mar 2005 08:32:39 -0700
+
+apache2 (2.0.53-5ubuntu1) hoary; urgency=low
+
+ * Resynchronise with Debian, resolving minor conflicts.
+ * Remove /etc/apache2/conf.d/charset on purge.
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 27 Mar 2005 15:15:44 +0000
+
+apache2 (2.0.53-5) unstable; urgency=high
+
+ * Update 040_link_external_pcre to require autoconf 2.50, so it
+ doesn't fail when autoconf2.13 is installed (closes: #295428)
+ * Further mangle the apache_stop function in the init script so it
+ attempts as hard as possible to make sure apache2 is stopped before
+ it tries to restart. Thanks to Andre Tomt <andre@tomt.net> for
+ the bug and patch this fix was based on (closes: #295915, #281557)
+
+ -- Adam Conrad <adconrad@0c3.net> Fri, 25 Feb 2005 00:51:13 -0700
+
+apache2 (2.0.53-4) unstable; urgency=low
+
+ * Add 040_link_external_pcre to allow us to link to an external libpcre
+ rather than statically compiling the bundled version.
+ * Add --with-external-pcre to the configure flags in debian/rules
+ (closes: #294673, #294675, #282606, #294740)
+ * Stop hardcoding the path to netstat in postinst (closes: #294737)
+
+ -- Adam Conrad <adconrad@loki.0c3.net> Mon, 14 Feb 2005 01:45:08 +0000
+
+apache2 (2.0.53-3) unstable; urgency=medium
+
+ * Drop Andres Salomon's PCRE manglig patch in favour of hand-merging
+ Joe Orton's patch against head to completely internalise apache's
+ copy of PCRE, only exposing a wrapper API. (closes: #294395)
+
+ -- Adam Conrad <adconrad@0c3.net> Wed, 9 Feb 2005 11:30:21 -0700
+
+apache2 (2.0.53-2) unstable; urgency=low
+
+ * Make apache2-threaded-dev and apache2-prefork-dev both arch:any
+ as they contain architecture-dependant defines (closes: #294257)
+
+ -- Adam Conrad <adconrad@0c3.net> Wed, 9 Feb 2005 04:20:07 -0700
+
+apache2 (2.0.53-1) unstable; urgency=low
+
+ * New upstream release
+ - Remove 036_HEAD_CAN-2004-0942, integrated upstream
+ - Remove 037_HEAD_CAN-2004-0885, integrated upstream
+ * Drop support for the threadpool MPM, as it's abandoned upstream.
+ - Make apache2-mpm-threadpool an empty package depending on
+ apache2-mpm-worker, and make worker replace the old threadpool
+ * Make SYSCONFDIR configurable at the top of a2{en,dis}{mod,site}
+ * Drop the build-conflict on gawk, and use ac_cv_prog_AWK=mawk
+ instead (closes: #283396)
+ * Make the apache_stop() function stop trying to do the equivalent
+ of "killall apache2", and instead issue a nasty warning if it can't
+ stop apache2 on its own
+ * Make "restart" an alias for "force-reload" in the init script, as
+ apache2ctl restart doesn't match policy's requirements for restart
+ * Swapping between threaded and unthreaded MPMs could leave one with
+ both mod_cgi and mod_cgid enabled. Fixed the postinsts so that
+ no longer happens
+ * Update 021-pcre_mangle_symbols.patch from Andres Salomon, now also
+ mangling typedefs, which should fix PHP (closes: #280823)
+ * Hardcode a dependency on libgcc1 (>= 1:3.3.5) so pthread_cancel
+ will work correctly with partial upgrades (closes: #287033)
+ * When removing ssl_scache, make sure to remove its db transation logs
+ and other garbage as well (closes: #293831)
+ * Remove duplicate /icons/ from the default site (closes: #291856)
+ * Yank 039_fix_forensic_tmpfiles from Ubuntu's apache2 packages
+ * Split out utils into seperate apache2-utils. This will also
+ supercede the apache-utils package (closes: #285219)
+ * Add split-logfile to apache2-utils (closes: #290814)
+ * Make the MPM postinsts scream loudly, but not fail, if you've
+ deleted cgi{,d}.load before swapping MPMs (closes: #283141)
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 7 Feb 2005 07:54:12 -0700
+
+apache2 (2.0.52-3) unstable; urgency=high
+
+ * Brown paper bag release to fix apache2-common's postinst, by judiciously
+ sprinkling ||true in a couple of needed places (closes: #280527)
+ * While hunting for unclean uses of VAR=`command` in the package, found
+ the cause of the "can't purge with broken config" bugs and fixed that
+ too with yet another ||true (closes: #263511, #273759, #279875)
+
+ -- Adam Conrad <adconrad@0c3.net> Wed, 10 Nov 2004 01:32:16 -0700
+
+apache2 (2.0.52-2) unstable; urgency=high
+
+ * Include two patches, 036_HEAD_CAN-2004-0942 and 037_HEAD_CAN-2004-0885
+ - CAN-2004-0942: Memory leak in header parsing in server/protocol.c
+ - CAN-2004-0885: Incorrect SSLCipherSuite selection in mod_ssl
+ * Fix up our use of netstat in apache2-common's postinst to clean up some
+ unnecessary output to stderr, as well as detect when netstat believes
+ we don't have AF_INET support. This should allow for installation in
+ chroots where the /proc filesystem isn't mounted (closes: #245487)
+ * Add 035_HEAD_Content-Length_Fix_From_CVS, which should solve problems
+ with Content-Length being set incorrectly on proxied HEAD requests,
+ breaking Windows Update from proxied machines (closes: #277787)
+ * Take out the reload/start magic in the postinst, and just call start in
+ all cases, as we stop the daemon in the prerm (closes: #275175, #222786)
+ * Copy config.guess/config.sub/ltmain.sh in from /usr/share/libtool at
+ build time. (closes: #257228, #263101)
+ * Clean up the clean target in debian/rules to remove some duplicate
+ maintainer scripts from the debian/ directory that we don't need to be
+ shipping in the source package.
+ * Move envvars to /etc/apache2/ and add patch 038_no_LD_LIBRARY_PATH to
+ remove the extraneous LD_LIBRARY_PATH from envvars (closes: #276670)
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 7 Nov 2004 04:09:46 -0700
+
+apache2 (2.0.52-1) unstable; urgency=high
+
+ * New upstream bugfix/security release:
+ - Fixes CAN-2004-0811: Satisfy directive bypass (closes: #273412)
+ * Add '|| true' to a2enmod to stop it from dying when the installed MPM
+ isn't prefork (closes: #273017, #273019, #272865, #273021, #273258)
+ * Touch /var/log/apache2/error.log on new installs to ensure that our log
+ directory isn't removed until the package is purged, so logrotate doesn't
+ complain about its inability to find it (closes: #239571)
+ * Add 032_suexec_is_shared, which makes sure suEXEC is only searched for
+ and enabled when mod_suexec is loaded (closes: #227653)
+ * Use '$APACHE2CTL startssl' consistently in init script to make sure the
+ SSL define doesn't disappear on force-reload (closes: #272531)
+ * Add 033_dbm_read_hash_or_btree to allow apr-util and dbmmanage to open
+ and manipulate DB_BTREE databases, while still defaulting to creating
+ DB_HASH databases as before. This should clear up incompatibilities
+ with other applications (such as PHP) which default to DB_BTREE.
+ * Moved dbmmanage2 to /usr/bin, instead of /usr/sbin, as it's a user tool.
+ * Added 034_ab2_has_openssl, thanks to 2.1-cvs, Fedora, thom, and a bit
+ of munging, to compile a working ab2 with SSL support (closes: #261820)
+
+ -- Adam Conrad <adconrad@0c3.net> Tue, 28 Sep 2004 10:21:20 -0600
+
+apache2 (2.0.51-2) unstable; urgency=high
+
+ * Test for the existence of /usr/sbin/apache2 before we go trying to invoke
+ it to determine what MPM we have installed (closes: #272103, #272207)
+ * Make the default httpd.conf created in apache2-common's postinst contain
+ a fake LoadModule line (commented out), and make apxs2 default to
+ installing modules to /etc/apache2/httpd.conf, so people using apxs2
+ rather than the mods-{enabled,available} directories get the expected
+ behaviour, rather than obscure errors (closes: #167552, #231134)
+ * apxs2 now writes the correct path to modules in httpd.conf, including
+ the mysteriously missing slash (closes: #231450, #167557)
+ * Make apxs2 install modules with mode 644, since 755 makes no sense.
