Merge ~ahasenack/ubuntu/+source/apache2:cosmic-merge-apache-2.4.34-1 into ubuntu/+source/apache2:debian/sid

[Andreas Hasenack]

Please use local git for the review, as the LP diff is incorrect. It's correct until it reaches docs/manual, where it breaks. Probably because of the empty-dir-in-git problem.

Merge from debian's 2.4.34-1. The tricky part here was to recover the rich history from the previous uploads to ubuntu: 2.4.33-3ubuntu1, 3ubuntu2 and 3ubuntu3, as the upload tag didn't match what was expected due to the empty directories in the apache2 orig tarball.

I think I recovered that just fine, and wrote up what I did in my tips & tricks doc at https://docs.google.com/document/d/1uS-Ci89VWnl_M7DqqOuj5yM6_hx13EwNI86a0n25qVw/edit#bookmark=id.w6zg30wxw10h

Besides that, of note in this merge is that you can see in the 3ubuntu2 and 3ubuntu3 uploads that I first dropped both mod_md and mod_uwsgi_proxy, and later restored uwsgi, so I squashed all that together which resulted in just the removal of mod_md.

This upload is also fixing #1782806, which I will link to the MP and close manually later.

I can make the google doc public, or better yet, update our wiki.

PPA with test packages: ppa:ahasenack/apache2-merge-2.4.34-1

[Andreas Hasenack (ahasenack)]

I'm still going to run the lp:qa-regression-testing apache test script.

[Andreas Hasenack (ahasenack)]

qa-regression-testing tests are fine:
(master)ubuntu@cosmic-apache-merge:~/qa-regression-testing/scripts$ sudo ./test-apache2.py 2>&1 | tee ~/test-apache2.log
test_basic_rewrite (__main__.BasicTest)
Test basic rewrite functionality ... ok
test_cve_2007_6203 (__main__.BasicTest)
Test CVE-2007-6203 ... ok
test_cve_2007_6420 (__main__.BasicTest)
Test CVE-2007-6420 ... ok
test_cve_2008_2168 (__main__.BasicTest)
Test CVE-2008-2168 ... ok
test_cve_2008_2939 (__main__.BasicTest)
Test CVE-2008-2939 ... ok
test_cve_2009_1890 (__main__.BasicTest)
Test CVE-2009-1890 ... ok
test_cve_2011_0419 (__main__.BasicTest)
Test CVE-2011-0419 ... ok
test_cve_2011_3192 (__main__.BasicTest)
Test CVE-2011-3192 ... ok
test_cve_2011_3192_gzip (__main__.BasicTest)
Test CVE-2011-3192 (gzip) ... ok
test_cve_2011_3192_regression_1 (__main__.BasicTest)
Test CVE-2011-3192 regression 1 ... ok
test_cve_2011_3192_regression_2 (__main__.BasicTest)
Test CVE-2011-3192 regression 2 ... ok
test_cve_2011_3192_request_range (__main__.BasicTest)
Test CVE-2011-3192 (Request-Range) ... ok
test_cve_2011_3368 (__main__.BasicTest)
Test CVE-2011-3368 ... ok
test_cve_2011_3368_proto_09 (__main__.BasicTest)
Test CVE-2011-3368 w/http protocol 0.9 ... ok
test_cve_2011_4317 (__main__.BasicTest)
Test CVE-2011-4317 ... ok
test_cve_2012_4929_default (__main__.BasicTest)
Test CVE-2012-4929 (compression default setting) ... ok
test_cve_2012_4929_off (__main__.BasicTest)
Test CVE-2012-4929 (compression off) ... ok
test_cve_2012_4929_on (__main__.BasicTest)
Test CVE-2012-4929 (compression on) ... ok
test_daemons (__main__.BasicTest)
Test daemon ... ok
test_http (__main__.BasicTest)
Test http ... ok
test_lp1626883 (__main__.BasicTest)
Test lp1626883 ... ok
test_mod_cgid (__main__.BasicTest)
Test mod_cgid ... ok
test_mod_dav (__main__.BasicTest)
Test mod_dav ... ok
test_mod_dav_svn (__main__.BasicTest)
Test mod_dav_svn ... ok
test_mod_deflate_input (__main__.BasicTest)
Test mod_deflate input compression ... ok
test_mod_status (__main__.BasicTest)
Test mod_status ... ok
test_php (__main__.BasicTest)
Test php ... ok
test_proxy_ftp (__main__.BasicTest)
Test ftp proxy ... ok
test_ssl (__main__.BasicTest)
Test https ... ok
test_ssl_tls_md5 (__main__.BasicTest)
Test whether https allows MD5 ... ok
test_ssl_tls_v1 (__main__.BasicTest)
Test connecting with TLS v1.0 ... ok
test_ssl_tls_v1_1 (__main__.BasicTest)
Test connecting with TLS v1.1 ... ok
test_ssl_tls_v1_2 (__main__.BasicTest)
Test connecting with TLS v1.2 ... ok
test_status (__main__.BasicTest)
Test status (apache2ctl) ... ok
test_htpasswd_des (__main__.HTPasswdTest)
Test htpasswd to ensure crypt returns sane des results ... ok
test_htpasswd_md5 (__main__.HTPasswdTest)
Test htpasswd to ensure crypt returns sane md5 results ... ok
test_htpasswd_sha (__main__.HTPasswdTest)
Test htpasswd to ensure crypt returns sane sha results ... ok

----------------------------------------------------------------------
Ran 37 tests in 430.533s

OK

(master)ubuntu@cosmic-apache-merge:~/qa-regression-testing/scripts$ apt-cache policy apache2
apache2:
  Installed: 2.4.34-1ubuntu1~ppa1
  Candidate: 2.4.34-1ubuntu1~ppa1
  Version table:
 *** 2.4.34-1ubuntu1~ppa1 500
        50...

[Robie Basak (racb)]

Tags are structurally correct, except for an expected mismatch against old/ubuntu to both deconstruct and logical which I assume is an empty directory change artifact.

Logical verified transferred exactly, no changes. Changelog entry accurately describes changes. All of the delta seems appropriate to keep. md disablement still seems relevant as libxmltooling7 still requires libcurl3. I'm OK with this given that md is still listed as experimental upstream.

lgtm

review: Approve

[Andreas Hasenack (ahasenack)]

DEP8 tests are also good:
(...)
autopkgtest [11:27:56]: test chroot: - - - - - - - - - - results - - - - - - - - - -
chroot PASS
autopkgtest [11:27:56]: @@@@@@@@@@@@@@@@@@@@ summary
run-test-suite PASS
duplicate-module-load PASS
htcacheclean PASS
default-mods PASS
ssl-passphrase PASS
check-http2 PASS
chroot PASS

[Andreas Hasenack (ahasenack)]

Thanks for the review, Robie. Could you please set the MP to "approved" and push the upload tag? I can then dput the package and follow it through migration.

[Robie Basak (racb)]

On Mon, Aug 06, 2018 at 02:30:05PM -0000, Andreas Hasenack wrote:
> Thanks for the review, Robie. Could you please set the MP to "approved" and push the upload tag?

Sorry, I keep forgetting about this. Now done.

[Andreas Hasenack (ahasenack)]

apache2 migrated, marking MP as merged and closing linked bug.

diff --git a/debian/apache2-bin.install b/debian/apache2-bin.install
index 63c573f..3d1bdf1 100644
--- a/debian/apache2-bin.install
+++ b/debian/apache2-bin.install
@@ -1,2 +1,3 @@
 /usr/lib/apache2/modules/
 /usr/sbin/apache2
+debian/apache2.py usr/share/apport/package-hooks
diff --git a/debian/apache2-utils.ufw.profile b/debian/apache2-utils.ufw.profile
 new file mode 100644
index 0000000..974a655
--- /dev/null
+++ b/debian/apache2-utils.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
diff --git a/debian/apache2.dirs b/debian/apache2.dirs
index 6089013..1aa6d3c 100644
--- a/debian/apache2.dirs
+++ b/debian/apache2.dirs
@@ -10,3 +10,4 @@ var/cache/apache2/mod_cache_disk
 var/lib/apache2
 var/log/apache2
 var/www/html
+/etc/ufw/applications.d/apache2
diff --git a/debian/apache2.install b/debian/apache2.install
index b6ad789..92865fc 100644
--- a/debian/apache2.install
+++ b/debian/apache2.install
@@ -8,3 +8,4 @@ debian/config-dir/*.conf			/etc/apache2
 debian/config-dir/envvars			/etc/apache2
 debian/config-dir/magic				/etc/apache2
 debian/debhelper/apache2-maintscript-helper	/usr/share/apache2/
+debian/apache2-utils.ufw.profile /etc/ufw/applications.d/
diff --git a/debian/apache2.postrm b/debian/apache2.postrm
index a68583c..b0e5d7b 100644
--- a/debian/apache2.postrm
+++ b/debian/apache2.postrm
@@ -33,6 +33,7 @@ is_default_index_html () {
 		776221a94e5a174dc2396c0f3f6b6a74
 		c481228d439cbb54bdcedbaec5bbb11a
 		e2620d4a5a0f8d80dd4b16de59af981f
+		3526531ccd6c6a1d2340574a305a18f8
 	EOF
 }
 
diff --git a/debian/apache2.py b/debian/apache2.py
 new file mode 100644
index 0000000..a9fb9d8
--- /dev/null
+++ b/debian/apache2.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+
+'''apport hook for apache2
+
+(c) 2010 Adam Sommer.
+Author: Adam Sommer <[e-mail]>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import os
+
+SITES_ENABLED_DIR = '/etc/apache2/sites-enabled/'
+
+def add_info(report, ui):
+    if os.path.isdir(SITES_ENABLED_DIR):
+        response = ui.yesno("The contents of your " + SITES_ENABLED_DIR + " directory "
+                            "may help developers diagnose your bug more "
+                            "quickly.  However, it may contain sensitive "
+                            "information.  Do you want to include it in your "
+                            "bug report?")
+
+        if response == None: # user cancelled
+            raise StopIteration
+
+        elif response == True:
+            # Attache config files in /etc/apache2/sites-enabled and listing of files in /etc/apache2/conf.d 
+            for conf_file in os.listdir(SITES_ENABLED_DIR):
+                attach_file_if_exists(report, SITES_ENABLED_DIR + conf_file, conf_file)
+
+    try:
+        report['Apache2ConfdDirListing'] = str(os.listdir('/etc/apache2/conf.d'))
+    except OSError:
+        report['Apache2ConfdDirListing'] = str(False)
+
+    # Attach default config files if changed.
+    attach_conffiles(report, 'apache2', conffiles=None)
+
+    # Attach the error.log file.
+    attach_file(report, '/var/log/apache2/error.log', key='error.log')
+
+    # Get loaded modules.
+    report['Apache2Modules'] = root_command_output(['/usr/sbin/apachectl', '-D DUMP_MODULES'])
diff --git a/debian/changelog b/debian/changelog
index 42e2f4f..5a42a14 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+apache2 (2.4.34-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+    - d/control, d/rules, d/config-dir/mods-available/md.load: don't build
+      libapache2-mod-md, as that makes apache2-bin pull in libcurl4 which
+      cannot be coinstalled with libcurl3. That situation breaks the
+      installation of libapache2-mod-shib2.  See
+      https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1770242/comments/1
+      for details.
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 03 Aug 2018 17:09:27 -0300
+
 apache2 (2.4.34-1) unstable; urgency=medium
 
   [ Ondřej Surý ]
@@ -16,6 +37,87 @@ apache2 (2.4.34-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Fri, 27 Jul 2018 21:37:37 +0200
 
+apache2 (2.4.33-3ubuntu3) cosmic; urgency=medium
+
+  * d/control, d/rules, d/config-dir/mods-available/proxy_uwsgi.load:
+    re-enable proxy_uwsgi, as the uwsgi source no longer builds this module.
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 28 Jun 2018 10:07:06 -0300
+
+apache2 (2.4.33-3ubuntu2) cosmic; urgency=medium
+
+  * d/control, d/rules: Don't build libapache2-mod-proxy-uwsgi and
+    libapache2-mod-md until we figure out their transitions.  libapache2-mod-md
+    in particular is problematic because that makes apache2-bin pull in
+    libcurl4 which cannot be coinstalled with libcurl3.  That situation breaks
+    the installation of libapache2-mod-shib2.  See
+    https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1770242/comments/1
+    for details.
+    - Don't ship md.load and remove build-requires that were added because of
+      mod-md (see
+      https://salsa.debian.org/apache-team/apache2/commit/b9d37f2a96da2fd69bf)
+    - Remove proxy_uwsgi.load as we are not building it for now (see
+      https://salsa.debian.org/apache-team/apache2/commit/4e3168562d75ce398b9)
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 May 2018 14:46:19 +0000
+
+apache2 (2.4.33-3ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1770242). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - d/t/control, d/t/check-http2: add basic test for http2 support
+  * Drop:
+    - SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
+      + debian/patches/CVE-2017-15710.patch: fix language long names
+        detection as short name in modules/aaa/mod_authnz_ldap.c.
+      + CVE-2017-15710
+    - SECURITY UPDATE: incorrect <FilesMatch> matching
+      + debian/patches/CVE-2017-15715.patch: allow to configure
+        global/default options for regexes, like caseless matching or
+        extended format in include/ap_regex.h, server/core.c,
+        server/util_pcre.c.
+      + CVE-2017-15715
+    - SECURITY UPDATE: mod_session header manipulation
+      + debian/patches/CVE-2018-1283.patch: strip Session header when
+        SessionEnv is on in modules/session/mod_session.c.
+      + CVE-2018-1283
+    - SECURITY UPDATE: DoS via specially-crafted request
+      + debian/patches/CVE-2018-1301.patch: ensure that read lines are NUL
+        terminated on any error, not only on buffer full in
+        server/protocol.c.
+      + CVE-2018-1301
+    - SECURITY UPDATE: mod_cache_socache DoS
+      + debian/patches/CVE-2018-1303.patch: fix caching of empty headers up
+        to carriage return in modules/cache/mod_cache_socache.c.
+      + CVE-2018-1303
+    - SECURITY UPDATE: insecure nonce generation
+      + debian/patches/CVE-2018-1312.patch: actually use the secret when
+        generating nonces in modules/aaa/mod_auth_digest.c.
+      + CVE-2018-1312
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+      [type=Forking already in the base systemd service file, and
+       RemainsAfterExit=no is the default value, so no need to
+       customize these anymore.]
+    - Avoid crashes, hangs and loops by fixing mod_ldap locking: (LP #1752683)
+      + added debian/patches/util_ldap_cache_lock_fix.patch
+      [Already applied upstream]
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 15 May 2018 11:03:34 -0300
+
 apache2 (2.4.33-3) unstable; urgency=medium
 
   * Add Breaks for libapache2-mod-proxy-uwsgi and libapache2-mod-md, too.
@@ -88,6 +190,91 @@ apache2 (2.4.29-2) unstable; urgency=medium
 
  -- Ondřej Surý <[e-mail]>  Sun, 14 Jan 2018 11:01:58 +0000
 
+apache2 (2.4.29-1ubuntu4.1) bionic-security; urgency=medium
+
+  * SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
+    - debian/patches/CVE-2017-15710.patch: fix language long names
+      detection as short name in modules/aaa/mod_authnz_ldap.c.
+    - CVE-2017-15710
+  * SECURITY UPDATE: incorrect <FilesMatch> matching
+    - debian/patches/CVE-2017-15715.patch: allow to configure
+      global/default options for regexes, like caseless matching or
+      extended format in include/ap_regex.h, server/core.c,
+      server/util_pcre.c.
+    - CVE-2017-15715
+  * SECURITY UPDATE: mod_session header manipulation
+    - debian/patches/CVE-2018-1283.patch: strip Session header when
+      SessionEnv is on in modules/session/mod_session.c.
+    - CVE-2018-1283
+  * SECURITY UPDATE: DoS via specially-crafted request
+    - debian/patches/CVE-2018-1301.patch: ensure that read lines are NUL
+      terminated on any error, not only on buffer full in
+      server/protocol.c.
+    - CVE-2018-1301
+  * SECURITY UPDATE: mod_cache_socache DoS
+    - debian/patches/CVE-2018-1303.patch: fix caching of empty headers up
+      to carriage return in modules/cache/mod_cache_socache.c.
+    - CVE-2018-1303
+  * SECURITY UPDATE: insecure nonce generation
+    - debian/patches/CVE-2018-1312.patch: actually use the secret when
+      generating nonces in modules/aaa/mod_auth_digest.c.
+    - CVE-2018-1312
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 25 Apr 2018 07:38:24 -0400
+
+apache2 (2.4.29-1ubuntu4) bionic; urgency=medium
+
+  * Avoid crashes, hangs and loops by fixing mod_ldap locking: (LP: #1752683)
+    - added debian/patches/util_ldap_cache_lock_fix.patch
+
+ -- Rafael David Tinoco <[e-mail]>  Fri, 02 Mar 2018 02:19:31 +0000
+
+apache2 (2.4.29-1ubuntu3) bionic; urgency=medium
+
+  * Switch back to OpenSSL 1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 06 Feb 2018 11:57:20 +0000
+
+apache2 (2.4.29-1ubuntu2) bionic; urgency=medium
+
+  * enable http2 (LP: #1687454) by stopping to disable it
+    - debian/control: no more removed libnghttp2-dev Build-Depends (in universe).
+    - debian/config-dir/mods-available/http2.load: no more removed.
+    - debian/rules: no more removed proxy_http2 from configure.
+  * d/t/control, d/t/check-http2: add basic test for http2 support
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 05 Dec 2017 17:25:39 +0100
+
+apache2 (2.4.29-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+    - Don't build http2 module (nghttp2 still not in main) (LP 1687454)
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+  * Switch back to OpenSSL 1.0 as we don't yet have 1.1:
+    - debian/control: switch BuildDepends to libssl1.0-dev
+    - debian/control: remove Breaks on gridsite and libapache2-mod-dacs
+    - debian/rules: remove openssl virtual package and logic
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 10 Nov 2017 10:51:46 -0500
+
 apache2 (2.4.29-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
@@ -152,6 +339,47 @@ apache2 (2.4.27-3) experimental; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 16 Jul 2017 23:11:07 +0200
 
+apache2 (2.4.27-2ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: optionsbleed information leak
+    - debian/patches/CVE-2017-9798.patch: disallow method registration
+      at run time in server/core.c.
+    - CVE-2017-9798
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 18 Sep 2017 11:05:48 -0400
+
+apache2 (2.4.27-2ubuntu2) artful; urgency=medium
+
+  * Undrop (LP 1658469):
+    - Don't build http2 module (nghttp2 still not in main) (LP 1687454)
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 02 Aug 2017 13:04:45 -0400
+
+apache2 (2.4.27-2ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable (LP: #1702582). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 27 Jul 2017 13:38:39 -0700
+
 apache2 (2.4.27-2) unstable; urgency=medium
 
   * Switch back to openssl 1.0 for now. The transition to 1.1 needs more
@@ -181,6 +409,55 @@ apache2 (2.4.25-4) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Tue, 20 Jun 2017 21:31:51 +0200
 
+apache2 (2.4.25-3ubuntu3) artful; urgency=medium
+
+  * Re-Drop (LP: #1658469):
+    - Don't build experimental http2 module for LTS:
+     + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+     + debian/config-dir/mods-available/http2.load: removed.
+     + debian/rules: removed proxy_http2 from configure.
+     + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Mon, 01 May 2017 09:55:11 -0700
+
+apache2 (2.4.25-3ubuntu2) zesty; urgency=medium
+  * Undrop (LP 1658469):
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 10 Feb 2017 08:53:43 -0800
+
+apache2 (2.4.25-3ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #1663425). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+      + d/source/include-binaries: add Ubuntu icon file
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+   * Drop (LP: #1658469):
+     - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+
+ -- Nishanth Aravamudan <[e-mail]>  Thu, 09 Feb 2017 15:48:28 -0800
+
 apache2 (2.4.25-3) unstable; urgency=medium
 
   * Fix detection of systemd to fix 'apache2ctl start' on sysv-init.
@@ -242,6 +519,39 @@ apache2 (2.4.25-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Wed, 21 Dec 2016 23:46:06 +0100
 
+apache2 (2.4.23-8ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable (LP: #). Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm,
+      d/source/include-binaries: replace Debian with Ubuntu on default
+      page.
+      [ include-binaries change previously undocumented ]
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+      + debian/apache2.maintscript: remove http2 conffile.
+        [ Previously undocumented ]
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+  * Drop:
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    [ Incorrectly indicated as delta, fixed by Debian in 2.4.18-2 ]
+
+ -- Nishanth Aravamudan <[e-mail]>  Fri, 09 Dec 2016 11:02:38 +0100
+
 apache2 (2.4.23-8) unstable; urgency=medium
 
   * Move the mod_ssl_openssl.h header and the dependency on libssl-dev to a
@@ -252,6 +562,33 @@ apache2 (2.4.23-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 20 Nov 2016 00:33:13 +0100
 
+apache2 (2.4.23-7ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html, d/icons/ubuntu-logo.png, d/apache2.postrm: replace
+      Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+      + debian/rules: removed proxy_http2 from configure.
+    - Correct systemd-sysv-generator behavior by customizing some
+      parameters:
+      + d/apache2-systemd.conf: add a drop-in file to specify some
+        parameters for the systemd unit (type=Forking and
+        RemainsAfterExit=no), this allow a correct state synchronisation
+        between systemctl status and actual state of apache2 daemon.
+      + d/apache2.install: place the apache2-systemd.conf file in the
+        correct location.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 16 Nov 2016 09:17:24 -0500
+
 apache2 (2.4.23-7) unstable; urgency=medium
 
   * Make apache2-dev depend on openssl 1.0, too. Closes: #844160
@@ -366,6 +703,55 @@ apache2 (2.4.20-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 10 Apr 2016 14:03:41 +0200
 
+apache2 (2.4.18-2ubuntu4) yakkety; urgency=medium
+
+  * SECURITY UPDATE: proxy request header vulnerability (httpoxy)
+    - debian/patches/CVE-2016-5387.patch: don't pass through HTTP_PROXY in
+      server/util_script.c.
+    - CVE-2016-5387
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 18 Jul 2016 14:32:02 -0400
+
+apache2 (2.4.18-2ubuntu3) xenial; urgency=medium
+
+  [ Ryan Harper ]
+  * Drop /etc/apache2/mods-available/http2.load. This was inadvertently
+    introduced in 2.4.18-2ubuntu1. The intention is to not carry this at
+    all, since http2 support is intentionally disabled (see LP 1531864).
+  * d/apache2.maintscript: handle removal of http2.load conffile.
+
+  [ Robie Basak ]
+  * Re-write Ryan's changelog entry.
+
+ -- Robie Basak <[e-mail]>  Fri, 15 Apr 2016 18:00:57 +0000
+
+apache2 (2.4.18-2ubuntu2) xenial; urgency=medium
+
+  * Correct systemd-sysv-generator behavior by customizing some parameters (LP: #1488962)
+    - d/apache2-systemd.conf: add a drop-in file to specify some parameters for the systemd
+      unit (type=Forking and RemainsAfterExit=no), this allow a correct state synchronisation
+      between systemctl status and actual state of apache2 daemon.
+    - d/apache2.install: place the apache2-systemd.conf file in the correct location.
+
+ -- Pierre-André MOREY <[e-mail]>  Fri, 08 Apr 2016 11:48:00 +0200
+
+apache2 (2.4.18-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Timo Aaltonen <[e-mail]>  Wed, 06 Apr 2016 00:18:31 +0300
+
 apache2 (2.4.18-2) unstable; urgency=low
 
   * htcacheclean:
@@ -391,6 +777,24 @@ apache2 (2.4.18-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 28 Mar 2016 21:58:54 +0200
 
+apache2 (2.4.18-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 21 Jan 2016 15:15:22 -0500
+
 apache2 (2.4.18-1) unstable; urgency=medium
 
   * New upstream release:
@@ -398,12 +802,48 @@ apache2 (2.4.18-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 19 Dec 2015 09:26:14 +0100
 
+apache2 (2.4.17-3ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 03 Dec 2015 10:07:35 -0500
+
 apache2 (2.4.17-3) unstable; urgency=medium
 
   * mpm_prefork: Fix segfault if started with -X. Closes: #805737
 
  -- Stefan Fritsch <[e-mail]>  Mon, 23 Nov 2015 19:52:09 +0100
 
+apache2 (2.4.17-2ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Don't build experimental http2 module for LTS:
+      + debian/control: removed libnghttp2-dev Build-Depends (in universe).
+      + debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 20 Nov 2015 09:11:52 -0500
+
 apache2 (2.4.17-2) unstable; urgency=medium
 
   * Revert REDIRECT_URL to pre-2.4.17 behavior for now. The change broke
@@ -414,6 +854,31 @@ apache2 (2.4.17-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 31 Oct 2015 23:17:11 +0100
 
+apache2 (2.4.17-1ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+  * Drop patches (applied upstream):
+    - debian/patches/CVE-2015-3183.patch
+    - debian/patches/CVE-2015-3185.patch
+  * Drop changes (adopted in Debian):
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Don't build experimental http2 module for LTS
+    - debian/control: removed libnghttp2-dev Build-Depends (in universe).
+    - debian/config-dir/mods-available/http2.load: removed.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 30 Oct 2015 09:35:46 -0400
+
 apache2 (2.4.17-1) unstable; urgency=medium
 
   [ Stefan Fritsch ]
@@ -479,6 +944,49 @@ apache2 (2.4.16-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 02 Aug 2015 00:44:07 +0200
 
+apache2 (2.4.12-2ubuntu2) wily; urgency=medium
+
+  * SECURITY UPDATE: request smuggling via chunked transfer encoding
+    - debian/patches/CVE-2015-3183.patch: refactor chunk parsing in
+      modules/http/http_filters.c.
+    - CVE-2015-3183
+  * SECURITY UPDATE: access restriction bypass via deprecated API
+    - debian/patches/CVE-2015-3185.patch: deprecate old API and add new one
+      in include/http_request.h, server/request.c.
+    - CVE-2015-3185
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 24 Jul 2015 09:56:09 -0400
+
+apache2 (2.4.12-2ubuntu1) wily; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - Allow "triggers-awaited" and "triggers-pending" states in addition
+      to "installed" when determining whether to defer actions or
+      process deferred actions.
+  * Drop patches (applied upstream):
+    - d/p/split-logfile.patch
+    - d/p/CVE-2015-0228.patch
+  * Drop changes (superceded in Debian):
+    - Cherry-pick versioned build-depend on dpkg from Debian for correct
+      dpkg-maintscript-helper symlink_to_dir support.
+  * Drop changes (adopted in Debian):
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+  * Fix cross-building configure line in d/rules, which had bit-rotted in
+    previous merges.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 May 2015 16:34:00 +0000
+
 apache2 (2.4.12-2) unstable; urgency=medium
 
   [ Jean-Michel Nirgal Vourgère ]
@@ -528,6 +1036,28 @@ apache2 (2.4.10-10) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 15 Mar 2015 10:47:36 +0100
 
+apache2 (2.4.10-9ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+    - d/p/CVE-2015-0228.patch: fix logic in modules/lua/lua_request.c to fix a
+      denial of service in mod_lua via websockets PING
+  * debian/tests/ssl-passphrase: Add password responder for
+    systemd-ask-passphrase.
+
+ -- Martin Pitt <[e-mail]>  Mon, 09 Mar 2015 12:03:16 +0100
+
 apache2 (2.4.10-9) unstable; urgency=medium
 
   * CVE-2014-8109: mod_lua: Fix handling of the Require line when a
@@ -542,6 +1072,54 @@ apache2 (2.4.10-9) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Mon, 22 Dec 2014 20:24:36 +0100
 
+apache2 (2.4.10-8ubuntu3) vivid; urgency=medium
+
+  * SECURITY UPDATE: restriction bypass in mod_lua via multiple Require
+    directives
+    - debian/patches/CVE-2014-8109.patch: handle multiple Require
+      directives with different arguments in modules/lua/mod_lua.c.
+    - CVE-2014-8109
+  * SECURITY UPDATE: denial of service in mod_lua via websockets PING
+    - debian/patches/CVE-2015-0228.patch: fix logic in
+      modules/lua/lua_request.c.
+    - CVE-2015-0228
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 05 Mar 2015 10:56:34 -0500
+
+apache2 (2.4.10-8ubuntu2) vivid; urgency=medium
+
+  * Allow "triggers-awaited" and "triggers-pending" states in addition to
+    "installed" when determining whether to defer actions or process
+    deferred actions (LP: #1393832).
+
+ -- Colin Watson <[e-mail]>  Wed, 26 Nov 2014 11:31:44 +0000
+
+apache2 (2.4.10-8ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile
+      command.
+  * Fixes from Debian included in merge:
+    - Crash caused by OCSP stapling code; this was erroneously
+      attributed to Debian in my previous merge, but actually only
+      appears in 2.4.10-8; with thanks to Stefan Fritsch (LP: #1366174).
+  * Cherry-pick versioned build-depend on dpkg from Debian for correct
+    dpkg-maintscript-helper symlink_to_dir support.
+
+ -- Robie Basak <[e-mail]>  Fri, 21 Nov 2014 15:15:58 +0000
+
 apache2 (2.4.10-8) unstable; urgency=medium
 
   * Bump dpkg Pre-Depends to version that supports relative symlinks in
@@ -556,6 +1134,33 @@ apache2 (2.4.10-8) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Tue, 18 Nov 2014 15:18:18 +0100
 
+apache2 (2.4.10-7ubuntu1) vivid; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing
+      DEB_{HOST,BUILD}_GNU_TYPE to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross
+      fixes from upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+  * Fixes from Debian included in merge:
+    - Don't use a2query in preinst, as it may not be available yet
+      (LP: #1312533).
+    - Crash caused by OCSP stapling code (LP: #1366174).
+    - Disable SSLv3 in default config (LP: #1358305).
+    - If apache2 is not configured yet, defer actions executed via
+      apache2-maintscript-helper. This fixes installation failures if a
+      module package is configured first (LP: #1312854).
+
+ -- Robie Basak <[e-mail]>  Mon, 17 Nov 2014 18:04:40 +0000
+
 apache2 (2.4.10-7) unstable; urgency=medium
 
   * Handle transitions of doc dirs and symlinks correctly during upgrade.
@@ -639,6 +1244,25 @@ apache2 (2.4.10-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 21 Sep 2014 22:58:33 +0200
 
+apache2 (2.4.10-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install: Plymouth aware passphrase dialog program
+      ask-for-passphrase.
+    - Add dep8 tests.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - d/index.html: replace Debian with Ubuntu on default page.
+    - d/p/split-logfile.patch: fix completely broken split-logfile command.
+
+ -- Robie Basak <[e-mail]>  Thu, 24 Jul 2014 15:13:16 +0000
+
 apache2 (2.4.10-1) unstable; urgency=medium
 
   [ Arno Töll ]
@@ -686,6 +1310,45 @@ apache2 (2.4.9-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 08 Jun 2014 10:38:04 +0200
 
+apache2 (2.4.9-1ubuntu2) utopic; urgency=medium
+
+  * Revert 2.4.4-6ubuntu3 and build against lua 5.1 again, since Apache doesn't
+    yet support building against lua 5.2 (LP: #1323930).
+
+ -- Robie Basak <[e-mail]>  Wed, 28 May 2014 08:55:25 +0000
+
+apache2 (2.4.9-1ubuntu1) utopic; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf, d/ask-for-passphrase,
+      d/apache2.install, d/tests/ssl-passphrase: Plymouth aware passphrase
+      dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to
+      configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes from
+      upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/tests/ssl-passphrase: update for new default path /var/www/html.
+    - d/tests/duplicate-module-load: check for duplicate module loads.
+    - d/index.html: replace Debian with Ubuntu on default page (LP: #1288690).
+    - d/p/split-logfile.patch: fix completely broken split-logfile command
+      (LP: #1299162). Thanks to Holger Mauermann.
+  * Drop changes (upstreamed):
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+  * d/tests/control: adjust dep8 tests for new "breaks-testbed" facility.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 May 2014 19:30:04 +0000
+
 apache2 (2.4.9-1) unstable; urgency=medium
 
   * New upstream version.
@@ -718,6 +1381,63 @@ apache2 (2.4.9-1) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 29 Mar 2014 22:50:32 +0100
 
+apache2 (2.4.7-1ubuntu4) trusty; urgency=medium
+
+  * d/p/split-logfile.patch: fix completely broken split-logfile command
+    (LP: #1299162). Thanks to Holger Mauermann.
+
+ -- Robie Basak <[e-mail]>  Thu, 03 Apr 2014 11:21:22 +0000
+
+apache2 (2.4.7-1ubuntu3) trusty; urgency=medium
+
+  * SECURITY UPDATE: denial of service via mod_dav incorrect end of string
+    calculation
+    - debian/patches/CVE-2013-6438.patch: properly calculate correct length
+      in modules/dav/main/util.c.
+    - CVE-2013-6438
+  * SECURITY UPDATE: denial of service via truncated cookie and
+    mod_log_config
+    - debian/patches/CVE-2014-0098.patch: properly parse tokens in
+      modules/loggers/mod_log_config.c.
+    - CVE-2014-0098
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 20 Mar 2014 08:34:10 -0400
+
+apache2 (2.4.7-1ubuntu2) trusty; urgency=medium
+
+  * d/index.html: replace Debian with Ubuntu on default page
+    (LP: #1288690).
+
+ -- Robie Basak <[e-mail]>  Wed, 19 Mar 2014 11:04:21 +0000
+
+apache2 (2.4.7-1ubuntu1) trusty; urgency=medium
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - d/control, d/config-dir/mods-available/ssl.conf,
+      d/ask-for-passphrase, d/apache2.install, d/tests/ssl-passphrase:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+    - Build using lua5.2.
+    - d/tests/chroot: dep8 test for ChrootDir case.
+    - d/p/ignore-quilt-dir: adjust build system so that it does not use
+      files find inside the .pc directory. This stops a double module load
+      causing later havoc, including "ChrootDir" directive failure.
+  * Drop changes:
+    - debian/{control, rules}: Enable PIE hardening: no longer required;
+      2.4.7-1 is already hardened.
+    - d/p/itk-rerun-configure.patch: no longer needed, as ITK support has moved
+      out of this package.
+  * d/tests/ssl-passphrase: update for new default path /var/www/html.
+  * d/tests/duplicate-module-load: check for duplicate module loads.
+
+ -- Robie Basak <[e-mail]>  Tue, 14 Jan 2014 17:23:47 +0000
+
 apache2 (2.4.7-1) unstable; urgency=low
 
   New upstream version
@@ -781,6 +1501,53 @@ apache2 (2.4.6-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 12 Aug 2013 20:15:38 +0200
 
+apache2 (2.4.6-2ubuntu4) trusty; urgency=low
+
+  * d/p/ignore-quilt-dir, d/p/itk-rerun-configure.patch: adjust build system so
+    that it does not use files find inside the .pc directory. This stops a
+    double module load causing later havoc, including "ChrootDir" directive
+    failure (LP: #1251939). Thanks to Stefan Fritsch.
+  * d/tests/chroot: dep8 test for ChrootDir case.
+
+ -- Robie Basak <[e-mail]>  Thu, 28 Nov 2013 16:21:51 +0000
+
+apache2 (2.4.6-2ubuntu3) trusty; urgency=low
+
+  * debian/apache2.install: Correct path for ufw.
+    (LP: #1252722) 
+
+ -- Chuck Short <[e-mail]>  Tue, 19 Nov 2013 08:59:54 -0500
+
+apache2 (2.4.6-2ubuntu2) saucy; urgency=low
+
+  * d/ask-for-passphrase: mark executable so that apache2 can run it. Fixes
+    passphrase prompting for SSL certificates that are passphrase protected.
+  * Add dep8 test for SSL passphrase prompting.
+
+ -- Robie Basak <[e-mail]>  Fri, 09 Aug 2013 13:08:52 +0000
+
+apache2 (2.4.6-2ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, apache2.install, apache2-utils.ufw.profile,
+      apache2.dirs}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2-bin.install: Add apport hook.
+    - debian/control, debian/config-dir/mods-available/ssl.conf,
+      debian/ask-for-passphrase, debian/apache2.install: Plymouth aware
+      passphrase dialog program ask-for-passphrase.
+    - debian/rules: Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE
+      to configure.
+    - debian/patches/086_svn_cross_compiles: Backport several cross fixes
+      from upstream
+  * Dropped changes:
+    - debian/patches/CVE-2013-1896.patch: upstream
+  * Fixed module dependencies (LP: #1205314)
+    - debian/config-dir/mods-available/lbmethod_*: properly specify
+      proxy_balancer, not mod_proxy_balancer.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 26 Jul 2013 08:31:33 -0400
+
 apache2 (2.4.6-2) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -833,6 +1600,56 @@ apache2 (2.4.6-1) unstable; urgency=low
 
  -- Arno Töll <[e-mail]>  Sun, 21 Jul 2013 18:44:42 +0200
 
+apache2 (2.4.4-6ubuntu5) saucy; urgency=low
+
+  * SECURITY UPDATE: denial of service via MERGE request
+    - debian/patches/CVE-2013-1896.patch: make sure DAV is enabled for URI
+      in modules/dav/main/mod_dav.c.
+    - CVE-2013-1896
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 18 Jul 2013 11:20:47 -0400
+
+apache2 (2.4.4-6ubuntu4) saucy; urgency=low
+
+  * d/apache2-{utils,bin}.install: move apport hook from apache2-utils to
+    apache2-bin. apache2-utils is only suggested by apache2, so may not
+    always be installed by bug reporters. However, apache2-bin will always
+    need to be installed for Apache to be functional, so this is a better
+    place for the apport hook. apache2-bin already Conflicts/Replaces
+    apache2.2-common, so this also fixes (LP: #1199318).
+  * d/apache2.py: adjust apport hook for new location of configuration
+    files in apache2 >= 2.4: they have moved from apache2.2-common to
+    apache2.
+
+ -- Robie Basak <[e-mail]>  Wed, 17 Jul 2013 17:54:22 +0000
+
+apache2 (2.4.4-6ubuntu3) saucy; urgency=low
+
+  * Build using lua5.2.
+
+ -- Matthias Klose <[e-mail]>  Wed, 17 Jul 2013 14:24:42 +0200
+
+apache2 (2.4.4-6ubuntu2) saucy; urgency=low
+
+  * debian/rules: Fix FTBFS while installing ufw. 
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 10:10:14 -0500
+
+apache2 (2.4.4-6ubuntu1) saucy; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/patches/CVE-2012-2687.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-3499_4558.patch: Dropped no longer needed.
+    - debian/patches/CVE-2012-4929.patch: Dropped no longer needed.
+
+ -- Chuck Short <[e-mail]>  Tue, 02 Jul 2013 08:34:01 -0500
+
 apache2 (2.4.4-6) unstable; urgency=low
 