+ * Added a bit of magic to a2{en,dis}site to treat the default site as a
+ special case and add a "000-" priority to the beginning of its symlink.
+ Patches welcome to turn this into something robust, like update-rc.d.
+
+ -- Adam Conrad <adconrad@0c3.net> Sat, 18 Sep 2004 07:12:12 -0600
+
+apache2 (2.0.51-1) unstable; urgency=high
+
+ * New upstream release, including the following security fixes:
+ - CAN-2004-0747: ap_resolve_env buffer overflow
+ - CAN-2004-0786: apr_uri_parse segfault in memcpy
+ - CAN-2004-0809: mod_dav crash/DoS via NULL pointer dereference
+ * Drop the following patches which are now included upstream:
+ - 025_CAN-2004-0748.patch
+ - 026_CAN-2004-0751.patch
+ - 027_autoindex_ignore_bad_files.patch
+ - 028_apr_sticky_bits.patch
+ * Install a properly sanitised config_vars.mk so that apxs2 behaves in
+ a reasonably sane way (closes: #243340, #270768)
+ * Relax www-browser dependency to a Suggests, as the mod_status dump from
+ apache2ctl is a pretty minor (and oft unused) feature (closes: #269309)
+ * init script now allows you to stop (but not start, restart, etc) the web
+ server, even if NO_START is set to 1 (closes: #269398)
+ * Make the apache2 -> apache2-mpm-* dependency tighter, so it does what
+ one expects when installing it (closes: #269580)
+ * Remove the ^/doc/apache2-doc/manual(.*)$ /manual$1 RedirectMatch from
+ the default site which was confusing and useless (closes: #270216)
+ * Add debian/watch file to track upstream versions.
+ * Add some magic to a2enmod to map cgi to cgid if using a threaded MPM.
+ * Add a2ensite and a2dissite which do the same thing as a2{en,dis}mod,
+ but for sites rather than modules (closes: #269251)
+
+ -- Adam Conrad <adconrad@0c3.net> Wed, 15 Sep 2004 00:09:39 -0600
+
+apache2 (2.0.50-12) unstable; urgency=high
+
+ * Build-depend on mawk, and build-conflict with gawk, as we're only
+ guaranteed of having one or the other installed at any given time
+ and GNU awk seems to royally mess up the build with regards to which
+ external symbols get exported by httpd (closes: #268155)
+ * Add myself to the Uploaders field as it seems that, for better or
+ worse, I have become a co-maintainer of apache2.
+ * Drop the :80 from the default site config, so changing ports in
+ ports.conf now Just Works (closes: #253271)
+ * Added 029_docroot_manual.patch, which corrects the links in the start
+ page to point to /manual/ instead of manual/, so the link actually
+ works when apache2-doc is installed (closes: #232954)
+ * Add a postrm to apache2-common, implementing a policy-compliant purge
+ process (closes: #237030, #252254, #197986)
+ * Add a simple RedirectMatch to the "default" site, so that fresh
+ installations see the default start page, rather than a directory
+ listing (closes: #240772, #255974, #264070)
+ * Add 030_www-browser_apachectl.patch, and make apache2-common depend
+ on www-browser, so 'apache2ctl status' works (closes: #266724)
+ * Move apache2's (re)start from the apache2-common postinst to the MPM
+ postinsts, so we're not trying to start the old binary if apache2-common
+ is configured before apache2-mpm-* is unpacked (closes: #268936)
+ * Enable CGI on initial installation, as packages depending on httpd-cgi
+ require it to be running to work (closes: #267547, #263038)
+ * Only enable userdir on upgrades from older versions where it was
+ built-in, or on fresh installs.
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 30 Aug 2004 17:40:47 -0600
+
+apache2 (2.0.50-11) unstable; urgency=high
+
+ * Add two patches from upstream to address two vulnerabilities in mod_ssl:
+ - CAN-2004-0748 is a potential infinite loop in the SSL input filter
+ which can be triggered by an aborted connection.
+ - CAN-2004-0751 is a potential segfault in the SSL input filter which
+ can be triggered by the response to request which is proxied to a
+ remote SSL server.
+ * Changed the ownership of /var/cache/apache2 to allow mod_proxy to
+ actually cache files (closes: #264622)
+ * Added a patch from upstream to make mod_autoindex skip over files that
+ it can't stat() (closes: #264645)
+ * New installations now get an /etc/default/apache2 file with a moderately
+ informative comment, and the default set sanely (closes: #263515)
+ * Added a patch from upstream to make APR stop creating directories with
+ the sticky bit set (closes: #266198)
+ * Remove the bogus "-e" from the echo that creates httpd.conf, so people
+ installing with ash/dash don't get a broken file (closes: #267693)
+
+ -- Adam Conrad <adconrad@0c3.net> Mon, 23 Aug 2004 19:25:50 -0600
+
+apache2 (2.0.50-10) unstable; urgency=high
+
+ * Roll back the libapr0 ABI changes introduced in 2.0.50-9. We were
+ hopeful that we could hunt down and fix any fallout from this change
+ before release, and we were, apparently, wrong.
+ (closes: #266211, #266145, #266165, #266330, #266230, #266279, #266736)
+
+ -- Adam Conrad <adconrad@0c3.net> Thu, 19 Aug 2004 03:46:11 -0600
+
+apache2 (2.0.50-9) unstable; urgency=medium
+
+ * Enable LFS properly. (Closes: #264645, #244897)
+ - Added 023_largefiles_upstream_fixes which makes the upstream configure
+ script a bit smarter and fixes some misuses of size_t/off_t.
+ - Added 024_largefiles_debian_hacks which adds some hideous hackery to
+ work around a bug in glibc where sendfile64 is used in place of sendfile
+ with no fallback even if the current kernel doesn't support it.
+ - Add note to README.Debian noting that while we can now read, write, and
+ list large files, SERVING large files is kernel-dependant.
+ * Bump libapr0 shlibs to (>= 2.0.50-9), since we're introducing
+ some serious ABI breakage with the above changes.
+ * Fix up the PATH in apache2's init script to list /usr/local, /usr, /
+ in the standard order.
+ * Change misleading return messages for a2{en,dis}mod, to reflect
+ the reality that some modules just won't load/unload properly
+ without a full stop/start server cycle.