   * Denote exact versions breaking gnome-user-share now that Gnome maintainers
@@ -1304,6 +2121,122 @@ apache2 (2.4.1-1) experimental; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 19 Mar 2012 10:46:02 +0100
 
+apache2 (2.2.22-6ubuntu5) raring; urgency=low
+
+  * SECURITY UPDATE: multiple cross-site scripting issues
+    - debian/patches/CVE-2012-3499_4558.patch: properly escape html in
+      modules/generators/{mod_info.c,mod_status.c},
+      modules/ldap/util_ldap_cache_mgr.c, modules/mappers/mod_imagemap.c,
+      modules/proxy/{mod_proxy_balancer.c,mod_proxy_ftp.c}.
+    - CVE-2012-3499
+    - CVE-2012-4558
+  * SECURITY UPDATE: symlink attack in apache2ctl script
+    - debian/apache2ctl: introduce and use a safer mkdir_chown() function.
+    - Thanks to Stefan Fritsch for the fix.
+    - CVE-2013-1048
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 15 Mar 2013 07:59:58 -0400
+
+apache2 (2.2.22-6ubuntu4) raring; urgency=low
+
+  * Fix cross-building by passing DEB_{HOST,BUILD}_GNU_TYPE to configure.
+  * Skip module sanity check between MPMs if cross-building without the
+    kernel/binfmt support to run our target binaries on the build system.
+  * Backport several cross fixes from upstream as 086_svn_cross_compiles.
+
+ -- Adam Conrad <[e-mail]>  Wed, 05 Dec 2012 02:21:46 -0700
+
+apache2 (2.2.22-6ubuntu3) raring; urgency=low
+
+  * SECURITY UPDATE: XSS vulnerability in mod_negotiation
+    - debian/patches/CVE-2012-2687.patch: escape filenames in
+      modules/mappers/mod_negotiation.c.
+    - CVE-2012-2687
+  * SECURITY UPDATE: CRIME attack ssl attack (LP: #1068854)
+    - debian/patches/CVE-2012-4929.patch: backport SSLCompression on|off
+      directive. Defaults to off as enabling compression enables the CRIME
+      attack.
+    - CVE-2012-4929
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 08 Nov 2012 17:56:24 -0500
+
+apache2 (2.2.22-6ubuntu2) quantal; urgency=low
+
+  * debian/apache2.py
+   - Update apport hook for python3 ; thanks to Edward Donovan (LP: #1013171)
+   - Check if this directory exists: /etc/apache2/sites-enabled/
+
+ -- Matthieu Baerts (matttbe) <[e-mail]>  Mon, 16 Jul 2012 10:02:18 +0200
+
+apache2 (2.2.22-6ubuntu1) quantal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+  * Dropped changes:
+    - debian/control: Add bzr tag and point it to our tree; this is not 
+      really required and just increases the delta.
+
+ -- Robie Basak <[e-mail]>  Fri, 08 Jun 2012 11:37:31 +0100
+
+apache2 (2.2.22-6) unstable; urgency=low
+
+  [ Stefan Fritsch ]
+  * Fix regression causing apache2 to cache "206 partial content" responses,
+    and then serving these partial responses when replying to normal requests.
+    Closes: #671204
+  * Add section to security.conf that shows how to forbid access to VCS
+    directories. Closes: #548213
+  * Update ssl default cipher config, add alternative speed optimized config.
+    Closes: #649020
+  * Add "AddCharset" for .brf files in default mod_mime config.
+    Closes: #402567
+  * Don't create httpd.conf anymore and don't include it in apache2.conf. If
+    it contains local modifications, move it to /etc/apache2/conf.d/httpd.conf
+  * Port some of the comments in apache2.conf from the 2.4 package.
+  * Compile mod_version statically, drop associated module load file.
+  * If apache2 is not running, make "/etc/init.d/apache2 reload" skip the
+    configtest.
+  * Note in README.Debian that future versions of the package will have the
+    include statements changed to include only *.conf.
+  * Change compiled-in document root to /var/www, to avoid strange error
+    messages.
+  * Use "dh --with autotools_dev" instead of patching config.sub/config.guess.
+
+  [ Arno Töll ]
+  * Fix apxs to import LDFLAGS from config_vars.mk. Moreover, make it possible
+    to override LDFLAGS at compile time by defining LDLAGS in the environment,
+    just like it is possible for CFLAGS. This also means, config_vars.mk now
+    exports hardening build flags by default.
+  * Update doc-base metadata for the apache2-doc package.
+
+ -- Stefan Fritsch <[e-mail]>  Tue, 29 May 2012 22:05:48 +0200
+
+apache2 (2.2.22-5) unstable; urgency=low
+
+  * Make LoadFile and LoadModule look in the standard search paths if the
+    dso file name is given as a pure filename. This helps with the multi-arch
+    transition.
+
+ -- Stefan Fritsch <[e-mail]>  Mon, 30 Apr 2012 23:38:33 +0200
+
+apache2 (2.2.22-4) unstable; urgency=high
+
+  * CVE-2012-0216: Remove "Alias /doc /usr/share/doc" from the default virtual
+    hosts' config files.
+    If scripting modules like mod_php or mod_rivet are enabled on systems
+    where either 1) some frontend server forwards connections to an apache2
+    backend server on the localhost address, or 2) the machine running
+    apache2 is also used for web browsing, this could allow a remote
+    attacker to execute example scripts stored under /usr/share/doc.
+    Depending on the installed packages, this could lead to issues like cross
+    site scripting, code execution, or leakage of sensitive data.
+
+ -- Stefan Fritsch <[e-mail]>  Sun, 15 Apr 2012 23:41:43 +0200
+
 apache2 (2.2.22-3) unstable; urgency=low
 
   * Fix "FTBFS: mkdir: cannot create directory `debian/build-tree/arch':
@@ -1324,6 +2257,18 @@ apache2 (2.2.22-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 15 Mar 2012 00:02:31 +0100
 
+apache2 (2.2.22-1ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 12 Feb 2012 20:06:35 -0500
+
 apache2 (2.2.22-1) unstable; urgency=low
 
    [ Stefan Fritsch ]
@@ -1341,6 +2286,18 @@ apache2 (2.2.22-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 01 Feb 2012 21:49:04 +0100 
 
+apache2 (2.2.21-5ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 09 Jan 2012 06:26:31 +0000
+
 apache2 (2.2.21-5) unstable; urgency=low
 
   [ Arno Töll ]
@@ -1394,6 +2351,26 @@ apache2 (2.2.21-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 29 Dec 2011 12:09:14 +0100
 
+apache2 (2.2.21-3ubuntu2) precise; urgency=low
+
+  * d/ask-for-passphrase: Flip the logic of this script so that it checks
+    first to see if apache is being started from a TTY, and then if not,
+    tries plymouth. (LP: #887410)
+
+ -- Clint Byrum <[e-mail]>  Tue, 06 Dec 2011 16:49:33 -0800
+
+apache2 (2.2.21-3ubuntu1) precise; urgency=low
+
+  * Merge from Debian testing.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 09 Dec 2011 05:20:43 +0000
+
 apache2 (2.2.21-3) unstable; urgency=medium
 
   * Fix CVE-2011-4317: Prevent unintended pattern expansion in some
@@ -1408,6 +2385,24 @@ apache2 (2.2.21-3) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 03 Dec 2011 18:54:03 +0100
 
+apache2 (2.2.21-2ubuntu2) precise; urgency=low
+
+  * No-change rebuild to drop spurious libsfgcc1 dependency on armhf.
+
+ -- Adam Conrad <[e-mail]>  Fri, 02 Dec 2011 17:36:28 -0700
+
+apache2 (2.2.21-2ubuntu1) precise; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Fri, 14 Oct 2011 16:01:29 +0000
+
 apache2 (2.2.21-2) unstable; urgency=high
 
   * Fix CVE-2011-3368: Prevent unintended pattern expansion in some
@@ -1425,6 +2420,19 @@ apache2 (2.2.21-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 26 Sep 2011 18:16:11 +0200
 
+apache2 (2.2.20-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable to fix CVE-2011-3192 (LP: #837991).
+    Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Steve Beattie <[e-mail]>  Tue, 06 Sep 2011 01:17:15 -0700
+
 apache2 (2.2.20-1) unstable; urgency=low
 
   * New upstream release.
@@ -1447,6 +2455,18 @@ apache2 (2.2.19-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 29 Aug 2011 17:08:17 +0200
 
+apache2 (2.2.19-1ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable (LP: #787013). Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debian/apache2.py, debian/apache2.2-common.install: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Andres Rodriguez <[e-mail]>  Mon, 23 May 2011 10:16:09 -0400
+
 apache2 (2.2.19-1) unstable; urgency=low
 
   * New upstream release.
@@ -1464,6 +2484,18 @@ apache2 (2.2.19-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 22 May 2011 10:21:21 +0200
 
+apache2 (2.2.17-3ubuntu1) oneiric; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Mon, 11 Apr 2011 02:13:30 +0100
+
 apache2 (2.2.17-3) unstable; urgency=low
 
   * Fix compilation with OpenSSL without SSLv2 support. Closes: #622049
@@ -1490,6 +2522,18 @@ apache2 (2.2.17-2) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 21 Mar 2011 23:01:17 +0100
 
+apache2 (2.2.17-1ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase. 
+
+ -- Chuck Short <[e-mail]>  Tue, 22 Feb 2011 13:02:08 -0500
+
 apache2 (2.2.17-1) unstable; urgency=low
 
   * New upstream version
@@ -1498,6 +2542,32 @@ apache2 (2.2.17-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 15 Feb 2011 23:30:18 +0100
 
+apache2 (2.2.16-6ubuntu3) natty; urgency=low
+
+  * debian/rules: Don't use "-fno-strict-aliasing" since it causes
+    apache FTBFS on amd64. (LP: #711293) 
+
+ -- Chuck Short <[e-mail]>  Tue, 01 Feb 2011 10:19:55 -0500
+
+apache2 (2.2.16-6ubuntu2) natty; urgency=low
+
+  * debian/rules: Use "-fno-strict-aliasing" to work around a gcc bug.
+   (LP: #697105) 
+
+ -- Chuck Short <[e-mail]>  Tue, 25 Jan 2011 11:14:58 -0500
+
+apache2 (2.2.16-6ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+    - debain/apache2.py, debian/apache2.2-common.isntall: Add apport hook.
+    - debian/control, debian/ask-for-passphrase, debian/config-dir/mods-available/ssl.conf:
+      Plymouth aware passphrase dialog program ask-for-passphrase.
+
+ -- Chuck Short <[e-mail]>  Sun, 02 Jan 2011 06:05:51 +0000
+
 apache2 (2.2.16-6) unstable; urgency=low
 
   * Also add $named to the secondary-init-script example.
@@ -1513,6 +2583,30 @@ apache2 (2.2.16-5) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Fri, 31 Dec 2010 01:22:19 +0100
 
+apache2 (2.2.16-4ubuntu2) natty; urgency=low
+
+  [Clint Byrum]
+  * Adding plymouth aware passphrase dialog program ask-for-passphrase.
+    (LP: #582963)
+    + debian/control: apache2.2-common depends on bash for ask-for-passphrase
+    + debian/config-dir/mods-available/ssl.conf:
+      - SSLPassPhraseDialog now uses exec:/usr/share/apache2/ask-for-passhrase
+
+  [Chuck Short]
+  * Add apport hook. (LP: #609177)
+    + debian/apache2.py, debian/apache2.2-common.install
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:43 -0500
+
+apache2 (2.2.16-4ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree
+
+ -- Chuck Short <[e-mail]>  Mon, 22 Nov 2010 09:43:41 -0500
+
 apache2 (2.2.16-4) unstable; urgency=medium
 
   * Increase the mod_reqtimeout default timeouts to avoid potential problems
@@ -1523,6 +2617,15 @@ apache2 (2.2.16-4) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Nov 2010 19:05:55 +0100
 
+apache2 (2.2.16-3ubuntu1) natty; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Tue, 12 Oct 2010 11:54:48 +0100
+
 apache2 (2.2.16-3) unstable; urgency=high
 
   * CVE-2010-1623: mod_reqtimeout: Fix potential DoS by high memory usage.
@@ -1545,6 +2648,30 @@ apache2 (2.2.16-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 29 Aug 2010 15:29:21 +0200
 
+apache2 (2.2.16-1ubuntu3) maverick; urgency=low
+
+  * Revert "stty sane" to unbreak apache starting, this will have to be
+    fixed a different way. (LP: #626723) 
+
+ -- Chuck Short <[e-mail]>  Wed, 08 Sep 2010 08:33:17 -0400
+
+apache2 (2.2.16-1ubuntu2) maverick; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Add stty sane so that users will get a 
+    password prompt when using apache-ssl. (LP: #582963)
+
+ -- Chuck Short <[e-mail]>  Wed, 25 Aug 2010 09:25:05 -0400
+
+apache2 (2.2.16-1ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 26 Jul 2010 20:21:37 +0100
+
 apache2 (2.2.16-1) unstable; urgency=medium
 
   * Urgency medium for security fix.
@@ -1577,6 +2704,24 @@ apache2 (2.2.15-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jul 2010 23:41:08 +0200
 
+apache2 (2.2.15-5ubuntu1) maverick; urgency=low
+
+  * Merge from debian unstable.  Remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+    - debian/apache2-2.common.apache2.init: Add graceful restart (LP: #456381)
+    + Dropped:
+      - debian/patches/206-fix-potential-memory-leaks.dpatch: No longer needed.
+      - debian/patches/206-report-max-client-mpm-worker.dpatch: No longer needed.
+      - debian/config-dir/apache2.conf: Merged back from debian.
+      - mod-reqtimeout functionality: Merge back from debian.
+      - debian/patches/204_CVE-2010-0408.dpatch: No longer needed.
+      - debian/patches/205_CVE-2010-0434.dpatch: No longer needed.
+      - debian/patches/203_fix-ab-segfault.dpatch: No longer needed.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 May 2010 01:28:04 +0100
+
 apache2 (2.2.15-5) unstable; urgency=low
 
   * Conflict with apache package as we now include apachectl. Closes: #579065
@@ -1697,6 +2842,80 @@ apache2 (2.2.14-6) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 07 Feb 2010 17:29:45 +0100
 
+apache2 (2.2.14-5ubuntu8) lucid; urgency=low
+
+  * debian/patches/210-backport-mod-reqtimeout-ftbfs.dpatch: Add missing mod_reqtime.so
+    (LP: #562370) 
+
+ -- Chuck Short <[e-mail]>  Tue, 13 Apr 2010 15:09:57 -0400
+
+apache2 (2.2.14-5ubuntu7) lucid; urgency=low
+
+  * debian/patches/206-fix-potential-memory-leaks.dpatch: Fix potential memory
+    leaks by making sure to not destroy bucket brigades that have been created
+    by earlier filters. Backported from 2.2.15.
+  * debian/patches/206-report-max-client-mpm-worker.dpatch: Don't report server 
+    has reached MaxClients until it has. Backported from 2.2.15
+  * debian/config-dir/apache2.conf: Make the Files ~ "^\.ht" block in apache2.conf 
+    more secure by adding Satisfy all. (Debian bug: #572075)
+  * debian/rules, debian/patches/209-backport-mod-reqtimeout.dpatch, 
+    debian/config2-dir/mods-available/reqtimeout.load,
+    debian/config2-dir/mods-available/reqtimeout.conf debian/NEWS : Backport the 
+    mod-reqtimeout module from 2.2.15, this will mitigate apache slowloris
+    bug in apache. Enable it by default. (LP: #392759)
+
+ -- Chuck Short <[e-mail]>  Mon, 05 Apr 2010 09:53:35 -0400
+
+apache2 (2.2.14-5ubuntu6) lucid; urgency=low
+
+  * debian/apache2.2-common.apache2.init: Fix thinko. (LP: #551681) 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 09:41:11 -0400
+
+apache2 (2.2.14-5ubuntu5) lucid; urgency=low
+
+  * Revert 99-fix-mod-dav-permissions.dpatch 
+
+ -- Chuck Short <[e-mail]>  Tue, 30 Mar 2010 07:55:46 -0400
+
+apache2 (2.2.14-5ubuntu4) lucid; urgency=low
+
+  * debian/patches/99-fix-mod-dav-permissions.dpatch: Fix permisisons when 
+    downloading files from webdav (LP: #540747)
+  * debian/apache2.2-common.apache2.init: Add graceful restart (LP: #456381)
+
+ -- Chuck Short <[e-mail]>  Mon, 29 Mar 2010 13:37:39 -0400
+
+apache2 (2.2.14-5ubuntu3) lucid; urgency=low
+
+  * SECURITY UPDATE: denial of service via crafted request in mod_proxy_ajp
+    - debian/patches/204_CVE-2010-0408.dpatch: return the right error code
+      in modules/proxy/mod_proxy_ajp.c.
+    - CVE-2010-0408
+  * SECURITY UPDATE: information disclosure via improper handling of
+    headers in subrequests
+    - debian/patches/205_CVE-2010-0434.dpatch: use a copy of r->headers_in
+      in server/protocol.c.
+    - CVE-2010-0434
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 10 Mar 2010 14:48:48 -0500
+
+apache2 (2.2.14-5ubuntu2) lucid; urgency=low
+
+  * debian/patches/203_fix-ab-segfault.dpatch: Fix segfaulting ab when using really
+    wacky options. (LP: #450501) 
+
+ -- Chuck Short <[e-mail]>  Mon, 08 Mar 2010 14:53:17 -0500
+
+apache2 (2.2.14-5ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing.  Remaining changes: LP: #506862
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/control: Add bzr tag and point it to our tree.
+
+ -- Bhavani Shankar <[e-mail]>  Wed, 13 Jan 2010 14:28:41 +0530
+
 apache2 (2.2.14-5) unstable; urgency=low
 
   * Security: Further mitigation for the TLS renegotation attack
@@ -1720,6 +2939,15 @@ apache2 (2.2.14-5) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sat, 02 Jan 2010 22:44:15 +0100
 
+apache2 (2.2.14-4ubuntu1) lucid; urgency=low
+
+  * Resynchronzie with Debian, remaining changes are:
+   - debian/{control, rules}: Enable PIE hardening.
+   - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+   - debian/control: Add bzr tag and point it to our tree.
+
+ -- Chuck Short <[e-mail]>  Wed, 23 Dec 2009 14:44:51 -0500
+
 apache2 (2.2.14-4) unstable; urgency=low
 
   * Disable localized error pages again by default because they break
@@ -1770,6 +2998,17 @@ apache2 (2.2.14-2) unstable; urgency=medium
 
  -- Stefan Fritsch <[e-mail]>  Sat, 07 Nov 2009 14:37:37 +0100
 
+apache2 (2.2.14-1ubuntu1) lucid; urgency=low
+
+  * Merge from debian testing, remaining changes:
+    - debian/{control, rules}: Enable PIE hardening.
+    - debian/{control, rules, pache2.2-common.ufw.profile}: Add ufw profiles.
+    - debian/conrol: Add bzr tag and point it to our tree.
+    - Dropped debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+      Already applied upstream.
+
+ -- Chuck Short <[e-mail]>  Fri, 06 Nov 2009 00:29:03 +0000
+
 apache2 (2.2.14-1) unstable; urgency=low
 
   * New upstream version:
@@ -1804,6 +3043,24 @@ apache2 (2.2.13-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Mon, 31 Aug 2009 20:28:56 +0200
 