+
+ -- Adam Conrad <adconrad@0c3.net> Sun, 15 Aug 2004 07:41:19 -0600
+
+apache2 (2.0.50-8) unstable; urgency=high
+
+ * Ensure we link against the correct version of DB42
+
+ -- Thom May <thom@debian.org> Mon, 9 Aug 2004 14:37:38 +0100
+
+apache2 (2.0.50-7) unstable; urgency=high
+
+ * Fix up linking of apr-util (Closes: #262009)
+
+ -- Thom May <thom@debian.org> Tue, 3 Aug 2004 12:42:53 +0100
+
+apache2 (2.0.50-6) unstable; urgency=high
+
+ * use 'env -i' rather than trying to parse env (Closes: #261558, #258713)
+ * revert to old build process (Closes: #260756, #259693)
+ * Reflect changes in ssl setup - Thanks, Björn Wiberg (Closes: #259414)
+ * Remove userdir config from main config file (Closes: #260058)
+
+ -- Thom May <thom@debian.org> Tue, 27 Jul 2004 10:31:46 +0100
+
+apache2 (2.0.50-5) unstable; urgency=high
+
+ * Add necessary suexec information to central build
+ (Closes: #258453, #258772)
+ * Exclude lines starting with a space from removal from the env
+ (Closes: #258713)
+
+ -- Thom May <thom@debian.org> Mon, 12 Jul 2004 17:30:59 +0100
+
+apache2 (2.0.50-4) unstable; urgency=high
+
+ * Fix dependencies so the MPMs don't conflict with the metapackages *g*
+ Thanks to Adam Conrad for this catch
+
+ -- Thom May <thom@debian.org> Fri, 9 Jul 2004 00:55:19 +0100
+
+apache2 (2.0.50-3) unstable; urgency=high
+
+ * Brown paper bag of epic proportion. Build all mpms with the proper
+ collection of libraries. (Closes: #258217, #258202)
+ * Clean up environment (Closes: #241579)
+ * Clarify prefork description (Closes: #252918)
+ * Make apache2-default/manual DTRT (Closes: #244847)
+ * Note that we don't ship INSTALL or README.platforms (Closes: #232956)
+
+ -- Thom May <thom@debian.org> Thu, 8 Jul 2004 16:04:31 +0100
+
+apache2 (2.0.50-2) unstable; urgency=high
+
+ * Make a2enmod a bit more robust (Closes: #258149, #258145)
+ * Should really be urgency=high to get into testing quick
+
+ -- Thom May <thom@debian.org> Wed, 7 Jul 2004 23:03:36 +0100
+
+apache2 (2.0.50-1) unstable; urgency=medium
+
+ * New upstream release, fixes [CAN-2004-0493] and [CAN-2004-0488]
+ * The "I can't believe you're late to your own raid" release
+ * Check whether verbose is on or off in rcS's config (Closes: #242351)
+ * Add an apache2 metapackage (Closes: #234955)
+ * Specifically disable /~root (Closes: #246139)
+ * Stop the daemon in prerm (Closes: #245488)
+ * Redirect /doc/apache2-doc/manual to /manual so the correct magic happens
+ (Closes: #248038)
+ * Update SSL config to current upstream (Closes: #234591,#231147)
+ * No longer install default cgis - they're already shipped in -doc as
+ examples. (Closes: #231665)
+ * Tighten regex for Include (Closes: #234489)
+ * Remove ext-filter.load since we ship ext_filter.load too (Closes: #249268)
+ * Enable userdir as a shared module (Closes: #251102, #246134)
+ * OSKURO SUCKS (otherwise known as: not a bug) (Closes: #208569)
+ * Create /var/lib/apache2 (Closes: #242169)
+ * Remove 'AddDefaultCharset' line from apache2.conf (Suggestion from Marco
+ D'Itri)
+
+ -- Thom May <thom@debian.org> Tue, 6 Jul 2004 18:45:35 +0100
+
+apache2 (2.0.49-1) unstable; urgency=high
+
+ * New Upstream release. (Closes: #240100)
+ * Add missing $ to init-script (closes: #240301)
+ * Provides: httpd-cgi in reference to #117916
+
+ -- Thom May <thom@debian.org> Sun, 4 Apr 2004 11:32:20 +0100
+
+apache2 (2.0.48-8) unstable; urgency=low
+
+ * Fix typo in debian/rules (closes: #230760)
+ * Added patch 021-pcre_mangle_symbols.patch (closes: #235810)
+ * Fixed typo in the init scripts (closes: #230263)
+ * Changed a bunch of mv's to cp's in rules (closes: #228840)
+ * Change mime_magic to use magic from libmagic1 (closes: #236509)
+ * Disable ssl-cert until it sucks less. related to 230791 (closes: #231726)
+ * update descriptions (closes: #234543, #234538, #234542)
+ * Nuke /etc/vhosts and all associated cruft (closes: #235029)
+
+ -- Thom May <thom@debian.org> Mon, 2 Feb 2004 12:47:10 +0000
+
+apache2 (2.0.48-7) unstable; urgency=low
+
+ * Brown paper bag release. Refix the nonfixed libapr0 which built
+ without linking information.
+
+ -- Tollef Fog Heen <tfheen@debian.org> Fri, 30 Jan 2004 18:25:12 +0100
+
+apache2 (2.0.48-6) unstable; urgency=low
+
+ * Build-Conflict with gdbm (closes: #230226, #230175, #204672)
+
+ -- Tollef Fog Heen <tfheen@debian.org> Fri, 30 Jan 2004 12:24:09 +0100
+
+apache2 (2.0.48-5) unstable; urgency=low
+
+ * (Daniel Stone)
+ - Bump Standards-Version to 3.6.1.0.
+ - init-script: Print a small warning when NO_START=1. (closes: #178431)
+ - default site: Enable FollowSymLinks. (closes: #200829)
+ * (Thom May)
+ - Permanently kill the ErrorLog directive from ssl.conf
+ - Call ssl-cert to generate an SSL cert using debconf (closes: #178322)
+ - Allow /usr/share/doc/ to be viewable from localhost (closes: #222551)
+ - Set the default DocumentRoot to be /var/www (closes: #222552)
+ - Change where the init script is installed to (Closes: #223417)
+ - Upgrade to DB4.2
+ * (Tollef Fog Heen)
+ - handle building out of the SVN checkout.
+
+ -- Tollef Fog Heen <tfheen@debian.org> Wed, 28 Jan 2004 00:13:13 +0100
+
+apache2 (2.0.48-4) unstable; urgency=medium
+
+ * (Daniel Stone)
+ - Change apache2-threaded-dev's Conflicts from apache2-perfork-dev to
+ apache2-prefork-dev. Learn how to type, dude (thanks to Grzegorz
+ Prokopski for spotting this one).
+
+ -- Daniel Stone <daniels@debian.org> Mon, 17 Nov 2003 12:00:11 +1100
+
+apache2 (2.0.48-3) unstable; urgency=medium
+
+ * Grmmp. stuffed the upload
+
+ -- Thom May <thom@debian.org> Wed, 12 Nov 2003 18:18:54 +0000
+
+apache2 (2.0.48-2) unstable; urgency=high
+
+ * (Thom May)
+ - Fix locking busted by NPTL (Closes: #220299)
+ - Fix IPv6 weirdness (thanks to Jordi/Fabio) (Closes: #220334)
+
+ -- Thom May <thom@debian.org> Wed, 12 Nov 2003 13:04:04 +0000
+
+apache2 (2.0.48-1) unstable; urgency=low
+
+ * (Thom May)
+ - New Upstream Release (Closes: #202094)
+ - Fix i18n autonegotiation for the manual (Closes: #201648)
+ - Add deb.{gif,png} (Closes: #199454)
+ - Explicitly link against libdl (Closes: #195968)
+ - Add dependency on ssl-cert (Closes: #177837)
+ - Take preventative action against SCTP
+ - Add apache2-prefork-dev to work around PHP.
+ - Shut Oskuro up - startup time changed to 91 (Closes: #208569)
+ - Install README.etc into apache2-common's doc dir
+ (Closes: #208751,#177941)
+ - Auth_LDAP loads mod_ldap as well. (Closes: #217795)
+ - Make sure /var/lock/apache2 has correct ownership (Closes: #206375)
+ - Fix for SSL enabled virtual hosts (Closes: #202925)
+ - Steal new apr_threads.m4 from upstream to deal with -lpthread better
+ (Closes: #197685)
+ * (Fabio M. Di Nitto)
+ - Fixed init script (Closes: #203093)
+
+ -- Thom May <thom@debian.org> Sat, 16 Aug 2003 00:13:20 +0100
+
+apache2 (2.0.47-2) unstable; urgency=low
+
+ * Move dav.conf to dav_fs.conf (Closes: #201530)
+ * Fix the manual, and only ship it once. (Closes: #201648)
+ * Enable SymLinksIfOwnerMatch for cgi-bin (Closes: #200829)
+
+ -- Thom May <thom@debian.org> Wed, 16 Jul 2003 10:24:28 +0100
+
+apache2 (2.0.47-1) unstable; urgency=high
+
+ * New Upstream Release. Bunch of security fixes (Closes: #200593)
+ * Add asis.load, auth_ldap.load, cache.load, dav_fs.load, disk_cache.load,
+ ext_filter.load, file_cache.load, imap.load, ldap.load, mem_cache.load,
+ include.load (Closes: #197152, #198389, #196115)
+ Note that dav_fs was previously loaded by dav.load, and is now broken out
+ into a seperate file.
+ * Patch apxs2 to use datadir rather than prefix for top_builddir.
+ (Closes: #198607)
+ * Kill a couple of pointless conflicts. (Closes: #197242)
+ * Change suexec docroot from /var/www/apache2-default to /var/www
+ (Closes: #198981)
+ * Make sure we use Expat rather than xmltok (Closes: #197020)
+ * Ship find_ap{r,u}.m4 (per Nuutti Kotivuori)
+
+ -- Thom May <thom@debian.org> Fri, 4 Jul 2003 13:40:37 +0100
+
+apache2 (2.0.46-3) unstable; urgency=low
+
+ * Clean up the proxy config although it's not enabled by default.
+ (Closes: #195187)
+ * Remove all traces of gdbm. (Closes: #196231)
+ * Re-enable ldap support (Closes: #190092)
+ * This changelog should be policy compliant. Any whingers can take a long
+ hike off a short pier.
+ * use printf rather than echo to work round weird shells. (Closes: #196230)
+
+ -- Thom May <thom@debian.org> Thu, 5 Jun 2003 19:26:21 +0100
+
+apache2 (2.0.46-2) unstable; urgency=critical
+
+ * Fix config_vars.mk creation and installation (Closes: #195141, #195190)
+
+ -- Thom May <thom@debian.org> Thu, 29 May 2003 11:47:13 +0100
+
+apache2 (2.0.46-1) unstable; urgency=critical
+
+ * The "David Welton is my hero" release
+ * New upstream release, numerous security vulns fixed.
+ * Oh the pain.
+ * Move ScriptSocket to /var/run/apache2 (Closes: #188655)
+ * Restore mod_include (Closes: #188483)
+ * Move the virtual hosts config to the end of the config file
+ (Closes: #188584)
+ * Add Mod-Ext-Filter (Closes: #182770)
+ * Add actions.load (Closes: #178087, #179571, #181527)
+ * Add a dependency on net-tool (Closes: #190663)
+ * Clean up FHS compliancy and fix up a typo in apachectl (Closes: #187723)
+ * Fix for the apxs -q APR_BINDIR doesn't work problem (Closes: #188278)
+ * Special case the install of special.mk (Closes: #179776)
+ * Make apache2-dev and apache-dev not conflict. (This renames apxs back to
+ apxs2)
+ * Add README for /etc/apache2 written by David.
+ * Add auth_digest.load courtesy of Amelia A Lewis <amyzing@talsever.com>
+ (Closes: #194111)
+
+ -- Thom May <thom@debian.org> Wed, 28 May 2003 14:17:21 +0100
+
+apache2 (2.0.45-3) unstable; urgency=critical
+
+ * another "stupid freaking sasl" release. the series is on!
+
+ -- Thom May <thom@debian.org> Tue, 8 Apr 2003 17:13:09 +0100
+
+apache2 (2.0.45-2) unstable; urgency=critical
+
+ * the "stupid freaking sasl" release.
+ * fix override disparities too.
+ * fix dulpicate dependency on libssl0.9.7 (Closes: #179598)
+
+ -- Thom May <thom@debian.org> Tue, 8 Apr 2003 13:34:44 +0100
+
+apache2 (2.0.45-1) unstable; urgency=critical
+
+ * New upstream release (Closes: #187502)
+ * Fix korean language type, thanks to Donggyoo Lee
+ <donggyoo@kmaritime.ac.kr> (Closes: #179542)
+ * Add explicit dependency to libsasl-dev (Closes: #179674)
+ * Remove ErrorLog from ssl.conf
+ * forward ported patches courtesy of Roberto Moreda <moreda@debian.org>; big
+ thanks!
+
+ -- Thom May <thom@debian.org> Sat, 5 Apr 2003 14:35:58 +0100
+
+apache2 (2.0.44-6) unstable; urgency=low
+
+ * Make APR's postinst idempotent (Closes: #178105, #178141)
+ * Make Apache2-common's postinst non interactive (Closes: #178551)
+ * People filing bugs after they're fixed should be shot (Closes: #178244)
+ * Build Logio into the core, apparently.
+
+ -- Thom May <thom@debian.org> Mon, 27 Jan 2003 20:47:28 +0000
+
+apache2 (2.0.44-5) unstable; urgency=low
+
+ * The "someone should take my compiler away from me" release
+ * Depend on openssl as well. Grrr. (Closes: #177985)
+ * Clean up the last of the section mismatches
+
+ -- Thom May <thom@debian.org> Thu, 23 Jan 2003 15:04:20 +0000
+
+apache2 (2.0.44-4) unstable; urgency=low
+
+ * The "going for broke" release.
+ * Enable Logio, suggested by Roberto Moreda
+ * Stop force loading of cgi modules. (until we can do it cleanly)
+ (Closes: #177876, #177795)
+ * Restore symlink for libapr.so.0 (Closes: #177792)
+ * Apache2-common must depend on libssl0.9.7 (Closes: #177845)
+ * Rename ssl-certificate so we don't conflict with apache-ssl
+ (Closes: #177881)
+ * Only create the certificate if it's not there already (Duh!)
+
+ -- Thom May <thom@debian.org> Wed, 22 Jan 2003 09:59:11 +0000
+
+apache2 (2.0.44-3) unstable; urgency=low
+
+ * The "This one goes out wearing a brown paper bag" release
+ * Fix apxs to correctly return the header locations (Closes: #177729)
+
+ -- Thom May <thom@debian.org> Tue, 21 Jan 2003 16:35:14 +0000
+
+apache2 (2.0.44-2) unstable; urgency=low
+
+ * The "Ooops, I did it again" release
+ * Fixup of sections and priorities.
+ * Add dependency of libldap2-dev to libapr0-dev
+ * Correct dependencies to be db4.1 not db4.0
+
+ -- Thom May <thom@debian.org> Tue, 21 Jan 2003 13:26:57 +0000
+
+apache2 (2.0.44-1) unstable; urgency=low
+
+ * Conform to 10.4 of policy re init scripts, (Closes: #165693)
+ * Be more selective about filenames when doing Include
+ Patch - 008_make_include_safe (Closes: #161512)
+ * Make HTMLTable validate, and add a note recommending its use.
+ (Patch submitted upstream and will be in 2.0.44)
+ Patch - 010_fix_html_table (Closes: #153593)
+ * Make apr have correct library versioning
+ Patch committed upstream
+ Patch - 011_make_apr_versioned (Closes: #162775)
+ * Placed packaging code under subversion change management
+ http://svn.positive-internet.com/svn/apache2/trunk
+ * Changed some bash scripts to use #!/bin/bash rather than #!/bin/sh
+ (Closes: #168338)
+ * Changed apache2-common to merely suggest apache2-doc (Closes: #167595)
+ * Patch from David Kimdon to clean up debian/scripts/*
+ * Rename apxs2 to apxs; conflict with apache-dev (Closes: #167550)
+ * Upstream fix for AllowOverride documentation (Closes: #169431)
+ * Tighter build dependency on debhelper (Closes: #170803)
+ * Only reload in logrotate if apache2 is actually running (Closes: #171095)
+ * Upstream Fix for AddOutputFilterByType documentation (Closes: #172294)
+ * Add robots.txt to apache2-common (Closes: #172592)
+ * Enable cgi in postinst (Closes: #168709)
+ * Create an SSL Certificate on install (Closes: #168109)
+ * Fix a couple of typos in debian/ssl-certificate, with thanks to Nuutti
+ Kotivuori
+ * Change to restart rather than reload in logrotate, to work round a nasty
+ PHP bug (PHP has bugs? *gasp* I thought it was perfect!) with thanks to
+ Adam Conrad for the suggestion
+ * Clarify what needs to be installed for a working system (Thanks to Sean
+ Abrahams)
+ * Support debug DEB_BUILD_OPTIONS setting, thanks to Karl Hegbloom
+ (Closes: #174221)
+ * Add -pipe to the CFLAGS, thanks to Karl Hegbloom
+ * Force apr-util to build against db4
+ * add OSX finder to the list of things that needs to be redirect-carefully'd
+ * s/enabled/disabled in debian/a2-scripts/a2dismod (Closes: #173956)
+ * enable auth-ldap, auth-anon, auth-dbm, auth-digest, and action as shared
+ modules (Closes: #172044, #174583, #172093)
+ * Upgrade to Berkely DB 4.1
+ * Upgrade to OpenSSL 0.9.7
+ * Add patch to ensure DB4.1 --with-unique-names is picked up. (Committed
+ upstream)
+ * Add local apache2 and apache2ctl manpages, since upstream have removed
+ them.
+
+ -- Thom May <thom@debian.org> Mon, 20 Jan 2003 11:14:43 +0000
+
+apache2 (2.0.43-1) unstable; urgency=medium
+
+ * New Upstream Release; Fixes: CVE: CAN-2002-0840 CERT: VU#240329
+ * Add extra config to unfuck perchild. hopefully.