+apache2 (2.2.12-1ubuntu2) karmic; urgency=low
+
+  * debian/patches/203_fix_legacy_ap_rputs_segfaults.dpatch: 
+    - Fix potential segfaults with the use of the legacy ap_rputs() etc
+      interfaces, in cases where an output filter fails. This happens
+      frequently after CVE-2009-1891 got fixed. (LP: #409987) 
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 17 Aug 2009 15:38:47 -0400
+
+apache2 (2.2.12-1ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+    - Dropped debian/patches/203_fix-ssl-timeftm-ignored.dpatch.
+
+ -- Chuck Short <[e-mail]>  Tue, 04 Aug 2009 20:04:24 +0100
+
 apache2 (2.2.12-1) unstable; urgency=low
 
   * New upstream release:
@@ -1851,6 +3108,16 @@ apache2 (2.2.12-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 04 Aug 2009 11:02:34 +0200
 
+apache2 (2.2.11-7ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes: LP: #398130
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 11 Jul 2009 16:34:32 +0530
+
 apache2 (2.2.11-7) unstable; urgency=low
 
   * Security fixes:
@@ -1865,6 +3132,16 @@ apache2 (2.2.11-7) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 10 Jul 2009 22:42:57 +0200
 
+apache2 (2.2.11-6ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssl-timeftm-ignored.dpatch:
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914)
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Tue, 09 Jun 2009 01:01:23 +0100
+
 apache2 (2.2.11-6) unstable; urgency=high
 
   * CVE-2009-1195: mod_include allowed to bypass IncludesNoExec for Server
@@ -1873,6 +3150,16 @@ apache2 (2.2.11-6) unstable; urgency=high
 
  -- Stefan Fritsch <[e-mail]>  Mon, 08 Jun 2009 19:22:58 +0200
 
+apache2 (2.2.11-5ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Wed, 03 Jun 2009 14:10:54 +1200
+
 apache2 (2.2.11-5) unstable; urgency=low
 
   * Move all binaries into a new package apache2.2-bin and make
@@ -1921,6 +3208,16 @@ apache2 (2.2.11-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 19 May 2009 22:55:27 +0200
 
+apache2 (2.2.11-3ubuntu1) karmic; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+      Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Andrew Mitchell <[e-mail]>  Tue, 12 May 2009 16:15:34 +1200
+
 apache2 (2.2.11-3) unstable; urgency=low
 
   * Rebuild against apr-util 1.3, to fix undefined symbol errors in mod_ldap
@@ -1929,6 +3226,21 @@ apache2 (2.2.11-3) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Tue, 31 Mar 2009 21:07:26 +0200
 
+apache2 (2.2.11-2ubuntu2) jaunty; urgency=low
+
+  * debian/patches/203_fix-ssi-timeftm-ignored.dpatch: 
+    Fix timefmt is ignored when XBitHack is on. (LP: #258914) 
+
+ -- Chuck Short <[e-mail]>  Wed, 01 Apr 2009 11:39:17 -0400
+
+apache2 (2.2.11-2ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{contro,rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Sat, 17 Jan 2009 00:02:55 +0000
+
 apache2 (2.2.11-2) unstable; urgency=low
 
   * Report an error instead instead of segfaulting when apr_pollset_create
@@ -1938,6 +3250,14 @@ apache2 (2.2.11-2) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Fri, 16 Jan 2009 19:01:59 +0100
 
+apache2 (2.2.11-1ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Mon, 15 Dec 2008 00:06:50 +0000
+
 apache2 (2.2.11-1) unstable; urgency=low
 
   [Thom May]
@@ -1952,6 +3272,14 @@ apache2 (2.2.11-1) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 14 Dec 2008 09:34:24 +0100
 
+apache2 (2.2.9-11ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes: (LP: #303375)
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Bhavani Shankar <[e-mail]>  Sat, 29 Nov 2008 14:02:31 +0530
+
 apache2 (2.2.9-11) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy:
@@ -1966,6 +3294,14 @@ apache2 (2.2.9-11) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Wed, 26 Nov 2008 23:10:22 +0100
 
+apache2 (2.2.9-10ubuntu1) jaunty; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control, rules}: enable PIE hardening.
+    - debian/{control, rules, apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Chuck Short <[e-mail]>  Wed, 05 Nov 2008 02:23:18 -0400
+
 apache2 (2.2.9-10) unstable; urgency=low
 
   * Regression fix from upstream svn for mod_proxy_http:
@@ -1996,6 +3332,27 @@ apache2 (2.2.9-8) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Thu, 11 Sep 2008 09:17:33 +0200
 
+apache2 (2.2.9-7ubuntu3) intrepid; urgency=low
+
+  * Revert logrotate change since it will break it for everyone. 
+
+ -- Chuck Short <[e-mail]>  Fri, 19 Sep 2008 09:32:01 -0400
+
+apache2 (2.2.9-7ubuntu2) intrepid; urgency=low
+
+  * debian/logrotate: Restart rather than reload for busy websites.
+    (LP: #270899) 
+
+ -- Chuck Short <[e-mail]>  Thu, 18 Sep 2008 08:42:22 -0400
+
+apache2 (2.2.9-7ubuntu1) intrepid; urgency=low
+
+  * Merge from debian unstable, remaining changes:
+    - debian/{control,rules}: enable PIE hardening.
+    - debian/{control,rules,apache2.2-common.ufw.profile}: add ufw profiles.
+
+ -- Kees Cook <[e-mail]>  Thu, 28 Aug 2008 08:10:59 -0700
+
 apache2 (2.2.9-7) unstable; urgency=low
 
   * Fix XSS in mod_proxy_ftp (CVE-2008-2939).
@@ -2038,6 +3395,23 @@ apache2 (2.2.9-4) unstable; urgency=low
 
  -- Stefan Fritsch <[e-mail]>  Sun, 06 Jul 2008 10:38:37 +0200
 
+apache2 (2.2.9-3ubuntu2) intrepid; urgency=low
+
+  * add ufw integration (see
+    https://wiki.ubuntu.com/UbuntuFirewall#Integrating%20UFW%20with%20Packages)
+    (LP: #261198)
+    - debian/control: suggest ufw for apache2.2-common
+    - add apache2.2-common.ufw.profile with 3 profiles and install it to
+      /etc/ufw/applications.d/apache2.2-common
+
+ -- Didier Roche <[e-mail]>  Tue, 26 Aug 2008 19:03:42 +0200
+
+apache2 (2.2.9-3ubuntu1) intrepid; urgency=low
+
+  * debian/{control,rules}: enable PIE hardening
+
+ -- Kees Cook <[e-mail]>  Wed, 20 Aug 2008 15:45:00 -0700
+
 apache2 (2.2.9-3) unstable; urgency=low
 
   [ Stefan Fritsch ]
@@ -4118,3 +5492,4 @@ apache2 (2.0.18-1) unstable; urgency=low
   * Initial Release.
 
  -- Daniel Stone <[e-mail]>  Wed,  4 Jul 2001 21:29:29 +1000
+
diff --git a/debian/config-dir/mods-available/md.load b/debian/config-dir/mods-available/md.load
 deleted file mode 100644
index 812a6a6..0000000
--- a/debian/config-dir/mods-available/md.load
+++ /dev/null
@@ -1 +0,0 @@
-LoadModule md_module /usr/lib/apache2/modules/mod_md.so
diff --git a/debian/control b/debian/control
index a72cfff..05adf99 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: apache2
 Section: httpd
 Priority: optional
-Maintainer: Debian Apache Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Apache Maintainers <[e-mail]>
 Uploaders: Stefan Fritsch <[e-mail]>,
            Arno Töll <[e-mail]>,
            Ondřej Surý <[e-mail]>
@@ -18,9 +19,7 @@ Build-Depends: debhelper (>= 9.20160709~),
                libxml2-dev,
                lsb-release,
                perl,
-               zlib1g-dev,
-               libcurl4-openssl-dev | libcurl4-dev,
-               libjansson-dev
+               zlib1g-dev
 Build-Conflicts: autoconf2.13
 Standards-Version: 4.1.2
 Vcs-Browser: https://salsa.debian.org/apache-team/apache2
@@ -44,15 +43,14 @@ Provides: httpd,
 Recommends: ssl-cert
 Conflicts: apache2.2-bin,
            apache2.2-common
-Breaks: libapache2-mod-md (<< 2.4.33),
-        libapache2-mod-proxy-uwsgi (<< 2.4.33)
+Breaks: libapache2-mod-proxy-uwsgi (<< 2.4.33)
 Replaces: apache2.2-bin,
           apache2.2-common,
-          libapache2-mod-md (<< 2.4.33),
           libapache2-mod-proxy-uwsgi (<< 2.4.33)
 Suggests: apache2-doc,
           apache2-suexec-pristine | apache2-suexec-custom,
-          www-browser
+          www-browser,
+          ufw
 Description: Apache HTTP Server
  The Apache HTTP Server Project's goal is to build a secure, efficient and
  extensible HTTP server as standards-compliant open source software. The
@@ -81,10 +79,8 @@ Depends: ${misc:Depends},
 Provides: ${apache2:API}
 Breaks: gridsite (<< 3.0.0~20170225gitd51b2fd-1~),
         libapache2-mod-dacs (<= 1.4.38a-2),
-        libapache2-mod-md (<< 2.4.33),
         libapache2-mod-proxy-uwsgi (<< 2.4.33)
-Replaces: libapache2-mod-md (<< 2.4.33),
-          libapache2-mod-proxy-uwsgi (<< 2.4.33)
+Replaces: libapache2-mod-proxy-uwsgi (<< 2.4.33)
 Suggests: apache2-doc,
           apache2-suexec-pristine | apache2-suexec-custom,
           www-browser
@@ -210,14 +206,6 @@ Description: Apache debugging symbols
  crashing server instances and modules.  See
  /usr/share/doc/apache2/README.backtrace for more information.
 
-Package: libapache2-mod-md
-Architecture: any
-Section: oldlibs
-Depends: ${misc:Depends}, apache2 (= ${binary:Version})
-Description: transitional package
- This is a transitional package to apache2 for users of libapache2-mod-md.
- It can be safely removed after the installation is complete.
-
 Package: libapache2-mod-proxy-uwsgi
 Architecture: any
 Section: oldlibs
diff --git a/debian/icons/ubuntu-logo.png b/debian/icons/ubuntu-logo.png
 new file mode 100644
index 0000000..4db2fa1
 Binary files /dev/null and b/debian/icons/ubuntu-logo.png differ
diff --git a/debian/index.html b/debian/index.html
index 766401d..96ed444 100644
--- a/debian/index.html
+++ b/debian/index.html
@@ -1,9 +1,14 @@
 
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
+  <!--
+    Modified from the Debian original for Ubuntu
+    Last updated: 2016-11-16
+    See: https://launchpad.net/bugs/1288690
+  -->
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
-    <title>Apache2 Debian Default Page: It works</title>
+    <title>Apache2 Ubuntu Default Page: It works</title>
     <style type="text/css" media="screen">
   * {
     margin: 0px 0px 0px 0px;
@@ -188,9 +193,9 @@
   <body>
     <div class="main_page">
       <div class="page_header floating_element">
-        <img src="/icons/openlogo-75.png" alt="Debian Logo" class="floating_element"/>
+        <img src="/icons/ubuntu-logo.png" alt="Ubuntu Logo" class="floating_element"/>
         <span class="floating_element">
-          Apache2 Debian Default Page
+          Apache2 Ubuntu Default Page
         </span>
       </div>
 <!--      <div class="table_of_contents floating_element">
@@ -221,7 +226,9 @@
         <div class="content_section_text">
           <p>
                 This is the default welcome page used to test the correct 
-                operation of the Apache2 server after installation on Debian systems.
+                operation of the Apache2 server after installation on Ubuntu systems.
+                It is based on the equivalent page on Debian, from which the Ubuntu Apache
+                packaging is derived.
                 If you can read this page, it means that the Apache HTTP server installed at
                 this site is working properly. You should <b>replace this file</b> (located at
                 <tt>/var/www/html/index.html</tt>) before continuing to operate your HTTP server.
@@ -242,9 +249,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Debian's Apache2 default configuration is different from the
+                Ubuntu's Apache2 default configuration is different from the
                 upstream default configuration, and split into several files optimized for
-                interaction with Debian tools. The configuration system is
+                interaction with Ubuntu tools. The configuration system is
                 <b>fully documented in
                 /usr/share/doc/apache2/README.Debian.gz</b>. Refer to this for the full
                 documentation. Documentation for the web server itself can be
@@ -253,7 +260,7 @@
 
           </p>
           <p>
-                The configuration layout for an Apache2 web server installation on Debian systems is as follows:
+                The configuration layout for an Apache2 web server installation on Ubuntu systems is as follows:
           </p>
           <pre>
 /etc/apache2/
@@ -324,7 +331,7 @@
 
         <div class="content_section_text">
             <p>
-                By default, Debian does not allow access through the web browser to
+                By default, Ubuntu does not allow access through the web browser to
                 <em>any</em> file apart of those located in <tt>/var/www</tt>,
                 <a href="http://httpd.apache.org/docs/2.4/mod/mod_userdir.html" rel="nofollow">public_html</a>
                 directories (when enabled) and <tt>/usr/share</tt> (for web
@@ -333,7 +340,7 @@
                 document root directory in <tt>/etc/apache2/apache2.conf</tt>.
             </p>
             <p>
-                The default Debian document root is <tt>/var/www/html</tt>. You
+                The default Ubuntu document root is <tt>/var/www/html</tt>. You
                 can make your own virtual hosts under /var/www. This is different
                 to previous releases which provides better security out of the box.
             </p>
@@ -345,9 +352,9 @@
         </div>
         <div class="content_section_text">
           <p>
-                Please use the <tt>reportbug</tt> tool to report bugs in the
-                Apache2 package with Debian. However, check <a
-                href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?ordering=normal;archive=0;src=apache2;repeatmerged=0"
+                Please use the <tt>ubuntu-bug</tt> tool to report bugs in the
+                Apache2 package with Ubuntu. However, check <a
+                href="https://bugs.launchpad.net/ubuntu/+source/apache2"
                 rel="nofollow">existing bug reports</a> before reporting a new bug.
           </p>
           <p>
diff --git a/debian/patches/086_svn_cross_compiles b/debian/patches/086_svn_cross_compiles
 new file mode 100644
index 0000000..b237908
--- /dev/null
+++ b/debian/patches/086_svn_cross_compiles
@@ -0,0 +1,118 @@
+Description: Pull upstream fixes for autotools for cross-compiling
+Author: Adam Conrad <[e-mail]>
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328445
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1327907
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328390
+Origin: upstream, http://svn.eu.apache.org/viewvc?view=revision&revision=1328714
+Forwarded: not-needed
+
+Index: apache2-2.4.29/acinclude.m4
+===================================================================
+--- apache2-2.4.29.orig/acinclude.m4	2017-11-10 10:56:51.488205250 -0500
++++ apache2-2.4.29/acinclude.m4	2017-11-10 10:56:51.484205199 -0500
+@@ -55,6 +55,8 @@ AC_DEFUN([APACHE_GEN_CONFIG_VARS],[
+   APACHE_SUBST(CPPFLAGS)
+   APACHE_SUBST(CFLAGS)
+   APACHE_SUBST(CXXFLAGS)
++  APACHE_SUBST(CC_FOR_BUILD)
++  APACHE_SUBST(CFLAGS_FOR_BUILD)
+   APACHE_SUBST(LTFLAGS)
+   APACHE_SUBST(LDFLAGS)
+   APACHE_SUBST(LT_LDFLAGS)
+@@ -697,7 +699,7 @@ int main(void)
+ {
+     return sizeof(void *) < sizeof(long); 
+ }], [ap_cv_void_ptr_lt_long=no], [ap_cv_void_ptr_lt_long=yes], 
+-    [ap_cv_void_ptr_lt_long=yes])])
++    [ap_cv_void_ptr_lt_long="cross compile - not checked"])])
+ 
+ if test "$ap_cv_void_ptr_lt_long" = "yes"; then
+     AC_MSG_ERROR([Size of "void *" is less than size of "long"])
+Index: apache2-2.4.29/configure
+===================================================================
+--- apache2-2.4.29.orig/configure	2017-11-10 10:56:51.488205250 -0500
++++ apache2-2.4.29/configure	2017-11-10 10:56:51.488205250 -0500
+@@ -662,6 +662,8 @@ HTTPD_LDFLAGS
+ SH_LDFLAGS
+ LT_LDFLAGS
+ LTFLAGS
++CFLAGS_FOR_BUILD
++CC_FOR_BUILD
+ CXXFLAGS
+ CXX
+ other_targets
+@@ -6071,6 +6073,12 @@ fi
+ 
+ 
+ 
++if test "x${build_alias}" != "x${host_alias}"; then
++  if test "x${CC_FOR_BUILD}" = "x"; then
++    CC_FOR_BUILD=cc
++  fi
++fi
++
+ if test "x${cache_file}" = "x/dev/null"; then
+   # Likewise, ensure that CC and CPP are passed through to the pcre
+   # configure script iff caching is disabled (the autoconf 2.5x default).
+@@ -7698,7 +7706,7 @@ if ${ap_cv_void_ptr_lt_long+:} false; th
+   $as_echo_n "(cached) " >&6
+ else
+   if test "$cross_compiling" = yes; then :
+-  ap_cv_void_ptr_lt_long=yes
++  ap_cv_void_ptr_lt_long="cross compile - not checked"
+ else
+   cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+ /* end confdefs.h.  */
+@@ -37522,6 +37530,14 @@ $as_echo "$as_me: " >&6;}
+ 
+ 
+ 
++  APACHE_VAR_SUBST="$APACHE_VAR_SUBST CC_FOR_BUILD"
++
++
++
++  APACHE_VAR_SUBST="$APACHE_VAR_SUBST CFLAGS_FOR_BUILD"
++
++
++
+   APACHE_VAR_SUBST="$APACHE_VAR_SUBST LTFLAGS"
+ 
+ 
+Index: apache2-2.4.29/configure.in
+===================================================================
+--- apache2-2.4.29.orig/configure.in	2017-11-10 10:56:51.488205250 -0500
++++ apache2-2.4.29/configure.in	2017-11-10 10:56:51.488205250 -0500
+@@ -206,6 +206,14 @@ AC_PROG_CPP
+ dnl Try to get c99 support for variadic macros
+ ifdef([AC_PROG_CC_C99], [AC_PROG_CC_C99])
+ 
++dnl In case of cross compilation we set CC_FOR_BUILD to cc unless
++dnl we got already CC_FOR_BUILD from environment.
++if test "x${build_alias}" != "x${host_alias}"; then
++  if test "x${CC_FOR_BUILD}" = "x"; then
++    CC_FOR_BUILD=cc
++  fi
++fi
++
+ if test "x${cache_file}" = "x/dev/null"; then
+   # Likewise, ensure that CC and CPP are passed through to the pcre
+   # configure script iff caching is disabled (the autoconf 2.5x default).
+Index: apache2-2.4.29/server/Makefile.in
+===================================================================
+--- apache2-2.4.29.orig/server/Makefile.in	2017-11-10 10:56:51.488205250 -0500
++++ apache2-2.4.29/server/Makefile.in	2017-11-10 10:56:51.488205250 -0500
+@@ -24,9 +24,14 @@ TARGETS = delete-exports $(LTLIBRARY_NAM
+ include $(top_builddir)/build/rules.mk
+ include $(top_srcdir)/build/library.mk
+ 
++ifdef CC_FOR_BUILD
++gen_test_char: gen_test_char.c
++	$(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) -DCROSS_COMPILE -o $@ $<
++else
+ gen_test_char_OBJECTS = gen_test_char.lo
+ gen_test_char: $(gen_test_char_OBJECTS)
+ 	$(LINK) $(EXTRA_LDFLAGS) $(gen_test_char_OBJECTS) $(EXTRA_LIBS)
++endif
+ 
+ test_char.h: gen_test_char
+ 	./gen_test_char > test_char.h
diff --git a/debian/patches/series b/debian/patches/series
index 145853d..6e33289 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -9,3 +9,6 @@ reproducible_builds.diff
 #suexec-custom.patch
 
 remove_mod_lbmethod_load_order_dependency.diff
+
+# Patches added by Ubuntu
+086_svn_cross_compiles
diff --git a/debian/rules b/debian/rules
index e2d693c..5654762 100755
--- a/debian/rules
+++ b/debian/rules
@@ -113,6 +113,7 @@ configure-stamp: prebuild-checks-stamp support/suexec-custom.c
 		--with-apr=/usr/bin/apr-1-config --with-apr-util=/usr/bin/apu-1-config \
 		--with-pcre=yes \
 		--enable-pie \
+		--disable-md \
 		--enable-mpms-shared=all \
 		--enable-mods-shared="all brotli cgi ident authnz_fcgi imagemap cern_meta proxy_fdpass proxy_http2 bucketeer case_filter case_filter_in" \
 		--enable-mods-static="unixd logio watchdog version" \
@@ -177,7 +178,7 @@ override_dh_installdocs-indep:
 	dh_installdocs -i
 
 override_dh_installdocs-arch:
-	dh_installdocs --link-doc=apache2 -papache2 -papache2-dbg -plibapache2-mod-md -plibapache2-mod-proxy-uwsgi
+	dh_installdocs --link-doc=apache2 -papache2 -papache2-dbg -plibapache2-mod-proxy-uwsgi
 	dh_installdocs --link-doc=apache2-dev -papache2-ssl-dev
 	dh_installdocs -a
 
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
index b6a30fe..c9128c9 100644
--- a/debian/source/include-binaries
+++ b/debian/source/include-binaries
@@ -16,6 +16,7 @@ debian/icons/odf6odp-20x22.png
 debian/icons/odf6otp-20x22.png
 debian/icons/odf6oth-20x22.png
 debian/icons/openlogo-75.png
+debian/icons/ubuntu-logo.png
 debian/upstream/signing-key.pgp
 debian/perl-framework/t/htdocs/apache/acceptpathinfo/index.shtml
 debian/perl-framework/t/htdocs/apache/acceptpathinfo/info.php
diff --git a/debian/tests/check-http2 b/debian/tests/check-http2
 new file mode 100644
index 0000000..6bc9125
--- /dev/null
+++ b/debian/tests/check-http2
@@ -0,0 +1,41 @@
+#!/bin/sh
+set -uxe
+
+# http2 is rather new, check that it at least generally works
+# Author: Christian Ehrhardt <[e-mail]>
+
+a2enmod http2
+a2enmod ssl
+a2ensite default-ssl
+# Enable globally
+echo "Protocols h2c h2 http/1.1" >> /etc/apache2/apache2.conf
+service apache2 restart
+
+# Use curl here. wget doesn't work on Debian, even with --no-check-certificate
+# wget on Debian gives me:
+#    GnuTLS: A TLS warning alert has been received.
+#    Unable to establish SSL connection.
+# Presumably this is due to the self-signed certificate, but I'm not sure how
+# to skip the warning with wget. curl will do for now.
+echo "Hello, world!" > /var/www/html/hello.txt
+
+testapache () {
+    cmd="${1}"
+    result=$(${cmd})
+
+    if [ "$result" != "Hello, world!" ]; then
+        echo "Unexpected result: ${result}" >&2
+        exit 1
+    else
+        echo OK
+    fi
+}
+
+# https shall not affect http
+testapache "curl -s -k http://localhost/hello.txt"
+# https shall not affect https
+testapache "curl -s -k https://localhost/hello.txt"
+#plain http2
+testapache "nghttp --no-verify-peer https://localhost/hello.txt"
+#http2 upgrade
+testapache "nghttp -u --no-verify-peer http://localhost/hello.txt"
diff --git a/debian/tests/control b/debian/tests/control
index fb913b5..230f19e 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -23,6 +23,10 @@ Tests: ssl-passphrase
 Restrictions: needs-root allow-stderr breaks-testbed
 Depends: apache2, curl, expect, ssl-cert
 