+ * Rejig Proxy Config some. With thanks to: Emmanuel Chantreau (Closes: #163124)
+ * Fix cgi install. Thanks to: Bastian Kleineidam (Closes: #162791)
+ * Fix postinst to check installation type and behave accordingly (Closes: #162627)
+ * Bring product version into line with RFC2616 (Closes: #151384)
+ * Add allow line for ipv6 localhost (Closes: #163533)
+ * Make more of the modules modular.
+ * Set UseCanonicalName off
+ * Added index.xhtml to DirectoryIndex settings
+ * Enabled MultiViews in the default site, and for the manual (Closes: #160367)
+ * Removed Unnecessary cgi.conf (Closes: #163842)
+
+ -- Thom May <thom@debian.org> Fri, 4 Oct 2002 21:47:18 +0100
+
+apache2 (2.0.42-2) unstable; urgency=low
+
+ * Tighten dependencies yet more
+ * Restart in postinst. don't stop in prerm and start in postinst (Closes: #162344, #162350, #162537)
+ * Fix dh_shlibdeps up
+ * PERCHILD IS NOT WORKING IN THIS RELEASE. DON'T EXPECT IT TO. BUGS ABOUT
+ THIS WILL BE CLOSED WITH EXTREME PREJUDICE.
+
+ -- Thom May <thom@debian.org> Fri, 27 Sep 2002 13:06:59 +0100
+
+apache2 (2.0.42-1) unstable; urgency=low
+
+ * "Pretty. What shall we blow up?"
+ * New Upstream Version (Closes: #160364)
+ * Fix man names and sections (Closes: #157113)
+ * Correct the regex for netstat checking of ports, thanks to Matthew Hambley
+ for this.
+ * Correct dependencies for apache2-common. (Closes: #161793)
+ * Applied patch from Stefan Gybas to fix a2enmod (Closes: #159459)
+ * Added BrowserMatch directives for microsoft's bodgy DAV implementations
+ and also for gnome-vfs (Closes: #155097)
+ * Loosened the config for home directories (Closes: #153599)
+ * Updated to latest standards version
+ * Drop priority to extra to bring it in line with libdb4.0
+ * Added logrotate script - Thanks to Phil Edwards for the basic version, and
+ the apache package that I ripped the rest off from (Closes: #155488)
+ * Tighten up what the Include lines load some. This is related to #161512
+ but doesn't completely close it.
+
+ -- Thom May <thom@debian.org> Sat, 21 Sep 2002 22:14:22 +0100
+
+apache2 (2.0.40-1) unstable; urgency=low
+
+ * New Upstream Version
+ * Correct dependencies. (Closes: #156959)
+ * Code to check for something else listening on 80 (Closes: #156129)
+ * correct permissions on suexec2 man page (Closes: #157005)
+ * Make the start and stop targets use apache2 directly rather than
+ apache2ctl.
+ * Check for the existence of apache2 and exit if it's not there (Closes: #156640)
+ * Nuke ssl_scache on startup (Closes: #157445)
+ * patch apxs to not need an mpm installed. Correct dependencies for -dev.
+ Stop messing around with ap_config_auto.h.
+ This hopefully resolves James Troup's objections to apache2. (Closes: #157895)
+ * Add code to check for a 2.2 based kernel and set up the Scoreboard
+ accordingly. (Closes: #156899)
+ * make sure i only have to update one init.d script, rather than 4.
+ * make apxs return a correctly formatted response on queries.
+
+ -- Thom May <thom@debian.org> Wed, 21 Aug 2002 14:21:14 +0100
+
+apache2 (2.0.39+cvs.1028741220-2) unstable; urgency=low
+
+ * Rebuild against new libc6. Grr. (Closes: #155865)
+ * Actually create /etc/apache2/httpd.conf
+ * Propagate init.d changes through the other MPMs.
+
+ -- Thom May <thom@debian.org> Thu, 8 Aug 2002 09:19:49 +0100
+
+apache2 (2.0.39+cvs.1028741220-1) unstable; urgency=low
+
+ * New Upstream Version
+ * Make a versioned depends on libapr0 (Closes: #154879, #155400)
+ * Ensure that /etc/init.d/apache2 is registered properly.
+ * Added a conf.d directory for random conf snippets
+ * Ensure that the /manual/ alias is setup by the correct package (Closes: #155179)
+ * Ensure that DAVLockDB is created in the right directory (Closes: #155096)
+ * Now Building in a pbuilder chroot environment.
+ * Perchild is now pseudo working (Closes: #154148)
+ * Cumulatively (note to Lazarus Long: this means all the things in this
+ changelog added together) (Closes: #155297, #155307, #155317, #155717, #155363, #155719, #155801)
+ * Note that preceeding changelog entry may not be parseable by strict grammar
+ checks. Thanks to Jamie Wilkinson for pointing this out.
+ * Turn MultiViews back on for the default site (Closes: #155450)
+ checks. Thanks to Jamie Wilkinson for pointing this out.
+ * Turn MultiViews back on for the default site (Closes: #155450)
+ * Removed all CVS directories (Closes: #155602, #155393, #155402)
+ * SSI has been fixed upstream (Closes: #151744)
+ * Removed SSLLog directives (Closes: #152940)
+ * Put icons in the right place (Closes: #155178)
+ * Fixed build-dep on libgdbmg1-dev (Closes: #155412)
+ * Get correct information into config_vars.mk (Closes: #151712)
+ * Removed 'ServerName localhost' line (Closes: #155359)
+ * Placed apr-util headers in correct package
+ * Ensured that the init.d script restarts apache properly
+
+ -- Thom May <thom@debian.org> Tue, 30 Jul 2002 22:37:52 +0100
+
+apache2 (2.0.39+cvs.1027964860-1) unstable; urgency=low
+
+ * New Upstream Source
+ * Correct Icons path (Closes: #151314)
+ * Add missing dep on mime-support (Closes: #151848, #152220, #152221, #151772)
+ * Fixup suexec2, thanks to Masahito Omote (Closes: #151422)
+ * Mark Brown
+ - Remove spurious claim that apache2 hasn't been uploaded (Closes: #151433)
+ - Bring apache2 in line with policy on /usr/share/doc/ (Closes: #151459)
+ - Make reload behave the same as force-reload (Closes: #151432)
+ * place the manual in the right place, thanks to Md (Closes: #151766)
+ * David Kimdon
+ - add build depends on zlib1g-dev (Closes: #151286)
+
+ -- Thom May <thom@debian.org> Mon, 29 Jul 2002 19:12:56 +0100
+
+apache2 (2.0.39-1) unstable; urgency=low
+
+ * New Upstream Version, fixing a denial of service attack.
+ * Fix installation of icons and manual.
+ * David Kimdon
+ - fix path for envvars in apxs2
+ - use generalized directives in ssl.conf ( SSLLog -> ErrorLog,
+ SSLLogLevel -> LogLevel ), this allows server to load ssl
+ module
+
+ -- Thom May <thom@debian.org> Fri, 14 Jun 2002 17:29:59 -0700
+
+apache2 (2.0.37-2) unstable; urgency=low
+
+ * Updated Copyright file to actually contain a copy of the various licenses.
+
+ -- Thom May <thom@debian.org> Fri, 14 Jun 2002 15:41:41 +0100
+
+apache2 (2.0.37-1) unstable; urgency=low
+
+ * New upstream version
+
+ -- Thom May <thom@debian.org> Thu, 13 Jun 2002 17:47:12 +0100
+
+apache2 (2.0.37+cvs.JCW_PRE2_2037-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Thom May <thom@debian.org> Wed, 5 Jun 2002 12:42:34 +0100
+
+apache2 (2.0.36-2) unstable; urgency=low
+
+ * debian/control - Correct provides, conflicts and depends, especially for
+ the mpms.
+ * build-dep doesn't work with provides, which makes sense. Need to make a
+ note of this in the policy.
+ * debian/rules - ensure that the mpm specific header file is installed into
+ the right place
+
+ -- Thom May <thom@debian.org> Fri, 31 May 2002 14:54:39 +0100
+
+apache2 (2.0.36-1) unstable; urgency=low
+
+ * The "The obviously begging in a changelog works" release.
+ * New Upstream release
+ * Vpath Builds now work, giving the ability to select which MPM you require
+ * Changed vhost base to only be a Recommends: as I'm not happy that it's
+ currently in a properly releasable state.
+ * New enhost script courtesy of DannyS.
+ * David Kimdon
+ - make apxs2 find envvars properly
+ - use libtool to install apache2 binaries for different mpm's
+ - fix dependancies for apache2-dev (we can't do a versioned 'Provides'
+ so we need to list all the packages that provide apache2 along
+ with their version)
+ * Implemented a long overdue suggestion to only create ports.conf if it's
+ not in existance already, rather than to add a command to listen on 80 iff
+ that didn't exist. The person who suggested it is lost in the mists of my
+ mailbox. If it was you, please email me!
+ * debian/vhost-base/add.d/apache2 - apply patch from "Omniflux"
+ <josh@nebonet.com> to fix some brainos
+
+ -- Thom May <thom@debian.org> Mon, 6 May 2002 16:39:18 +0100
+
+apache2 (2.0.35+cvs.20020420-1) unstable; urgency=low
+
+ * The "finding myself standing on the corner staring into a different world"
+ release. Will someone please give me a job?
+ * Resync with upstream CVS. lots and lots of bug fixes since the last
+ release.
+ * Attempting to build with multiple MPMs, so speedfreaks can have a threaded
+ MPM. (Available MPMs are: prefork, worker, threadpool, and
+ leader/follower).
+ * Now sedding ap{r,u}-config in the install target.
+ * vpath build evilness suggested by Andrew Suffield and others. I hate them
+ all. :)
+
+ -- Thom May <thom@debian.org> Sat, 20 Apr 2002 17:04:46 +0100
+
+apache2 (2.0.35-2) unstable; urgency=low
+
+ * The "Apache2 isn't released, therefore the Bug Tracking System doesn't
+ bloody well work" release
+ * Fixes a bug in add host, due to the change from Port to Listen.
+ (Reported by numerous people, patch more or less from Esteve Fernandez
+ <esteve@sindominio.net>.
+ * Attempt to fix apu-config, suggestion and patch from David Kimdon, if it's
+ wrong, I broke it. (Changed it to apply pre-build, rather than post build.
+ Yes, it's the lazy approach. It's also the right one :) )
+ * THE BUG TRACKING SYSTEM IS NOT THE RIGHT PLACE TO SEND BUG REPORTS FOR
+ APACHE2.
+ * REALLY.
+
+ -- Thom May <thom@debian.org> Sat, 6 Apr 2002 21:04:16 +0100
+
+apache2 (2.0.35-1) unstable; urgency=low
+
+ * WOOOOOOOOOOOHOOOOOOOOO! Apache2's first General Availability release!
+ * Various bug fixes, suggestions and so on.
+ * Built with db3 for the time being.
+
+ -- Thom May <thom@debian.org> Sat, 6 Apr 2002 03:01:24 +0100
+
+apache2 (2.0.34+retag-1) unstable; urgency=low
+
+ * Resync with upstream release.
+ * Fix packaging-fus (Hi Marcello!)
+ * Upstream have fixed cgi probs.
+
+ -- Thom May <thom@debian.org> Mon, 1 Apr 2002 14:50:12 +0100
+
+apache2 (2.0.34-1) unstable; urgency=low
+
+ * New upstream release
+ * added mod_deflate as a shared library
+ * bashed on apache2.conf some.
+
+ -- Thom May <thom@debian.org> Tue, 26 Mar 2002 23:23:09 +0000
+
+apache2 (2.0.33-1) unstable; urgency=low
+
+ * New upstream.
+ * Unfucked all code, include init.d and /etc/vhosts.
+ * FHS'ified, more or less
+ * Some debconf, but not much.
+ * Merged more patches upstream
+
+ -- Thom May <thom@debian.org> Sat, 9 Mar 2002 23:33:09 +0000
+
+apache2 (2.0.32+cvs.20020228-1) unstable; urgency=low
+
+ * The "bathwater, no baby" release.
+ * Submitted patches upstream like crazy.
+ * Tossed the insanely bogus apachectl patch
+ * Debconf not included here. Want to get everything else right, and a
+ release out.
+ * Boom!
+
+ -- Thom May <thom@debian.org> Thu, 28 Feb 2002 21:07:24 +0000
+
+apache2 (2.0.32-1) unstable; urgency=low
+
+ * The "Throwing stuff away like mad and seeing if it still builds" release.
+ * Ditched apache2-modules* on the principle of least surprise - the deb
+ layouts now pretty closely follow apache.
+ * Trying to triage away patches that have been fixed upstream.
+ * Major attack on debconfiscation starts here -> .
+
+ -- Thom May <thom@debian.org> Tue, 19 Feb 2002 20:37:58 +0000
+
+apache2 (2.0.31+cvs.20020217-1) unstable; urgency=low
+
+ * New CVS snapshot from HEAD to benefit Subversion for the impending 0.9
+ release. Enjoy! 81 lines in the last couple of days ... :)
+ * debian/patches/005_more_hardcoded_paths:
+ - Regenerated diff against newer version of mpm_default.h.
+ * debian/patches/008_apr-config_sucks
+ - Regenerated apr-util part of diff against newer version of
+ apu-config.in.
+ * debian/apache2.{config,templates,postinst},
+ debian/vhost-base/add.d/apache2,
+ debian/vhost-base/templates.d/apache2{,.in}, debian/rules:
+ - Debconfage asking which port to run on, and make the vhost-base script
+ only list the current ports; ports stuff moved to
+ /etc/apache2/ports.conf - re-enable dh_installdebconf in debian/rules.
+ - Moved templates.d/apache2 to templates.d/apache2.in so we can do some
+ nifty inplace regexps.
+ * debian/apache2.init.d:
+ - Bail out of the init script if there aren't any sites enabled.
+ * debian/{rules,control}:
+ - Get rid of apache2-modules; move its contents to apache2.
+ * debian/config-mods/cgid.conf:
+ - Get rid of redundant <IfModule> wrapper around ScriptSock, so it
+ actually loads. Thanks to Pieter "Pitr" Jansen for this one.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 17 Feb 2002 01:23:43 +1100
+
+apache2 (2.0.31+cvs.20020207-1) unstable; urgency=low
+
+ * The one-big-happy-apache2-bug-squashing-family release.
+ * Update to latest CVS; hopefully this won't mean that piro deadlocks every
+ time dpkg goes to read its database. Hopefully this gets rid of the bugs.
+ Yes, all of them.
+ * debian/patches/004a_srclib_layout_support:
+ - Updated a touch to fit in with .32-dev.
+ * debian/patches/008_stuff_in_sbin_not_bin:
+ - Removed; obsoleted by upstream discovering sanity.
+ * debian/patches/008_apr-config_sucks:
+ - Fix problem whereby @prefix@ would sub to $(prefix), but $(prefix)
+ wouldn't sub to the prefix, or ${prefix}, thus screwing up the running
+ of apr-config ... ditto for apu-config (from apr-util).
+ * debian/patches/009_apxs:
+ - Reworked to make it actually work, and apply cleanly.
+ - Fix libtool breakage once again, thanks David Kimdon.
+ * debian/patches/010_shmget:
+ - Hack to srclib/apr/apr.h.in to make it prefer shmget over everything
+ else, to make it 2.2/non-tmpfs safe. (Thanks Ben Collins).
+ * debian/patches/012_debian_version:
+ - Minor update (include a space in front of "Debian", change it to
+ "Debian GNU/Linux" to clarify things, and before the the Hurd [happy
+ now, you crack junkies?] people complain, it's not released as a Debian
+ port yet, so feh).
+ * debian/vhost-base/add.d/apache2:
+ - Change sites to sites-available, in line with the previous change.
+ * debian/config/mods-available:
+ - Move to debian/config-mods to make life easier with the move to
+ apache2-modules (see below).
+ * debian/config-mods/auth_dbm.load:
+ - New file, in line with introducing mod_auth_dbm; thanks again to David
+ Kimdon.
+ * debian/a2-scripts/a2{en,dis}mod:
+ - Rewritten to be much cleaner and cool. (Thanks to Ben Collins for
+ pointing out that the permissions were screwed).
+ * debian/apache2.postinst:
+ - New file, no #DEBHELPER# token so that we don't care if postinst fails;
+ this way it won't bail if you're already running another web server.