+Tests: check-http2
+Restrictions: needs-root allow-stderr breaks-testbed
+Depends: apache2, curl, ssl-cert, nghttp2-client
+
 Tests: chroot
 Features: no-build-needed
 Restrictions: needs-root allow-stderr breaks-testbed
diff --git a/docs/manual/style/latex/atbeginend.sty b/docs/manual/style/latex/atbeginend.sty
 new file mode 100644
index 0000000..79b555d
--- /dev/null
+++ b/docs/manual/style/latex/atbeginend.sty
@@ -0,0 +1,80 @@
+% atbeginend.sty 
+%
+% Licensed to the Apache Software Foundation (ASF) under one or more
+% contributor license agreements.  See the NOTICE file distributed with
+% this work for additional information regarding copyright ownership.
+% The ASF licenses this file to You under the Apache License, Version 2.0
+% (the "License"); you may not use this file except in compliance with
+% the License.  You may obtain a copy of the License at
+%
+%     http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS,
+% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+% See the License for the specific language governing permissions and
+% limitations under the License.
+
+% defines
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+%
+% Save \begin and \end to \BeginEnvironment and \EndEnvironment
+\let\BeginEnvironment=\begin
+\let\EndEnvironment=\end
+
+\def\IfUnDef#1{\expandafter\ifx\csname#1\endcsname\relax}
+
+% Null command needed to for \nothing{something}=.nothing.
+\def\NullCom#1{}
+
+\def\begin#1{%
+%
+% if defined \BeforeBeg for this environment, execute it
+\IfUnDef{BeforeBeg#1}\else\csname BeforeBeg#1\endcsname\fi%
+%
+%
+%
+\IfUnDef{AfterBeg#1}% This is done to skip the command for environments
+		     % which can take arguments, like multicols; YOU MUST NOT
+		     % USE \AfterBegin{...}{...} for such environments!
+	\let\SaveBegEng=\BeginEnvironment%
+\else%
+	% Start this environment
+		\BeginEnvironment{#1}%
+	% and execute code after \begin{environment}
+		\csname AfterBeg#1\endcsname%
+	% 
+	\let\SaveBegEng=\NullCom%
+\fi%
+\SaveBegEng{#1}%
+}
+
+
+\def\end#1{%
+%
+% execute code before \end{environment}
+\IfUnDef{BeforeEnd#1}\else\csname BeforeEnd#1\endcsname\fi%
+%
+% close this environment
+\EndEnvironment{#1}%
+%
+% and execute code after \begin{environment}
+\IfUnDef{AfterEnd#1}\else\csname AfterEnd#1\endcsname\fi%
+}
+
+
+%% Now, define commands
+% \BeforeBegin{environment}{code-to-execute}
+% \BeforeEnd  {environment}{code-to-execute}
+% \AfterBegin {environment}{code-to-execute}
+% \AfterEnd   {environment}{code-to-execute}
+
+\def\BeforeBegin#1#2{\expandafter\gdef\csname BeforeBeg#1\endcsname
+{#2}}
+\def\BeforeEnd  #1#2{\expandafter\gdef\csname BeforeEnd#1\endcsname
+{#2}}
+\def\AfterBegin #1#2{\expandafter\gdef\csname AfterBeg#1\endcsname {#2}}
+\def\AfterEnd   #1#2{\expandafter\gdef\csname AfterEnd#1\endcsname{#2}}
diff --git a/docs/manual/style/manualpage.dtd b/docs/manual/style/manualpage.dtd
 new file mode 100644
index 0000000..e9c22a0
--- /dev/null
+++ b/docs/manual/style/manualpage.dtd
@@ -0,0 +1,29 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <manualpage> is the root element -->
+<!ELEMENT manualpage (parentdocument?, title, summary?,
+seealso*, section*)>
+
+<!ATTLIST manualpage metafile CDATA  #REQUIRED
+                     upgrade  CDATA  #IMPLIED
+>
diff --git a/docs/manual/style/modulesynopsis.dtd b/docs/manual/style/modulesynopsis.dtd
 new file mode 100644
index 0000000..aa3d6ee
--- /dev/null
+++ b/docs/manual/style/modulesynopsis.dtd
@@ -0,0 +1,92 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % sitemap SYSTEM "sitemap.dtd">
+%sitemap;
+
+<!ELEMENT modulesynopsis (name , description, status, hint?, sourcefile?,
+identifier? , compatibility? , summary? , seealso* , section*,
+directivesynopsis*)>
+
+<!ATTLIST modulesynopsis metafile CDATA  #REQUIRED
+                         upgrade  CDATA  #IMPLIED>
+
+<!ELEMENT directivesynopsis (name , description? , syntax? , default?
+, contextlist? , override? , modulelist?, status?, compatibility? ,
+usage?, seealso*)>
+
+<!ELEMENT name (#PCDATA)>
+
+<!ELEMENT status (#PCDATA)>
+
+<!ELEMENT hint %Inline;>
+
+<!ELEMENT identifier (#PCDATA)>
+
+<!ELEMENT sourcefile (#PCDATA)>
+
+<!ELEMENT compatibility %Inline;>
+
+<!ELEMENT description %Inline;>
+
+<!-- 
+ idtype is appended to the directive name when generating links to allow
+ a directive of type section to share the name with another directive.
+ The attribute type could have been (re)used instead but it would have broken
+ pre-existing links.
+-->
+<!ATTLIST directivesynopsis  type       CDATA  #IMPLIED
+                             idtype     CDATA  #IMPLIED
+                             location   CDATA  #IMPLIED >
+
+<!ELEMENT syntax %Inline;>
+
+<!ELEMENT default (#PCDATA | directive | br)*>
+
+<!ELEMENT contextlist (context+)+>
+
+<!ELEMENT context (#PCDATA)>
+
+<!ELEMENT override (#PCDATA)>
+
+<!ELEMENT usage %Block;>
+
+<!-- Used in index.xml -->
+<!ELEMENT moduleindex (title, summary, seealso*)>
+
+<!ATTLIST moduleindex metafile CDATA  #REQUIRED>
+
+<!-- Used in directive.xml -->
+<!ELEMENT directiveindex (title | summary)+>
+
+<!ATTLIST directiveindex metafile CDATA  #REQUIRED>
+
+<!-- Used in quickreference.xml -->
+<!ELEMENT quickreference (title | summary | legend)+>
+<!ATTLIST quickreference metafile CDATA  #REQUIRED>
+
+<!ELEMENT legend (table, table)>
+
+<!-- Used in overrides.xml -->
+<!ELEMENT overrideindex (title | summary | overridesummary)+>
+<!ATTLIST overrideindex metafile CDATA #REQUIRED>
+
+<!ELEMENT overridesummary %Block;>
+<!ATTLIST overridesummary class    CDATA #IMPLIED
+                          fallback CDATA #IMPLIED>
diff --git a/docs/manual/style/scripts/MINIFY b/docs/manual/style/scripts/MINIFY
 new file mode 100644
index 0000000..2c1efc3
--- /dev/null
+++ b/docs/manual/style/scripts/MINIFY
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+(echo '// see prettify.js for copyright, license and expanded version'; python -mrjsmin <prettify.js) >prettify.min.js
+
+# needs python and rjsmin installed
diff --git a/docs/manual/style/scripts/prettify.js b/docs/manual/style/scripts/prettify.js
 new file mode 100644
index 0000000..2df198d
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.js
@@ -0,0 +1,1622 @@
+// Copyright (C) 2006 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+/**
+ * @fileoverview
+ * some functions for browser-side pretty printing of code contained in html.
+ *
+ * <p>
+ * For a fairly comprehensive set of languages see the
+ * <a href="http://google-code-prettify.googlecode.com/svn/trunk/README.html#langs">README</a>
+ * file that came with this source.  At a minimum, the lexer should work on a
+ * number of languages including C and friends, Java, Python, Bash, SQL, HTML,
+ * XML, CSS, Javascript, and Makefiles.  It works passably on Ruby, PHP and Awk
+ * and a subset of Perl, but, because of commenting conventions, doesn't work on
+ * Smalltalk, Lisp-like, or CAML-like languages without an explicit lang class.
+ * <p>
+ * Usage: <ol>
+ * <li> include this source file in an html page via
+ *   {@code <script type="text/javascript" src="/path/to/prettify.js"></script>}
+ * <li> define style rules.  See the example page for examples.
+ * <li> mark the {@code <pre>} and {@code <code>} tags in your source with
+ *    {@code class=prettyprint.}
+ *    You can also use the (html deprecated) {@code <xmp>} tag, but the pretty
+ *    printer needs to do more substantial DOM manipulations to support that, so
+ *    some css styles may not be preserved.
+ * </ol>
+ * That's it.  I wanted to keep the API as simple as possible, so there's no
+ * need to specify which language the code is in, but if you wish, you can add
+ * another class to the {@code <pre>} or {@code <code>} element to specify the
+ * language, as in {@code <pre class="prettyprint lang-java">}.  Any class that
+ * starts with "lang-" followed by a file extension, specifies the file type.
+ * See the "lang-*.js" files in this directory for code that implements
+ * per-language file handlers.
+ * <p>
+ * Change log:<br>
+ * cbeust, 2006/08/22
+ * <blockquote>
+ *   Java annotations (start with "@") are now captured as literals ("lit")
+ * </blockquote>
+ * @requires console
+ */
+
+// JSLint declarations
+/*global console, document, navigator, setTimeout, window, define */
+
+/**
+ * Split {@code prettyPrint} into multiple timeouts so as not to interfere with
+ * UI events.
+ * If set to {@code false}, {@code prettyPrint()} is synchronous.
+ */
+window['PR_SHOULD_USE_CONTINUATION'] = true;
+
+/**
+ * Find all the {@code <pre>} and {@code <code>} tags in the DOM with
+ * {@code class=prettyprint} and prettify them.
+ *
+ * @param {Function?} opt_whenDone if specified, called when the last entry
+ *     has been finished.
+ */
+var prettyPrintOne;
+/**
+ * Pretty print a chunk of code.
+ *
+ * @param {string} sourceCodeHtml code as html
+ * @return {string} code as html, but prettier
+ */
+var prettyPrint;
+
+
+(function () {
+  var win = window;
+  // Keyword lists for various languages.
+  // We use things that coerce to strings to make them compact when minified
+  // and to defeat aggressive optimizers that fold large string constants.
+  var FLOW_CONTROL_KEYWORDS = ["break,continue,do,else,for,if,return,while"];
+  var C_KEYWORDS = [FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default," + 
+      "double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module," +
+      "static,struct,switch,typedef,union,unsigned,void,volatile"];
+  var COMMON_KEYWORDS = [C_KEYWORDS,"catch,class,delete,false,import," +
+      "new,operator,private,protected,public,this,throw,true,try,typeof"];
+  var CPP_KEYWORDS = [COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool," +
+      "concept,concept_map,const_cast,constexpr,decltype," +
+      "dynamic_cast,explicit,export,friend,inline,late_check," +
+      "mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast," +
+      "template,typeid,typename,using,virtual,where,request_req"];
+  var JAVA_KEYWORDS = [COMMON_KEYWORDS,
+      "abstract,boolean,byte,extends,final,finally,implements,import," +
+      "instanceof,null,native,package,strictfp,super,synchronized,throws," +
+      "transient"];
+  var CSHARP_KEYWORDS = [JAVA_KEYWORDS,
+      "as,base,by,checked,decimal,delegate,descending,dynamic,event," +
+      "fixed,foreach,from,group,implicit,in,interface,internal,into,is,let," +
+      "lock,object,out,override,orderby,params,partial,readonly,ref,sbyte," +
+      "sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort," +
+      "var,virtual,where"];
+  var COFFEE_KEYWORDS = "all,and,by,catch,class,else,extends,false,finally," +
+      "for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then," +
+      "throw,true,try,unless,until,when,while,yes";
+  var JSCRIPT_KEYWORDS = [COMMON_KEYWORDS,
+      "debugger,eval,export,function,get,null,set,undefined,var,with," +
+      "Infinity,NaN"];
+  var PERL_KEYWORDS = "caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for," +
+      "goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require," +
+      "sub,undef,unless,until,use,wantarray,while,BEGIN,END";
+  var PHP_KEYWORDS = "abstract,and,array,as,break,case,catch,cfunction,class," +
+      "clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor," + 
+      "endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function," +
+      "global,goto,if,implements,interface,instanceof,namespace,new,old_function," +
+      "or,private,protected,public,static,switch,throw,try,use,var,while,xor," + 
+      "die,echo,empty,exit,eval,include,include_once,isset,list,require," + 
+      "require_once,return,print,unset";
+  var PYTHON_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "and,as,assert,class,def,del," +
+      "elif,except,exec,finally,from,global,import,in,is,lambda," +
+      "nonlocal,not,or,pass,print,raise,try,with,yield," +
+      "False,True,None"];
+  var RUBY_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "alias,and,begin,case,class," +
+      "def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo," +
+      "rescue,retry,self,super,then,true,undef,unless,until,when,yield," +
+      "BEGIN,END"];
+  var SH_KEYWORDS = [FLOW_CONTROL_KEYWORDS, "case,done,elif,esac,eval,fi," +
+      "function,in,local,set,then,until,echo"];
+  var CONFIG_ENVS = ["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];
+  var CONFIG_KEYWORDS = ["<AuthnProviderAlias>,<AuthzProviderAlias>,<Directory>,<DirectoryMatch>,<Else>,<ElseIf>,<Files>,<FilesMatch>,<If>,<IfDefine>,<IfModule>,<IfVersion>,<Limit>,<LimitExcept>,<Location>,<LocationMatch>,<MDomainSet>,<Macro>,<Proxy>,<ProxyMatch>,<RequireAll>,<RequireAny>,<RequireNone>,<VirtualHost>,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicFake,AuthBasicProvider,AuthBasicUseDigestAlgorithm,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthType,AuthUserFile,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,AuthnzFcgiCheckAuthnProvider,AuthnzFcgiDefineProvider,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerInherit,BalancerMember,BalancerPersist,BrotliAlterETag,BrotliCompressionMaxInputBlock,BrotliCompressionQuality,BrotliCompressionWindow,BrotliFilterNote,BrowserMatch,BrowserMatchNoCase,BufferSize,BufferedLogs,CGIDScriptTimeout,CGIMapExtension,CGIPassAuth,CGIVar,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheSocache,CacheSocacheMaxSize,CacheSocacheMaxTime,CacheSocacheMinTime,CacheSocacheReadSize,CacheSocacheReadTime,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DTracePrivileges,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateInflateLimitRequestBody,DeflateInflateRatioBurst,DeflateInflateRatioLimit,DeflateMemLevel,DeflateWindowSize,Deny,DirectoryCheckHandler,DirectoryIndex,DirectoryIndexRedirect,DirectorySlash,DocumentRoot,DumpIOInput,DumpIOOutput,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtFilterDefine,ExtFilterOptions,ExtendedStatus,FallbackResource,FileETag,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GlobalLog,GprofDir,GracefulShutdownTimeout,Group,H2CopyFiles,H2Direct,H2EarlyHints,H2MaxSessionStreams,H2MaxWorkerIdleSeconds,H2MaxWorkers,H2MinWorkers,H2ModernTLSOnly,H2Push,H2PushDiarySize,H2PushPriority,H2PushResource,H2SerializeHeaders,H2StreamMaxMemSize,H2TLSCoolDownSecs,H2TLSWarmUpSize,H2Upgrade,H2WindowSize,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,HttpProtocolOptions,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,IdentityCheck,IdentityCheckTimeout,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,KeepAlive,KeepAliveTimeout,KeptBodySize,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,LanguagePriority,LimitInternalRecursion,LimitRequestBody,LimitRequestFieldSize,LimitRequestFields,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,ListenCoresBucketsRatio,LoadFile,LoadModule,LogFormat,LogIOTrackTTFB,LogLevel,LogMessage,LuaAuthzProvider,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookLog,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MDBaseServer,MDCAChallenges,MDCertificateAgreement,MDCertificateAuthority,MDCertificateProtocol,MDDriveMode,MDHttpProxy,MDMember,MDMembers,MDMustStaple,MDNotifyCmd,MDPortMap,MDPrivateKeys,MDRenewWindow,MDRequireHttps,MDStoreDir,MDomain,MMapFile,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MemcacheConnTTL,MergeTrailers,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,ModMimeUsePathInfo,ModemStandard,MultiviewsMatch,Mutex,NWSSLTrustedCerts,NWSSLUpgradeable,NameVirtualHost,NoProxy,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,Protocols,ProtocolsHonorOrder,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFCGIBackendType,ProxyFCGISetEnvIf,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHCExpr,ProxyHCTPsize,ProxyHCTemplate,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLMeta,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,ProxyMaxForwards,ProxyPass,ProxyPassInherit,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,QualifyRedirectURL,RLimitCPU,RLimitMEM,RLimitNPROC,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RegisterHttpMethod,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,SSIETag,SSIEndTag,SSIErrorMsg,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCompression,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPNoverify,SSLOCSPOverrideResponder,SSLOCSPProxyURL,SSLOCSPResponderCertificateFile,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOCSPUseRequestNonce,SSLOpenSSLConfCmd,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCheckPeerName,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSRPUnknownUserSeed,SSLSRPVerifierFile,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLSessionTickets,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUseStapling,SSLUserName,SSLVerifyClient,SSLVerifyDepth,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,StartServers,StartThreads,Substitute,SubstituteInheritBefore,SubstituteMaxLineLength,Suexec,SuexecUserGroup,ThreadLimit,ThreadStackSize,ThreadsPerChild,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UndefMacro,UnsetEnv,Use,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse"]
+  var CONFIG_OPTIONS = /^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;
+  var ALL_KEYWORDS = [
+      CPP_KEYWORDS, CSHARP_KEYWORDS, JSCRIPT_KEYWORDS, PERL_KEYWORDS +
+      PYTHON_KEYWORDS, RUBY_KEYWORDS, SH_KEYWORDS, CONFIG_KEYWORDS, PHP_KEYWORDS];
+  var C_TYPES = /^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;
+
+  // token style names.  correspond to css classes
+  /**
+   * token style for a string literal
+   * @const
+   */
+  var PR_STRING = 'str';
+  /**
+   * token style for a keyword
+   * @const
+   */
+  var PR_KEYWORD = 'kwd';
+  /**
+   * token style for a comment
+   * @const
+   */
+  var PR_COMMENT = 'com';
+  /**
+   * token style for a type
+   * @const
+   */
+  var PR_TYPE = 'typ';
+  /**
+   * token style for a literal value.  e.g. 1, null, true.
+   * @const
+   */
+  var PR_LITERAL = 'lit';
+  /**
+   * token style for a punctuation string.
+   * @const
+   */
+  var PR_PUNCTUATION = 'pun';
+  /**
+   * token style for plain text.
+   * @const
+   */
+  var PR_PLAIN = 'pln';
+
+  /**
+   * token style for an sgml tag.
+   * @const
+   */
+  var PR_TAG = 'tag';
+  /**
+   * token style for a markup declaration such as a DOCTYPE.
+   * @const
+   */
+  var PR_DECLARATION = 'dec';
+  /**
+   * token style for embedded source.
+   * @const
+   */
+  var PR_SOURCE = 'src';
+  /**
+   * token style for an sgml attribute name.
+   * @const
+   */
+  var PR_ATTRIB_NAME = 'atn';
+  /**
+   * token style for an sgml attribute value.
+   * @const
+   */
+  var PR_ATTRIB_VALUE = 'atv';
+
+  /**
+   * A class that indicates a section of markup that is not code, e.g. to allow
+   * embedding of line numbers within code listings.
+   * @const
+   */
+  var PR_NOCODE = 'nocode';
+
+
+
+/**
+ * A set of tokens that can precede a regular expression literal in
+ * javascript
+ * http://web.archive.org/web/20070717142515/http://www.mozilla.org/js/language/js20/rationale/syntax.html
+ * has the full list, but I've removed ones that might be problematic when
+ * seen in languages that don't support regular expression literals.
+ *
+ * <p>Specifically, I've removed any keywords that can't precede a regexp
+ * literal in a syntactically legal javascript program, and I've removed the
+ * "in" keyword since it's not a keyword in many languages, and might be used
+ * as a count of inches.
+ *
+ * <p>The link above does not accurately describe EcmaScript rules since
+ * it fails to distinguish between (a=++/b/i) and (a++/b/i) but it works
+ * very well in practice.
+ *
+ * @private
+ * @const
+ */
+var REGEXP_PRECEDER_PATTERN = '(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';
+
+// CAVEAT: this does not properly handle the case where a regular
+// expression immediately follows another since a regular expression may
+// have flags for case-sensitivity and the like.  Having regexp tokens
+// adjacent is not valid in any language I'm aware of, so I'm punting.
+// TODO: maybe style special characters inside a regexp as punctuation.
+
+
+  /**
+   * Given a group of {@link RegExp}s, returns a {@code RegExp} that globally
+   * matches the union of the sets of strings matched by the input RegExp.
+   * Since it matches globally, if the input strings have a start-of-input
+   * anchor (/^.../), it is ignored for the purposes of unioning.
+   * @param {Array.<RegExp>} regexs non multiline, non-global regexs.
+   * @return {RegExp} a global regex.
+   */
+  function combinePrefixPatterns(regexs) {
+    var capturedGroupIndex = 0;
+  
+    var needToFoldCase = false;
+    var ignoreCase = false;
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.ignoreCase) {
+        ignoreCase = true;
+      } else if (/[a-z]/i.test(regex.source.replace(
+                     /\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi, ''))) {
+        needToFoldCase = true;
+        ignoreCase = false;
+        break;
+      }
+    }
+  
+    var escapeCharToCodeUnit = {
+      'b': 8,
+      't': 9,
+      'n': 0xa,
+      'v': 0xb,
+      'f': 0xc,
+      'r': 0xd
+    };
+  
+    function decodeEscape(charsetPart) {
+      var cc0 = charsetPart.charCodeAt(0);
+      if (cc0 !== 92 /* \\ */) {
+        return cc0;
+      }
+      var c1 = charsetPart.charAt(1);
+      cc0 = escapeCharToCodeUnit[c1];
+      if (cc0) {
+        return cc0;
+      } else if ('0' <= c1 && c1 <= '7') {
+        return parseInt(charsetPart.substring(1), 8);
+      } else if (c1 === 'u' || c1 === 'x') {
+        return parseInt(charsetPart.substring(2), 16);
+      } else {
+        return charsetPart.charCodeAt(1);
+      }
+    }
+  
+    function encodeEscape(charCode) {
+      if (charCode < 0x20) {
+        return (charCode < 0x10 ? '\\x0' : '\\x') + charCode.toString(16);
+      }
+      var ch = String.fromCharCode(charCode);
+      return (ch === '\\' || ch === '-' || ch === ']' || ch === '^')
+          ? "\\" + ch : ch;
+    }
+  
+    function caseFoldCharset(charSet) {
+      var charsetParts = charSet.substring(1, charSet.length - 1).match(
+          new RegExp(
+              '\\\\u[0-9A-Fa-f]{4}'
+              + '|\\\\x[0-9A-Fa-f]{2}'
+              + '|\\\\[0-3][0-7]{0,2}'
+              + '|\\\\[0-7]{1,2}'
+              + '|\\\\[\\s\\S]'
+              + '|-'
+              + '|[^-\\\\]',
+              'g'));
+      var ranges = [];
+      var inverse = charsetParts[0] === '^';
+  
+      var out = ['['];
+      if (inverse) { out.push('^'); }
+  
+      for (var i = inverse ? 1 : 0, n = charsetParts.length; i < n; ++i) {
+        var p = charsetParts[i];
+        if (/\\[bdsw]/i.test(p)) {  // Don't muck with named groups.
+          out.push(p);
+        } else {
+          var start = decodeEscape(p);
+          var end;
+          if (i + 2 < n && '-' === charsetParts[i + 1]) {
+            end = decodeEscape(charsetParts[i + 2]);
+            i += 2;
+          } else {
+            end = start;
+          }
+          ranges.push([start, end]);
+          // If the range might intersect letters, then expand it.
+          // This case handling is too simplistic.
+          // It does not deal with non-latin case folding.
+          // It works for latin source code identifiers though.
+          if (!(end < 65 || start > 122)) {
+            if (!(end < 65 || start > 90)) {
+              ranges.push([Math.max(65, start) | 32, Math.min(end, 90) | 32]);
+            }
+            if (!(end < 97 || start > 122)) {
+              ranges.push([Math.max(97, start) & ~32, Math.min(end, 122) & ~32]);
+            }
+          }
+        }
+      }
+  
+      // [[1, 10], [3, 4], [8, 12], [14, 14], [16, 16], [17, 17]]
+      // -> [[1, 12], [14, 14], [16, 17]]
+      ranges.sort(function (a, b) { return (a[0] - b[0]) || (b[1]  - a[1]); });
+      var consolidatedRanges = [];
+      var lastRange = [];
+      for (var i = 0; i < ranges.length; ++i) {
+        var range = ranges[i];
+        if (range[0] <= lastRange[1] + 1) {
+          lastRange[1] = Math.max(lastRange[1], range[1]);
+        } else {
+          consolidatedRanges.push(lastRange = range);
+        }
+      }
+  
+      for (var i = 0; i < consolidatedRanges.length; ++i) {
+        var range = consolidatedRanges[i];
+        out.push(encodeEscape(range[0]));
+        if (range[1] > range[0]) {
+          if (range[1] + 1 > range[0]) { out.push('-'); }
+          out.push(encodeEscape(range[1]));
+        }
+      }
+      out.push(']');
+      return out.join('');
+    }
+  
+    function allowAnywhereFoldCaseAndRenumberGroups(regex) {
+      // Split into character sets, escape sequences, punctuation strings
+      // like ('(', '(?:', ')', '^'), and runs of characters that do not
+      // include any of the above.
+      var parts = regex.source.match(
+          new RegExp(
+              '(?:'
+              + '\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'  // a character set
+              + '|\\\\u[A-Fa-f0-9]{4}'  // a unicode escape
+              + '|\\\\x[A-Fa-f0-9]{2}'  // a hex escape
+              + '|\\\\[0-9]+'  // a back-reference or octal escape
+              + '|\\\\[^ux0-9]'  // other escape sequence
+              + '|\\(\\?[:!=]'  // start of a non-capturing group
+              + '|[\\(\\)\\^]'  // start/end of a group, or line start
+              + '|[^\\x5B\\x5C\\(\\)\\^]+'  // run of other characters
+              + ')',
+              'g'));
+      var n = parts.length;
+  
+      // Maps captured group numbers to the number they will occupy in
+      // the output or to -1 if that has not been determined, or to
+      // undefined if they need not be capturing in the output.
+      var capturedGroups = [];
+  
+      // Walk over and identify back references to build the capturedGroups
+      // mapping.
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          // groups are 1-indexed, so max group index is count of '('
+          ++groupIndex;
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue) {
+            if (decimalValue <= groupIndex) {
+              capturedGroups[decimalValue] = -1;
+            } else {
+              // Replace with an unambiguous escape sequence so that
+              // an octal escape sequence does not turn into a backreference
+              // to a capturing group from an earlier regex.
+              parts[i] = encodeEscape(decimalValue);
+            }
+          }
+        }
+      }
+  
+      // Renumber groups and reduce capturing groups to non-capturing groups
+      // where possible.
+      for (var i = 1; i < capturedGroups.length; ++i) {
+        if (-1 === capturedGroups[i]) {
+          capturedGroups[i] = ++capturedGroupIndex;
+        }
+      }
+      for (var i = 0, groupIndex = 0; i < n; ++i) {
+        var p = parts[i];
+        if (p === '(') {
+          ++groupIndex;
+          if (!capturedGroups[groupIndex]) {
+            parts[i] = '(?:';
+          }
+        } else if ('\\' === p.charAt(0)) {
+          var decimalValue = +p.substring(1);
+          if (decimalValue && decimalValue <= groupIndex) {
+            parts[i] = '\\' + capturedGroups[decimalValue];
+          }
+        }
+      }
+  
+      // Remove any prefix anchors so that the output will match anywhere.
+      // ^^ really does mean an anchored match though.
+      for (var i = 0; i < n; ++i) {
+        if ('^' === parts[i] && '^' !== parts[i + 1]) { parts[i] = ''; }
+      }
+  
+      // Expand letters to groups to handle mixing of case-sensitive and
+      // case-insensitive patterns if necessary.
+      if (regex.ignoreCase && needToFoldCase) {
+        for (var i = 0; i < n; ++i) {
+          var p = parts[i];
+          var ch0 = p.charAt(0);
+          if (p.length >= 2 && ch0 === '[') {
+            parts[i] = caseFoldCharset(p);
+          } else if (ch0 !== '\\') {
+            // TODO: handle letters in numeric escapes.
+            parts[i] = p.replace(
+                /[a-zA-Z]/g,
+                function (ch) {
+                  var cc = ch.charCodeAt(0);
+                  return '[' + String.fromCharCode(cc & ~32, cc | 32) + ']';
+                });
+          }
+        }
+      }
+  
+      return parts.join('');
+    }
+  
+    var rewritten = [];
+    for (var i = 0, n = regexs.length; i < n; ++i) {
+      var regex = regexs[i];
+      if (regex.global || regex.multiline) { throw new Error('' + regex); }
+      rewritten.push(
+          '(?:' + allowAnywhereFoldCaseAndRenumberGroups(regex) + ')');
+    }
+  
+    return new RegExp(rewritten.join('|'), ignoreCase ? 'gi' : 'g');
+  }
+
+
+  /**
+   * Split markup into a string of source code and an array mapping ranges in
+   * that string to the text nodes in which they appear.
+   *
+   * <p>
+   * The HTML DOM structure:</p>
+   * <pre>
+   * (Element   "p"
+   *   (Element "b"
+   *     (Text  "print "))       ; #1
+   *   (Text    "'Hello '")      ; #2
+   *   (Element "br")            ; #3
+   *   (Text    "  + 'World';")) ; #4
+   * </pre>
+   * <p>
+   * corresponds to the HTML
+   * {@code <p><b>print </b>'Hello '<br>  + 'World';</p>}.</p>
+   *
+   * <p>
+   * It will produce the output:</p>
+   * <pre>
+   * {
+   *   sourceCode: "print 'Hello '\n  + 'World';",
+   *   //                     1          2
+   *   //           012345678901234 5678901234567
+   *   spans: [0, #1, 6, #2, 14, #3, 15, #4]
+   * }
+   * </pre>
+   * <p>
+   * where #1 is a reference to the {@code "print "} text node above, and so
+   * on for the other text nodes.
+   * </p>
+   *
+   * <p>
+   * The {@code} spans array is an array of pairs.  Even elements are the start
+   * indices of substrings, and odd elements are the text nodes (or BR elements)
+   * that contain the text for those substrings.
+   * Substrings continue until the next index or the end of the source.
+   * </p>
+   *
+   * @param {Node} node an HTML DOM subtree containing source-code.
+   * @param {boolean} isPreformatted true if white-space in text nodes should
+   *    be considered significant.
+   * @return {Object} source code and the text nodes in which they occur.
+   */
+  function extractSourceSpans(node, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+  
+    var chunks = [];
+    var length = 0;
+    var spans = [];
+    var k = 0;
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { return; }
+          for (var child = node.firstChild; child; child = child.nextSibling) {
+            walk(child);
+          }
+          var nodeName = node.nodeName.toLowerCase();
+          if ('br' === nodeName || 'li' === nodeName) {
+            chunks[k] = '\n';
+            spans[k << 1] = length++;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+        case 3: case 4:  // Text
+          var text = node.nodeValue;
+          if (text.length) {
+            if (!isPreformatted) {
+              text = text.replace(/[ \t\r\n]+/g, ' ');
+            } else {
+              text = text.replace(/\r\n?/g, '\n');  // Normalize newlines.
+              text = text.replace(/^(\r?\n\s*)+/g, '');  // Remove leading newlines
+              text = text.replace(/^\s*/g, '');  // Remove leading spaces due to indented formatting
+              text = text.replace(/(\r?\n\s*)+$/g, '');  // Remove ending newlines
+              
+            }
+            // TODO: handle tabs here?
+            chunks[k] = text;
+            spans[k << 1] = length;
+            length += text.length;
+            spans[(k++ << 1) | 1] = node;
+          }
+          break;
+      }
+    }
+  
+    walk(node);
+  
+    return {
+      sourceCode: chunks.join('').replace(/\n$/, ''),
+      spans: spans
+    };
+  }
+
+
+  /**
+   * Apply the given language handler to sourceCode and add the resulting
+   * decorations to out.
+   * @param {number} basePos the index of sourceCode within the chunk of source
+   *    whose decorations are already present on out.
+   */
+  function appendDecorations(basePos, sourceCode, langHandler, out) {
+    if (!sourceCode) { return; }
+    var job = {
+      sourceCode: sourceCode,
+      basePos: basePos
+    };
+    langHandler(job);
+    out.push.apply(out, job.decorations);
+  }
+
+  var notWs = /\S/;
+
+  /**
+   * Given an element, if it contains only one child element and any text nodes
+   * it contains contain only space characters, return the sole child element.
+   * Otherwise returns undefined.
+   * <p>
+   * This is meant to return the CODE element in {@code <pre><code ...>} when
+   * there is a single child element that contains all the non-space textual
+   * content, but not to return anything where there are multiple child elements
+   * as in {@code <pre><code>...</code><code>...</code></pre>} or when there
+   * is textual content.
+   */
+  function childContentWrapper(element) {
+    var wrapper = undefined;
+    for (var c = element.firstChild; c; c = c.nextSibling) {
+      var type = c.nodeType;
+      wrapper = (type === 1)  // Element Node
+          ? (wrapper ? element : c)
+          : (type === 3)  // Text Node
+          ? (notWs.test(c.nodeValue) ? element : wrapper)
+          : wrapper;
+    }
+    return wrapper === element ? undefined : wrapper;
+  }
+
+  /** Given triples of [style, pattern, context] returns a lexing function,
+    * The lexing function interprets the patterns to find token boundaries and
+    * returns a decoration list of the form
+    * [index_0, style_0, index_1, style_1, ..., index_n, style_n]
+    * where index_n is an index into the sourceCode, and style_n is a style
+    * constant like PR_PLAIN.  index_n-1 <= index_n, and style_n-1 applies to
+    * all characters in sourceCode[index_n-1:index_n].
+    *
+    * The stylePatterns is a list whose elements have the form
+    * [style : string, pattern : RegExp, DEPRECATED, shortcut : string].
+    *
+    * Style is a style constant like PR_PLAIN, or can be a string of the
+    * form 'lang-FOO', where FOO is a language extension describing the
+    * language of the portion of the token in $1 after pattern executes.
+    * E.g., if style is 'lang-lisp', and group 1 contains the text
+    * '(hello (world))', then that portion of the token will be passed to the
+    * registered lisp handler for formatting.
+    * The text before and after group 1 will be restyled using this decorator
+    * so decorators should take care that this doesn't result in infinite
+    * recursion.  For example, the HTML lexer rule for SCRIPT elements looks
+    * something like ['lang-js', /<[s]cript>(.+?)<\/script>/].  This may match
+    * '<script>foo()<\/script>', which would cause the current decorator to
+    * be called with '<script>' which would not match the same rule since
+    * group 1 must not be empty, so it would be instead styled as PR_TAG by
+    * the generic tag rule.  The handler registered for the 'js' extension would
+    * then be called with 'foo()', and finally, the current decorator would
+    * be called with '<\/script>' which would not match the original rule and
+    * so the generic tag rule would identify it as a tag.
+    *
+    * Pattern must only match prefixes, and if it matches a prefix, then that
+    * match is considered a token with the same style.
+    *
+    * Context is applied to the last non-whitespace, non-comment token
+    * recognized.
+    *
+    * Shortcut is an optional string of characters, any of which, if the first
+    * character, gurantee that this pattern and only this pattern matches.
+    *
+    * @param {Array} shortcutStylePatterns patterns that always start with
+    *   a known character.  Must have a shortcut string.
+    * @param {Array} fallthroughStylePatterns patterns that will be tried in
+    *   order if the shortcut ones fail.  May have shortcuts.
+    *
+    * @return {function (Object)} a
+    *   function that takes source code and returns a list of decorations.
+    */
+  function createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns) {
+    var shortcuts = {};
+    var tokenizer;
+    (function () {
+      var allPatterns = shortcutStylePatterns.concat(fallthroughStylePatterns);
+      var allRegexs = [];
+      var regexKeys = {};
+      for (var i = 0, n = allPatterns.length; i < n; ++i) {
+        var patternParts = allPatterns[i];
+        var shortcutChars = patternParts[3];
+        if (shortcutChars) {
+          for (var c = shortcutChars.length; --c >= 0;) {
+            shortcuts[shortcutChars.charAt(c)] = patternParts;
+          }
+        }
+        var regex = patternParts[1];
+        var k = '' + regex;
+        if (!regexKeys.hasOwnProperty(k)) {
+          allRegexs.push(regex);
+          regexKeys[k] = null;
+        }
+      }
+      allRegexs.push(/[\0-\uffff]/);
+      tokenizer = combinePrefixPatterns(allRegexs);
+    })();
+
+    var nPatterns = fallthroughStylePatterns.length;
+
+    /**
+     * Lexes job.sourceCode and produces an output array job.decorations of
+     * style classes preceded by the position at which they start in
+     * job.sourceCode in order.
+     *
+     * @param {Object} job an object like <pre>{
+     *    sourceCode: {string} sourceText plain text,
+     *    basePos: {int} position of job.sourceCode in the larger chunk of
+     *        sourceCode.
+     * }</pre>
+     */
+    var decorate = function (job) {
+      var sourceCode = job.sourceCode, basePos = job.basePos;
+      /** Even entries are positions in source in ascending order.  Odd enties
+        * are style markers (e.g., PR_COMMENT) that run from that position until
+        * the end.
+        * @type {Array.<number|string>}
+        */
+      var decorations = [basePos, PR_PLAIN];
+      var pos = 0;  // index into sourceCode
+      var tokens = sourceCode.match(tokenizer) || [];
+      var styleCache = {};
+
+      for (var ti = 0, nTokens = tokens.length; ti < nTokens; ++ti) {
+        var token = tokens[ti];
+        var style = styleCache[token];
+        var match = void 0;
+
+        var isEmbedded;
+        if (typeof style === 'string') {
+          isEmbedded = false;
+        } else {
+          var patternParts = shortcuts[token.charAt(0)];
+          if (patternParts) {
+            match = token.match(patternParts[1]);
+            style = patternParts[0];
+          } else {
+            for (var i = 0; i < nPatterns; ++i) {
+              patternParts = fallthroughStylePatterns[i];
+              match = token.match(patternParts[1]);
+              if (match) {
+                style = patternParts[0];
+                break;
+              }
+            }
+
+            if (!match) {  // make sure that we make progress
+              style = PR_PLAIN;
+            }
+          }
+
+          isEmbedded = style.length >= 5 && 'lang-' === style.substring(0, 5);
+          if (isEmbedded && !(match && typeof match[1] === 'string')) {
+            isEmbedded = false;
+            style = PR_SOURCE;
+          }
+
+          if (!isEmbedded) { styleCache[token] = style; }
+        }
+
+        var tokenStart = pos;
+        pos += token.length;
+
+        if (!isEmbedded) {
+          decorations.push(basePos + tokenStart, style);
+        } else {  // Treat group 1 as an embedded block of source code.
+          var embeddedSource = match[1];
+          var embeddedSourceStart = token.indexOf(embeddedSource);
+          var embeddedSourceEnd = embeddedSourceStart + embeddedSource.length;
+          if (match[2]) {
+            // If embeddedSource can be blank, then it would match at the
+            // beginning which would cause us to infinitely recurse on the
+            // entire token, so we catch the right context in match[2].
+            embeddedSourceEnd = token.length - match[2].length;
+            embeddedSourceStart = embeddedSourceEnd - embeddedSource.length;
+          }
+          var lang = style.substring(5);
+          // Decorate the left of the embedded source
+          appendDecorations(
+              basePos + tokenStart,
+              token.substring(0, embeddedSourceStart),
+              decorate, decorations);
+          // Decorate the embedded source
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceStart,
+              embeddedSource,
+              langHandlerForExtension(lang, embeddedSource),
+              decorations);
+          // Decorate the right of the embedded section
+          appendDecorations(
+              basePos + tokenStart + embeddedSourceEnd,
+              token.substring(embeddedSourceEnd),
+              decorate, decorations);
+        }
+      }
+      job.decorations = decorations;
+    };
+    return decorate;
+  }
+
+  /** returns a function that produces a list of decorations from source text.
+    *
+    * This code treats ", ', and ` as string delimiters, and \ as a string
+    * escape.  It does not recognize perl's qq() style strings.
+    * It has no special handling for double delimiter escapes as in basic, or
+    * the tripled delimiters used in python, but should work on those regardless
+    * although in those cases a single string literal may be broken up into
+    * multiple adjacent string literals.
+    *
+    * It recognizes C, C++, and shell style comments.
+    *
+    * @param {Object} options a set of optional parameters.
+    * @return {function (Object)} a function that examines the source code
+    *     in the input job and builds the decoration list.
+    */
+  function sourceDecorator(options) {
+    var shortcutStylePatterns = [], fallthroughStylePatterns = [];
+    if (options['tripleQuotedStrings']) {
+      // '''multi-line-string''', 'single-line-string', and double-quoted
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,
+           null, '\'"']);
+    } else if (options['multiLineStrings']) {
+      // 'multi-line-string', "multi-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,  /^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,
+           null, '\'"`']);
+    } else {
+      // 'single-line-string', "single-line-string"
+      shortcutStylePatterns.push(
+          [PR_STRING,
+           /^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,
+           null, '"\'']);
+    }
+    if (options['verbatimStrings']) {
+      // verbatim-string-literal production from the C# grammar.  See issue 93.
+      fallthroughStylePatterns.push(
+          [PR_STRING, /^@\"(?:[^\"]|\"\")*(?:\"|$)/, null]);
+    }
+    var hc = options['hashComments'];
+    if (hc) {
+      if (options['cStyleComments']) {
+        if (hc > 1) {  // multiline hash comments
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/, null, '#']);
+        } else {
+          // Stop C preprocessor declarations at an unclosed open comment
+          shortcutStylePatterns.push(
+              [PR_COMMENT, /^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,
+               null, '#']);
+        }
+        // #include <stdio.h>
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+             /^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,
+             null]);
+      } else {
+        shortcutStylePatterns.push([PR_COMMENT, /^#[^\r\n]*/, null, '#']);
+      }
+    }
+    if (options['cStyleComments']) {
+      fallthroughStylePatterns.push([PR_COMMENT, /^\/\/[^\r\n]*/, null]);
+      fallthroughStylePatterns.push(
+          [PR_COMMENT, /^\/\*[\s\S]*?(?:\*\/|$)/, null]);
+    }
+    if (options['regexLiterals']) {
+      /**
+       * @const
+       */
+      var REGEX_LITERAL = (
+          // A regular expression literal starts with a slash that is
+          // not followed by * or / so that it is not confused with
+          // comments.
+          '/(?=[^/*])'
+          // and then contains any number of raw characters,
+          + '(?:[^/\\x5B\\x5C]'
+          // escape sequences (\x5C),
+          +    '|\\x5C[\\s\\S]'
+          // or non-nesting character sets (\x5B\x5D);
+          +    '|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
+          // finally closed by a /.
+          + '/');
+      fallthroughStylePatterns.push(
+          ['lang-regex',
+           new RegExp('^' + REGEXP_PRECEDER_PATTERN + '(' + REGEX_LITERAL + ')')
+           ]);
+    }
+
+    var types = options['types'];
+    if (types) {
+      fallthroughStylePatterns.push([PR_TYPE, types]);
+    }
+
+    if (options['strings']) {
+        var strings = ("" + options['strings']).replace(/^ | $/g, '').replace(/-/g, '\\-');
+        fallthroughStylePatterns.push(
+            [PR_STRING,
+            new RegExp('(?:' + strings.replace(/[\s,]+/g, '|') + ')'),
+            , null]
+        );
+    }
+    
+    var keywords = ("" + options['keywords']).replace(/^ | $/g, '');
+    if (keywords.length) {
+      fallthroughStylePatterns.push(
+          [PR_KEYWORD,
+           new RegExp('^(?:' + keywords.replace(/[\s,]+/g, '|') + ')\\b'),
+           null]);
+    }
+
+    shortcutStylePatterns.push([PR_PLAIN,       /^\s+/, null, ' \r\n\t\xA0']);
+    if (options['httpdComments']) {
+        fallthroughStylePatterns.push(
+            [PR_PLAIN,     /^.*\S.*#/i, null]
+        );
+    }
+    
+    fallthroughStylePatterns.push(
+        // TODO(mikesamuel): recognize non-latin letters and numerals in idents
+        [PR_LITERAL,     /^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i, null],
+        [PR_LITERAL,     CONFIG_OPTIONS, null],
+        //[PR_STRING,     CONFIG_ENVS, null],
+        [PR_TAG,     /^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/, null],
+        [PR_TYPE,        /^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/, null],
+        [PR_TAG,     /^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i, null],
+        [PR_PLAIN,       /^[a-z_$][a-z_$@0-9\-]*/i, null],
+        [PR_LITERAL,
+         new RegExp(
+             '^(?:'
+             // A hex number
+             + '0x[a-f0-9]+'
+             // An IPv6 Address
+             + '|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
+             // or an octal or decimal number,
+             + '|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
+             // possibly in scientific notation
+             + '(?:e[+\\-]?\\d+)?'
+             + ')'
+             // with an optional modifier like UL for unsigned long
+             + '[a-z]*', 'i'),
+         null, '0123456789'],
+        // Don't treat escaped quotes in bash as starting strings.  See issue 144.
+        [PR_PLAIN,       /^\\[\s\S]?/, null],
+        [PR_PUNCTUATION, /^.[^\s\w\.$@\'\"\`\/\#\\]*/, null]);
+
+    return createSimpleLexer(shortcutStylePatterns, fallthroughStylePatterns);
+  }
+
+  var decorateSource = sourceDecorator({
+        'keywords': ALL_KEYWORDS,
+        'hashComments': true,
+        'cStyleComments': true,
+        'multiLineStrings': true,
+        'regexLiterals': true
+      });
+
+  /**
+   * Given a DOM subtree, wraps it in a list, and puts each line into its own
+   * list item.
+   *
+   * @param {Node} node modified in place.  Its content is pulled into an
+   *     HTMLOListElement, and each line is moved into a separate list item.
+   *     This requires cloning elements, so the input might not have unique
+   *     IDs after numbering.
+   * @param {boolean} isPreformatted true iff white-space in text nodes should
+   *     be treated as significant.
+   */
+  function numberLines(node, opt_startLineNum, isPreformatted) {
+    var nocode = /(?:^|\s)nocode(?:\s|$)/;
+    var lineBreak = /\r\n?|\n/;
+  
+    var document = node.ownerDocument;
+  
+    var li = document.createElement('li');
+    while (node.firstChild) {
+      li.appendChild(node.firstChild);
+    }
+    // An array of lines.  We split below, so this is initialized to one
+    // un-split line.
+    var listItems = [li];
+  
+    function walk(node) {
+      switch (node.nodeType) {
+        case 1:  // Element
+          if (nocode.test(node.className)) { break; }
+          if ('br' === node.nodeName) {
+            breakAfter(node);
+            // Discard the <BR> since it is now flush against a </LI>.
+            if (node.parentNode) {
+              node.parentNode.removeChild(node);
+            }
+          } else {
+            for (var child = node.firstChild; child; child = child.nextSibling) {
+              walk(child);
+            }
+          }
+          break;
+        case 3: case 4:  // Text
+          if (isPreformatted) {
+            var text = node.nodeValue;
+            var match = text.match(lineBreak);
+            if (match) {
+              var firstLine = text.substring(0, match.index);
+              node.nodeValue = firstLine;
+              var tail = text.substring(match.index + match[0].length);
+              if (tail) {
+                var parent = node.parentNode;
+                parent.insertBefore(
+                    document.createTextNode(tail), node.nextSibling);
+              }
+              breakAfter(node);
+              if (!firstLine) {
+                // Don't leave blank text nodes in the DOM.
+                node.parentNode.removeChild(node);
+              }
+            }
+          }
+          break;
+      }
+    }
+  
+    // Split a line after the given node.
+    function breakAfter(lineEndNode) {
+      // If there's nothing to the right, then we can skip ending the line
+      // here, and move root-wards since splitting just before an end-tag
+      // would require us to create a bunch of empty copies.
+      while (!lineEndNode.nextSibling) {
+        lineEndNode = lineEndNode.parentNode;
+        if (!lineEndNode) { return; }
+      }
+  
+      function breakLeftOf(limit, copy) {
+        // Clone shallowly if this node needs to be on both sides of the break.
+        var rightSide = copy ? limit.cloneNode(false) : limit;
+        var parent = limit.parentNode;
+        if (parent) {
+          // We clone the parent chain.
+          // This helps us resurrect important styling elements that cross lines.
+          // E.g. in <i>Foo<br>Bar</i>