+ Thanks to David Kimdon for pointing out an error.
+ * debian/vhost-base/{enable,disable}.d/apache2:
+ - Fixed! Woot! The code isn't the best you'll see, but now *WORKS*. Whoo!
+ * debian/control:
+ - Extend libapr-dev's Depends to include libapr0 (duh).
+ - Remove apache2-modules-dev as modules are no longer built both shared
+ and static, IMHO this was quite braindead behavior. Upstream's change,
+ not mine.
+ - Remove apache2-support as apxs2 requred apache2 anyway. Chalk one (more)
+ down for "failed experiments".
+ - Removed redundant libssl0.9.6 and libxmltok1 build-deps; we already
+ build-depped on the relevant -dev packages; thanks Ben Collins.
+ * debian/rules:
+ - Modules are no longer built statically as well as dynamically (upstream
+ change), so stop trying to move the files around.
+ - Sort out the libapr0/libapr-dev mess once and for all; thanks to Matt
+ Wilcox and Ben Collins for patiently talking me through it.
+ - Move *contents* of mods-available to apache2-modules, but keep the
+ directory itself as part of apache2, to keep the addons happy; thanks
+ David Kimdon.
+ - s/apache2-support/apache2/, see debian/control entry.
+ - Remove extraneous LICENSE file from the vhost manual.
+ - Remove *.exp files, because they're unneeded.
+ * debian/apache2.docs:
+ - Remove KEYS from the list of docs because this is crap and no longer
+ distributed. w00t!
+
+ -- Daniel Stone <daniel@sfarc.net> Thu, 7 Feb 2002 20:39:44 +1100
+
+apache2 (2.0.28-3) unstable; urgency=low
+
+ * Enabled mod_auth_dbm for Subversion. (thanks David Kimdon).
+
+ -- Daniel Stone <daniel@sfarc.net> Thu, 29 Nov 2001 23:25:53 +1100
+
+apache2 (2.0.28-2) unstable; urgency=low
+
+ * Fixed up a couple of things,
+ /etc/apache2/modules->/etc/apache2/mods-available, etc.
+ * Included mod_dav, so Subversion can be built.
+ * New package: apache2-modules-dev, containing all
+ /usr/lib/apache2/modules/*a. (Thanks Adam Heath).
+ * Moved libapr.so.* symlinks to libapr-dev (Thanks again to doogie).
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 25 Nov 2001 19:00:19 +1100
+
+apache2 (2.0.28-1) unstable; urgency=low
+
+ * Updated to 2.0.28, which they actually managed to agree on calling a beta.
+ * debian/apache2.init.d:
+ - Stripped of almost all its functionality. Now just touches httpd.conf if
+ we're starting and it doesn't exist, and then calls apache2ctl with all
+ our options, whatever they may be - it can error out if it wants.
+ * Removed patches:
+ - 010_index.html.it_typo - merged upstream.
+ * Updated patches:
+ - 009_apxs: make it actually find libtool. Thanks to David Kimdon.
+ - 002_apache2ctl: really fix apache2ctl graceful.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 18 Nov 2001 15:29:43 +1100
+
+apache2 (2.0.26+cvs.20011028-2) unstable; urgency=low
+
+ * Added vhost-base support.
+ - Removed Debconfage and moved all the templates to
+ debian/vhost-base/templates.d (/etc/vhosts/templates.d).
+ Removed apache2.postinst and apache2.config.
+ - Removed a2{dis,en}host.
+ * /usr/lib/cgi-bin will now be /cgi-bin, /var/vhosts/hostname/cgi-bin will be
+ /cgi-local.
+
+ -- Daniel Stone <daniel@sfarc.net> Fri, 9 Nov 2001 21:53:27 +1100
+
+apache2 (2.0.26+cvs.20011028-1) unstable; urgency=low
+
+ * Resync with HEAD (another coming to fix segfaults, but no net connectivity
+ at the moment - 4-11-2001, 2:12pm. Grrr).
+ * New patches:
+ - 011_mod_autoindex-symlink: make icons for symlinks to files and dirs
+ special cases.
+ + Touches modules/generators/mod_autoindex.c
+ + Special cases: ^^SYMDIR^^ and ^^SYMLINK^^.
+ - 012_debian_version: adds "Debian" to the Apache version string.
+ + Touches include/ap_release.h - this patch has *no* context. Please
+ don't give it any, I don't want to have to rediff every version.
+ * debian/config/httpd.conf, debian/config/apache2.conf:
+ - Move main config file to apache2.conf, made it much more bare-bones.
+ + User (or package) config should be done in httpd.conf.
+ * apache2.conf:
+ - s/Port/Listen/ - booya! Finally they cleaned it up.
+ - Add (commented-out) icon entries for ^^SYMDIR^^ and ^^SYMLINK^^.
+ Anyone volunteer to create icons?
+ * debian/apache2.postinst:
+ - Minor cleanups.
+ - And later: Made it just call ap2addhost --default. (and a2enhost).
+ * debian/config/modules/ssl.conf, debian/config/sites/default-443:
+ - Put only generic SSL stuff in ssl.conf, split SSL support out into
+ a new virtual host thingy in accordance with dealing with ports.
+ * debian/config/sites/default, debian/config/sites/default-443,
+ debian/patches/004b_debian_layout:
+ - Add a new alias /cgi-pub/ to /usr/lib/cgi-bin. Packages should put
+ scripts here.
+ * debian/control:
+ - changed the Suggests: on apache2-doc to a Recommends:
+ + otherwise /manual/ will be a broken alias, as it points to
+ /usr/share/doc/apache2-doc/manual.
+ - changed libapr-dev to Architecture: all (from Arch: any) - whoops.
+ * Added support for multiple ports on the one virtual host. At the moment
+ it's one gigantic, ugly, kludge. *sigh*. Format:
+ - /var/vhosts/site.name/htdocs-PORT
+ - /var/vhosts/site.name/logs/(access|error).log-PORT
+ - /var/vhosts/site.name/cgi-bin-PORT
+ * debian/apache2.postinst, debian/config/sites/default, etc:
+ - s#/var/www#/var/vhosts#;
+ - s#htdocs#htdocs-$PORT#;
+ * More Debconfage - it now asks if you want SSL support in the default
+ virtual host, and which port number you want (default 81 so it sits
+ side-by-side with apache).
+ * Major change to postinst, a2addhost, et al:
+ - It's all now done in Perl, and postinst is no longer a special case.
+ The standalones call Debconf for what they need to do, calling it as a
+ standalone. This way, postinst just calls a2addhost, etc, and it also
+ smooths the path for me to do the vhost-base stuff.
+ * No, this migration path probably won't be smooth (between apache2
+ versions). Sorry.
+ * Last release before I make it vhost-base compliant.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 28 Oct 2001 20:33:18 +1100
+
+apache2 (2.0.26+cvs.20011023-1) unstable; urgency=low
+
+ * Damnit, resync with HEAD (2_0_26 was unstable).
+
+ -- Daniel Stone <daniel@sfarc.net> Tue, 23 Oct 2001 18:36:42 +1000
+
+apache2 (2.0.26-1) unstable; urgency=low
+
+ * Resync with upstream CVS (but only as far as the APACHE_2_0_26 tag).
+ Essentially, this gives all the coolness of a CVS tree, but all the
+ stability of a release. I may start tracking HEAD later, we'll just
+ have to see.
+ * Changed libapr->libapr0.
+ * Fixed a couple of typo's in index.html.it (thanks Md, via Joey).
+ * 22nd October, 7:51pm: Resync again as they added a couple of files
+ and bumped the tag to fix segfaults.
+
+ -- Daniel Stone <daniel@sfarc.net> Wed, 17 Oct 2001 23:50:39 +1000
+
+apache2 (2.0.25+cvs.20011001-1) unstable; urgency=low
+
+ * More CVS resyncing joy.
+ * Silly stupid evil poo bum hack to apachectl. I don't like this.
+ Please, help.
+ * Got rid of a few lintian warnings.
+ * Install build stuff to /etc/apache2/build, adjust apxs accordingly.
+ * Agreed on policy with madduck. This is a MAJOR CHANGE, people.
+ A lot of stuff has changed around, so you'll need to change your
+ packages.
+ apache2 now treats everything as a virtual host (even when you only
+ have one host). This allows us to skirt around FHS and do our own
+ thing. ("Thpthpthpthpthpthpt, we're using vhosts. FHS doesn't say
+ anything about that.")
+ Please see README.Debian for more details.
+ * More fun with virtual hosts. Migrated their configuration files to
+ /etc/apache2/virtuals/<name>. This will allow for easy adding and
+ removal, via the new tools /usr/sbin/ap2(add|del)vh.
+ apache2's postinst touches /etc/apache2/POSTINST_CONFED, and will refuse
+ to re-run the postinst config stuff if it's there already.
+ * Module fun - /usr/sbin/ap2mod(en|dis). Modules put their loading line in
+ /etc/apache2/modules/foo.load, config in /etc/apache2/modules/foo.conf.
+ Enabled module stuff gets symlinked into /etc/apache2/mods-enabled.
+ * Move APR stuff to /usr/lib, not /usr/lib/libapr. Whoops, should've done
+ this a *long* *time* *ago*.
+ * More silly APR hacks: Move /usr/include/libapr to /usr/include/apache2, as
+ silly things like php4 don't get the fact that APR and apache2 can indeed
+ have different include directories. Grrr.
+ * Juggled script names - it's now a2(en|dis)(host|mod).
+ * I don't care, I'm uploading. No, really (closes: #103471).
+ It's been 93 days since I first did dh_make and ITPed it. :)
+
+ -- Daniel Stone <daniel@sfarc.net> Thu, 4 Oct 2001 20:15:31 +1000
+
+apache2 (2.0.25+cvs.20010923-1) unstable; urgency=low
+
+ * Another resync with upstream CVS; most of the changes below were made
+ between then and now.
+ * Also added apache2-support - everything from support/*, so php4, et al
+ don't need to Build-Depend on apache2 itself.
+
+ -- Daniel Stone <DanielS@esd.nec.com.au> Sun, 23 Sep 2001 13:21:16 +1000
+
+apache2 (2.0.25+cvs.20010908-1) unstable; urgency=low
+
+ * Synched everything with CVS; it works now.
+ * We now build with ./buildconf due to the above; redo all the patches
+ against configure.in. I swear this will be the last change, and that I'll
+ test it.
+ * Removed php4 and modperl-2.0 from the tree. I should keep the changelogs
+ internal, as this is now getting not only very silly, but very embarassing.
+ * I corrected myself in the ITP that it was licensed under the Apache
+ Software License, not GPLed, but forgot to do that in debian/copyright.
+ Whoops. Feel free to LART.
+ * Lintian cleanups:
+ - Remove extra LICENSE files.
+ - Stop stuff calling -rpath.
+ - Change printenv to call /usr/bin/perl, not /usr/local/bin/perl - wtf?
+ - Move manpages to the right directory.
+ * Minor merge from Thom courtesy of some stuff being stored on pandora:~thom.
+ - Use buildprogs.pl to parse stuff like apache2ctl, apxs2, etc.
+ * Hopefully I'm only one CVS sync away from an upload.
+ * Moved some stuff over to /usr/sbin, fixed apache2ctl once and for all.
+ Hopefully.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 9 Sep 2001 00:05:03 +1000
+
+apache2 (2.0.24-2) unstable; urgency=low
+
+ * The "Farewell Buddha" Release.
+ * Or, alternatively: The "Darren Milburn is an Idiot for Inciting Crowds"
+ Release.
+ * Yes, it's the height of evil, I know: modperl-2.0 goes into the source
+ tree. (from CVS).
+ Separate tarballs, thanks to DBS, but still, yeah.
+ * Ditto php4.
+ * Still no Thom's laptop; hence no merges, and I'm not going to duplicate
+ work.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 2 Sep 2001 21:50:59 +1000
+
+apache2 (2.0.24-1) unstable; urgency=low
+
+ * New upstream version.
+ * Use prefork, not threaded, MPM. (threaded is currently broken).
+ * Update example httpd.conf for mod_ssl and have lines for all the modules.
+ * Build-Depends, all the Build-Depends!
+ * Update maintainer email address (thanks Joey).
+ * Turns out using buildconf was what broke modules. I swear I won't do
+ anything like that again. Promise! (thanks Thom for pointing this out)
+ * Implied by the above, rediff all patches against configure, not
+ configure.in.
+ * Also, don't copy configure.{guess,sub} over anymore, because we don't need
+ them.
+ * More Thom merges:
+ - debian/patches/003_apache2ctl - rewritten apache2ctl to actually work.
+ * Return of debian/patches/006_dont_install_build_crap. GAH!
+
+ -- Daniel Stone <daniel@sfarc.net> Sat, 18 Aug 2001 17:01:19 +1000
+
+apache2 (2.0.23-2) unstable; urgency=low
+ * SSL finally works, and beat instructions on how to get it going out
+ of someone on new-httpd. Moved SSL stuff to apache2-modules.
+ * Disabled TLS, because it's unstable and unnecessary.
+ * Merge from Thom May's tree:
+ 005b_debian_layout - The Debian layout for stuff
+ - Move APR stuff to /usr/lib/libapr and /usr/include/libapr.
+ - Clean up debian/rules, largely thanks to the two new patches.
+ * General cleanups, resulting from running lintian:
+ - Chuck #DEBHELPER# in postinst, which also fixes the /usr/doc
+ and init.d problems (due to debhelper now doing its postinst
+ thing).
+ - Remove LICENSE files from apache2-doc and the default document
+ root.
+ - Remove man/ and build/ top-level dirs, install manpages correctly.
+ - Updated 004_perl_in_usr_bin to include the manual search CGI.
+ * Remove all evil, ugly, patches to configure in debian/patches/*, instead,
+ diff against configure.in, because autoconf gets run in the configure
+ stage every time.
+ * Copy config.{guess,sub} from /usr/share/misc (provided by autotools-dev) at
+ runtime, thus eliminating debian/patches/002_config_guess_and_sub.
+ * Reshuffled patch numbers to cope with the above.
+ * I give up on this DBM crap. Disable mod_auth_dbm for now.
+
+ -- Daniel Stone <daniel@sfarc.net> Wed, 15 Aug 2001 18:27:23 +1000
+
+apache2 (2.0.23-1) unstable; urgency=low
+
+ * New upstream - 2.0.23.
+ * New patches:
+ 004_conffile_in_etc_apache2 - Make an ugly init.d hack unnecessary.
+ 005_perl_in_usr_bin - Make example CGI scripts use /usr/bin/perl.
+ * Fix mime_magic stuff by copying magic to /etc/apache2.
+ * Remove debian/patches/003_cgisock_in_var_log_apache2, instead found a new
+ conffile directive, put this into the default distributed conffile.
+
+ -- Daniel Stone <daniel@sfarc.net> Sun, 12 Aug 2001 18:05:32 +1000
+
+apache2 (2.0.22-2) unstable; urgency=low
+
+ * Aargh, I'm an idiot. Fix a bug in mod_cgid.c that had a hardcoded path.
+ That's now debian/pactches/003*.
+
+ -- Daniel Stone <daniel@sfarc.net> Sat, 11 Aug 2001 08:04:13 +1000
+
+apache2 (2.0.22-1) unstable; urgency=low
+
+ * Updated to 2.0.22, started using a form of DBS.
+ * Merge from Thom May's 2.0.20 tree - new libapr-dev package.
+ * Backed out the old mod_(tls|ssl) hacks, see if 2.0.23 is any better
+ (apparently it is, thank god).
+
+ -- Daniel Stone <daniel@sfarc.net> Wed, 8 Aug 2001 15:13:09 +1000
+
+apache2 (2.0.20-2) unstable; urgency=low
+
+ * New SSL fixes from new-httpd. Apparently, this (generally) works.
+
+ -- Daniel Stone <daniels@yakko.doogie.org> Fri, 13 Jul 2001 07:57:18 -0500
+
+apache2 (2.0.20-1) unstable; urgency=low
+
+ * New upstream release
+
+ -- Daniel Stone <daniel@kabuki.sfarc.net> Mon, 9 Jul 2001 18:41:04 +1000
+
+apache2 (2.0.18-1) unstable; urgency=low
+
+ * Initial Release.
+
+ -- Daniel Stone <daniel@sfarc.net> Wed, 4 Jul 2001 21:29:29 +1000