+          // should be rewritten to <li><i>Foo</i></li><li><i>Bar</i></li>.
+          var parentClone = breakLeftOf(parent, 1);
+          // Move the clone and everything to the right of the original
+          // onto the cloned parent.
+          var next = limit.nextSibling;
+          parentClone.appendChild(rightSide);
+          for (var sibling = next; sibling; sibling = next) {
+            next = sibling.nextSibling;
+            parentClone.appendChild(sibling);
+          }
+        }
+        return rightSide;
+      }
+  
+      var copiedListItem = breakLeftOf(lineEndNode.nextSibling, 0);
+  
+      // Walk the parent chain until we reach an unattached LI.
+      for (var parent;
+           // Check nodeType since IE invents document fragments.
+           (parent = copiedListItem.parentNode) && parent.nodeType === 1;) {
+        copiedListItem = parent;
+      }
+      // Put it on the list of lines for later processing.
+      listItems.push(copiedListItem);
+    }
+  
+    // Split lines while there are lines left to split.
+    for (var i = 0;  // Number of lines that have been split so far.
+         i < listItems.length;  // length updated by breakAfter calls.
+         ++i) {
+      walk(listItems[i]);
+    }
+  
+    // Make sure numeric indices show correctly.
+    if (opt_startLineNum === (opt_startLineNum|0)) {
+      listItems[0].setAttribute('value', opt_startLineNum);
+    }
+  
+    var ol = document.createElement('ol');
+    ol.className = 'linenums';
+    var offset = Math.max(0, ((opt_startLineNum - 1 /* zero index */)) | 0) || 0;
+    for (var i = 0, n = listItems.length; i < n; ++i) {
+      li = listItems[i];
+      // Stick a class on the LIs so that stylesheets can
+      // color odd/even rows, or any other row pattern that
+      // is co-prime with 10.
+      li.className = 'L' + ((i + offset) % 1);
+      if (!li.firstChild) {
+        li.appendChild(document.createTextNode('\xA0'));
+      }
+      ol.appendChild(li);
+    }
+  
+    node.appendChild(ol);
+  }
+
+  /**
+   * Breaks {@code job.sourceCode} around style boundaries in
+   * {@code job.decorations} and modifies {@code job.sourceNode} in place.
+   * @param {Object} job like <pre>{
+   *    sourceCode: {string} source as plain text,
+   *    spans: {Array.<number|Node>} alternating span start indices into source
+   *       and the text node or element (e.g. {@code <BR>}) corresponding to that
+   *       span.
+   *    decorations: {Array.<number|string} an array of style classes preceded
+   *       by the position at which they start in job.sourceCode in order
+   * }</pre>
+   * @private
+   */
+  function recombineTagsAndDecorations(job) {
+    var isIE8OrEarlier = /\bMSIE\s(\d+)/.exec(navigator.userAgent);
+    isIE8OrEarlier = isIE8OrEarlier && +isIE8OrEarlier[1] <= 8;
+    var newlineRe = /\n/g;
+  
+    var source = job.sourceCode;
+    var sourceLength = source.length;
+    // Index into source after the last code-unit recombined.
+    var sourceIndex = 0;
+  
+    var spans = job.spans;
+    var nSpans = spans.length;
+    // Index into spans after the last span which ends at or before sourceIndex.
+    var spanIndex = 0;
+  
+    var decorations = job.decorations;
+    var nDecorations = decorations.length;
+    // Index into decorations after the last decoration which ends at or before
+    // sourceIndex.
+    var decorationIndex = 0;
+  
+    // Remove all zero-length decorations.
+    decorations[nDecorations] = sourceLength;
+    var decPos, i;
+    for (i = decPos = 0; i < nDecorations;) {
+      if (decorations[i] !== decorations[i + 2]) {
+        decorations[decPos++] = decorations[i++];
+        decorations[decPos++] = decorations[i++];
+      } else {
+        i += 2;
+      }
+    }
+    nDecorations = decPos;
+  
+    // Simplify decorations.
+    for (i = decPos = 0; i < nDecorations;) {
+      var startPos = decorations[i];
+      // Conflate all adjacent decorations that use the same style.
+      var startDec = decorations[i + 1];
+      var end = i + 2;
+      while (end + 2 <= nDecorations && decorations[end + 1] === startDec) {
+        end += 2;
+      }
+      decorations[decPos++] = startPos;
+      decorations[decPos++] = startDec;
+      i = end;
+    }
+  
+    nDecorations = decorations.length = decPos;
+  
+    var sourceNode = job.sourceNode;
+    var oldDisplay;
+    if (sourceNode) {
+      oldDisplay = sourceNode.style.display;
+      sourceNode.style.display = 'none';
+    }
+    try {
+      var decoration = null;
+      var X = 0;
+      while (spanIndex < nSpans) {
+        X = X + 1;
+        if (X > 5000) { break; }
+        var spanStart = spans[spanIndex];
+        var spanEnd = spans[spanIndex + 2] || sourceLength;
+  
+        var decEnd = decorations[decorationIndex + 2] || sourceLength;
+  
+        var end = Math.min(spanEnd, decEnd);
+  
+        var textNode = spans[spanIndex + 1];
+        var styledText;
+        if (textNode.nodeType !== 1  // Don't muck with <BR>s or <LI>s
+            // Don't introduce spans around empty text nodes.
+            && (styledText = source.substring(sourceIndex, end))) {
+          // This may seem bizarre, and it is.  Emitting LF on IE causes the
+          // code to display with spaces instead of line breaks.
+          // Emitting Windows standard issue linebreaks (CRLF) causes a blank
+          // space to appear at the beginning of every line but the first.
+          // Emitting an old Mac OS 9 line separator makes everything spiffy.
+          if (isIE8OrEarlier) {
+            styledText = styledText.replace(newlineRe, '\r');
+          }
+          textNode.nodeValue = styledText;
+          var document = textNode.ownerDocument;
+          var span = document.createElement('span');
+          span.className = decorations[decorationIndex + 1];
+          var parentNode = textNode.parentNode;
+          parentNode.replaceChild(span, textNode);
+          span.appendChild(textNode);
+          if (sourceIndex < spanEnd) {  // Split off a text node.
+            spans[spanIndex + 1] = textNode
+                // TODO: Possibly optimize by using '' if there's no flicker.
+                = document.createTextNode(source.substring(end, spanEnd));
+            parentNode.insertBefore(textNode, span.nextSibling);
+          }
+        }
+  
+        sourceIndex = end;
+  
+        if (sourceIndex >= spanEnd) {
+          spanIndex += 2;
+        }
+        if (sourceIndex >= decEnd) {
+          decorationIndex += 2;
+        }
+      }
+    } finally {
+      if (sourceNode) {
+        sourceNode.style.display = oldDisplay;
+      }
+    }
+  }
+
+
+  /** Maps language-specific file extensions to handlers. */
+  var langHandlerRegistry = {};
+  /** Register a language handler for the given file extensions.
+    * @param {function (Object)} handler a function from source code to a list
+    *      of decorations.  Takes a single argument job which describes the
+    *      state of the computation.   The single parameter has the form
+    *      {@code {
+    *        sourceCode: {string} as plain text.
+    *        decorations: {Array.<number|string>} an array of style classes
+    *                     preceded by the position at which they start in
+    *                     job.sourceCode in order.
+    *                     The language handler should assigned this field.
+    *        basePos: {int} the position of source in the larger source chunk.
+    *                 All positions in the output decorations array are relative
+    *                 to the larger source chunk.
+    *      } }
+    * @param {Array.<string>} fileExtensions
+    */
+  function registerLangHandler(handler, fileExtensions) {
+    for (var i = fileExtensions.length; --i >= 0;) {
+      var ext = fileExtensions[i];
+      if (!langHandlerRegistry.hasOwnProperty(ext)) {
+        langHandlerRegistry[ext] = handler;
+      } else if (win['console']) {
+        console['warn']('cannot override language handler %s', ext);
+      }
+    }
+  }
+  function langHandlerForExtension(extension, source) {
+    if (!(extension && langHandlerRegistry.hasOwnProperty(extension))) {
+      // Treat it as markup if the first non whitespace character is a < and
+      // the last non-whitespace character is a >.
+      extension = /^\s*</.test(source)
+          ? 'default-markup'
+          : 'default-code';
+    }
+    return langHandlerRegistry[extension];
+  }
+  registerLangHandler(decorateSource, ['default-code']);
+  registerLangHandler(
+      createSimpleLexer(
+          [],
+          [
+           [PR_PLAIN,       /^[^<?]+/],
+           [PR_DECLARATION, /^<!\w[^>]*(?:>|$)/],
+           [PR_COMMENT,     /^<\!--[\s\S]*?(?:-\->|$)/],
+           // Unescaped content in an unknown language
+           ['lang-',        /^<\?([\s\S]+?)(?:\?>|$)/],
+           ['lang-',        /^<%([\s\S]+?)(?:%>|$)/],
+           [PR_PUNCTUATION, /^(?:<[%?]|[%?]>)/],
+           ['lang-',        /^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],
+           // Unescaped content in javascript.  (Or possibly vbscript).
+           ['lang-js',      /^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],
+           // Contains unescaped stylesheet content
+           ['lang-css',     /^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],
+           ['lang-in.tag',  /^(<\/?[a-z][^<>]*>)/i]
+          ]),
+      ['default-markup', 'htm', 'html', 'mxml', 'xhtml', 'xml', 'xsl']);
+  registerLangHandler(
+      createSimpleLexer(
+          [
+           [PR_PLAIN,        /^[\s]+/, null, ' \t\r\n'],
+           [PR_ATTRIB_VALUE, /^(?:\"[^\"]*\"?|\'[^\']*\'?)/, null, '\"\'']
+           ],
+          [
+           [PR_TAG,          /^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],
+           [PR_ATTRIB_NAME,  /^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],
+           ['lang-uq.val',   /^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],
+           [PR_PUNCTUATION,  /^[=<>\/]+/],
+           ['lang-js',       /^on\w+\s*=\s*\"([^\"]+)\"/i],
+           ['lang-js',       /^on\w+\s*=\s*\'([^\']+)\'/i],
+           ['lang-js',       /^on\w+\s*=\s*([^\"\'>\s]+)/i],
+           ['lang-css',      /^style\s*=\s*\"([^\"]+)\"/i],
+           ['lang-css',      /^style\s*=\s*\'([^\']+)\'/i],
+           ['lang-css',      /^style\s*=\s*([^\"\'>\s]+)/i]
+           ]),
+      ['in.tag']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_ATTRIB_VALUE, /^[\s\S]+/]]), ['uq.val']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CPP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'types': C_TYPES
+        }), ['c', 'cc', 'cpp', 'cxx', 'cyc', 'm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PHP_KEYWORDS,
+          'hashComments': false,
+          'cStyleComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+//          'types': C_TYPES,
+        }), ['php', 'phtml', 'inc']);
+  registerLangHandler(sourceDecorator({
+          'keywords': 'null,true,false'
+        }), ['json']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CSHARP_KEYWORDS,
+          'hashComments': true,
+          'cStyleComments': true,
+          'verbatimStrings': true,
+          'types': C_TYPES
+        }), ['cs']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JAVA_KEYWORDS,
+          'cStyleComments': true
+        }), ['java']);
+  registerLangHandler(sourceDecorator({
+          'keywords': SH_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true
+        }), ['bsh', 'csh', 'sh']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PYTHON_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'tripleQuotedStrings': true
+        }), ['cv', 'py']);
+  registerLangHandler(sourceDecorator({
+          'keywords': PERL_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['perl', 'pl', 'pm']);
+  registerLangHandler(sourceDecorator({
+          'keywords': RUBY_KEYWORDS,
+          'hashComments': true,
+          'multiLineStrings': true,
+          'regexLiterals': true
+        }), ['rb']);
+  registerLangHandler(sourceDecorator({
+          'keywords': JSCRIPT_KEYWORDS,
+          'cStyleComments': true,
+          'regexLiterals': true
+        }), ['js']);
+  registerLangHandler(sourceDecorator({
+          'keywords': COFFEE_KEYWORDS,
+          'hashComments': 3,  // ### style block comments
+          'cStyleComments': true,
+          'multilineStrings': true,
+          'tripleQuotedStrings': true,
+          'regexLiterals': true
+        }), ['coffee']);
+  registerLangHandler(
+      createSimpleLexer([], [[PR_STRING, /^[\s\S]+/]]), ['regex']);
+  registerLangHandler(sourceDecorator({
+          'keywords': CONFIG_KEYWORDS,
+          'literals': CONFIG_OPTIONS,
+          'strings': CONFIG_ENVS,
+          'hashComments': true,
+          'cStyleComments': false,
+          'multiLineStrings': false,
+          'regexLiterals': false,
+          'httpdComments': true
+        }), ['config']);
+
+  function applyDecorator(job) {
+    var opt_langExtension = job.langExtension;
+
+    try {
+      // Extract tags, and convert the source code to plain text.
+      var sourceAndSpans = extractSourceSpans(job.sourceNode, job.pre);
+      /** Plain text. @type {string} */
+      var source = sourceAndSpans.sourceCode;
+      job.sourceCode = source;
+      job.spans = sourceAndSpans.spans;
+      job.basePos = 0;
+
+      // Apply the appropriate language handler
+      langHandlerForExtension(opt_langExtension, source)(job);
+
+      // Integrate the decorations and tags back into the source code,
+      // modifying the sourceNode in place.
+      recombineTagsAndDecorations(job);
+    } catch (e) {
+      if (win['console']) {
+        console['log'](e && e['stack'] ? e['stack'] : e);
+      }
+    }
+  }
+
+  /**
+   * @param sourceCodeHtml {string} The HTML to pretty print.
+   * @param opt_langExtension {string} The language name to use.
+   *     Typically, a filename extension like 'cpp' or 'java'.
+   * @param opt_numberLines {number|boolean} True to number lines,
+   *     or the 1-indexed number of the first line in sourceCodeHtml.
+   */
+  function prettyPrintOne(sourceCodeHtml, opt_langExtension, opt_numberLines) {
+    var container = document.createElement('pre');
+    // This could cause images to load and onload listeners to fire.
+    // E.g. <img onerror="alert(1337)" src="nosuchimage.png">.
+    // We assume that the inner HTML is from a trusted source.
+    container.innerHTML = sourceCodeHtml;
+    if (opt_numberLines) {
+      numberLines(container, opt_numberLines, true);
+    }
+
+    var job = {
+      langExtension: opt_langExtension,
+      numberLines: opt_numberLines,
+      sourceNode: container,
+      pre: 1
+    };
+    applyDecorator(job);
+    return container.innerHTML;
+  }
+
+  function prettyPrint(opt_whenDone) {
+    function byTagName(tn) { return document.getElementsByTagName(tn); }
+    // fetch a list of nodes to rewrite
+    var codeSegments = [byTagName('pre'), byTagName('code'), byTagName('xmp')];
+    var elements = [];
+    for (var i = 0; i < codeSegments.length; ++i) {
+      for (var j = 0, n = codeSegments[i].length; j < n; ++j) {
+        elements.push(codeSegments[i][j]);
+      }
+    }
+    codeSegments = null;
+
+    var clock = Date;
+    if (!clock['now']) {
+      clock = { 'now': function () { return +(new Date); } };
+    }
+
+    // The loop is broken into a series of continuations to make sure that we
+    // don't make the browser unresponsive when rewriting a large page.
+    var k = 0;
+    var prettyPrintingJob;
+
+    var langExtensionRe = /\blang(?:uage)?-([\w.]+)(?!\S)/;
+    var prettyPrintRe = /\bprettyprint\b/;
+    var prettyPrintedRe = /\bprettyprinted\b/;
+    var preformattedTagNameRe = /pre|xmp/i;
+    var codeRe = /^code$/i;
+    var preCodeXmpRe = /^(?:pre|code|xmp)$/i;
+
+    function doWork() {
+      var endTime = (win['PR_SHOULD_USE_CONTINUATION'] ?
+                     clock['now']() + 250 /* ms */ :
+                     Infinity);
+      for (; k < elements.length && clock['now']() < endTime; k++) {
+        var cs = elements[k];
+        var className = cs.className;
+        if (prettyPrintRe.test(className)
+            // Don't redo this if we've already done it.
+            // This allows recalling pretty print to just prettyprint elements
+            // that have been added to the page since last call.
+            && !prettyPrintedRe.test(className)) {
+
+          // make sure this is not nested in an already prettified element
+          var nested = false;
+          for (var p = cs.parentNode; p; p = p.parentNode) {
+            var tn = p.tagName;
+            if (preCodeXmpRe.test(tn)
+                && p.className && prettyPrintRe.test(p.className)) {
+              nested = true;
+              break;
+            }
+          }
+          if (!nested) {
+            // Mark done.  If we fail to prettyprint for whatever reason,
+            // we shouldn't try again.
+            cs.className += ' prettyprinted';
+
+            // If the classes includes a language extensions, use it.
+            // Language extensions can be specified like
+            //     <pre class="prettyprint lang-cpp">
+            // the language extension "cpp" is used to find a language handler
+            // as passed to PR.registerLangHandler.
+            // HTML5 recommends that a language be specified using "language-"
+            // as the prefix instead.  Google Code Prettify supports both.
+            // http://dev.w3.org/html5/spec-author-view/the-code-element.html
+            var langExtension = className.match(langExtensionRe);
+            // Support <pre class="prettyprint"><code class="language-c">
+            var wrapper;
+            if (!langExtension && (wrapper = childContentWrapper(cs))
+                && codeRe.test(wrapper.tagName)) {
+              langExtension = wrapper.className.match(langExtensionRe);
+            }
+
+            if (langExtension) { langExtension = langExtension[1]; }
+
+            var preformatted;
+            if (preformattedTagNameRe.test(cs.tagName)) {
+              preformatted = 1;
+            } else {
+              var currentStyle = cs['currentStyle'];
+              var whitespace = (
+                  currentStyle
+                  ? currentStyle['whiteSpace']
+                  : (document.defaultView
+                     && document.defaultView.getComputedStyle)
+                  ? document.defaultView.getComputedStyle(cs, null)
+                  .getPropertyValue('white-space')
+                  : 0);
+              preformatted = whitespace
+                  && 'pre' === whitespace.substring(0, 3);
+            }
+
+            // Look for a class like linenums or linenums:<n> where <n> is the
+            // 1-indexed number of the first line.
+            var lineNums = cs.className.match(/\blinenums\b(?::(\d+))?/);
+            lineNums = lineNums
+                ? lineNums[1] && lineNums[1].length ? +lineNums[1] : true
+                : false;
+            if (lineNums) { numberLines(cs, lineNums, preformatted); }
+
+            // do the pretty printing
+            prettyPrintingJob = {
+              langExtension: langExtension,
+              sourceNode: cs,
+              numberLines: lineNums,
+              pre: preformatted
+            };
+            applyDecorator(prettyPrintingJob);
+          }
+        }
+      }
+      if (k < elements.length) {
+        // finish up in a continuation
+        setTimeout(doWork, 250);
+      } else if (opt_whenDone) {
+        opt_whenDone();
+      }
+    }
+
+    doWork();
+  }
+
+  /**
+   * Contains functions for creating and registering new language handlers.
+   * @type {Object}
+   */
+  var PR = win['PR'] = {
+        'createSimpleLexer': createSimpleLexer,
+        'registerLangHandler': registerLangHandler,
+        'sourceDecorator': sourceDecorator,
+        'PR_ATTRIB_NAME': PR_ATTRIB_NAME,
+        'PR_ATTRIB_VALUE': PR_ATTRIB_VALUE,
+        'PR_COMMENT': PR_COMMENT,
+        'PR_DECLARATION': PR_DECLARATION,
+        'PR_KEYWORD': PR_KEYWORD,
+        'PR_LITERAL': PR_LITERAL,
+        'PR_NOCODE': PR_NOCODE,
+        'PR_PLAIN': PR_PLAIN,
+        'PR_PUNCTUATION': PR_PUNCTUATION,
+        'PR_SOURCE': PR_SOURCE,
+        'PR_STRING': PR_STRING,
+        'PR_TAG': PR_TAG,
+        'PR_TYPE': PR_TYPE,
+        'prettyPrintOne': win['prettyPrintOne'] = prettyPrintOne,
+        'prettyPrint': win['prettyPrint'] = prettyPrint
+      };
+   
+
+/* Register Lua syntaxes */   
+   PR['registerLangHandler'](
+    PR['createSimpleLexer'](
+        [
+         // Whitespace
+         [PR['PR_PLAIN'],       /^[\t\n\r \xA0]+/, null, '\t\n\r \xA0'],
+         // A double or single quoted, possibly multi-line, string.
+         [PR['PR_STRING'],      /^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/, null, '"\'']
+        ],
+        [
+         // A comment is either a line comment that starts with two dashes, or
+         // two dashes preceding a long bracketed block.
+         [PR['PR_COMMENT'], /^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],
+         [PR['PR_TYPE'], /^nil|false|true/],
+         // A long bracketed block not preceded by -- is a string.
+         [PR['PR_STRING'],  /^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],
+         [PR['PR_KEYWORD'], /^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/, null],
+         // A number is a hex integer literal, a decimal real literal, or in
+         // scientific notation.
+         [PR['PR_LITERAL'],
+          /^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],
+         // An identifier
+         [PR['PR_PLAIN'], /^[a-z_]\w*/i],
+         // A run of punctuation
+         [PR['PR_PUNCTUATION'], /^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]
+        ]),
+    ['lua']);
+
+
+  // Make PR available via the Asynchronous Module Definition (AMD) API.
+  // Per https://github.com/amdjs/amdjs-api/wiki/AMD:
+  // The Asynchronous Module Definition (AMD) API specifies a
+  // mechanism for defining modules such that the module and its
+  // dependencies can be asynchronously loaded.
+  // ...
+  // To allow a clear indicator that a global define function (as
+  // needed for script src browser loading) conforms to the AMD API,
+  // any global define function SHOULD have a property called "amd"
+  // whose value is an object. This helps avoid conflict with any
+  // other existing JavaScript code that could have defined a define()
+  // function that does not conform to the AMD API.
+  if (typeof define === "function" && define['amd']) {
+    define("google-code-prettify", [], function () {
+      return PR; 
+    });
+  }
+})();
diff --git a/docs/manual/style/scripts/prettify.min.js b/docs/manual/style/scripts/prettify.min.js
 new file mode 100644
index 0000000..bd72256
--- /dev/null
+++ b/docs/manual/style/scripts/prettify.min.js
@@ -0,0 +1,124 @@
+// see prettify.js for copyright, license and expanded version
+window['PR_SHOULD_USE_CONTINUATION']=true;var prettyPrintOne;var prettyPrint;(function(){var win=window;var FLOW_CONTROL_KEYWORDS=["break,continue,do,else,for,if,return,while"];var C_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"auto,case,char,const,default,"+"double,enum,extern,float,goto,int,long,register,short,signed,sizeof,module,"+"static,struct,switch,typedef,union,unsigned,void,volatile"];var COMMON_KEYWORDS=[C_KEYWORDS,"catch,class,delete,false,import,"+"new,operator,private,protected,public,this,throw,true,try,typeof"];var CPP_KEYWORDS=[COMMON_KEYWORDS,"alignof,align_union,asm,axiom,bool,"+"concept,concept_map,const_cast,constexpr,decltype,"+"dynamic_cast,explicit,export,friend,inline,late_check,"+"mutable,namespace,nullptr,reinterpret_cast,static_assert,static_cast,"+"template,typeid,typename,using,virtual,where,request_req"];var JAVA_KEYWORDS=[COMMON_KEYWORDS,"abstract,boolean,byte,extends,final,finally,implements,import,"+"instanceof,null,native,package,strictfp,super,synchronized,throws,"+"transient"];var CSHARP_KEYWORDS=[JAVA_KEYWORDS,"as,base,by,checked,decimal,delegate,descending,dynamic,event,"+"fixed,foreach,from,group,implicit,in,interface,internal,into,is,let,"+"lock,object,out,override,orderby,params,partial,readonly,ref,sbyte,"+"sealed,stackalloc,string,select,uint,ulong,unchecked,unsafe,ushort,"+"var,virtual,where"];var COFFEE_KEYWORDS="all,and,by,catch,class,else,extends,false,finally,"+"for,if,in,is,isnt,loop,new,no,not,null,of,off,on,or,return,super,then,"+"throw,true,try,unless,until,when,while,yes";var JSCRIPT_KEYWORDS=[COMMON_KEYWORDS,"debugger,eval,export,function,get,null,set,undefined,var,with,"+"Infinity,NaN"];var PERL_KEYWORDS="caller,delete,die,do,dump,else,elsif,eval,exit,foreach,for,"+"goto,if,import,last,local,my,next,no,our,print,printf,package,redo,require,"+"sub,undef,unless,until,use,wantarray,while,BEGIN,END";var PHP_KEYWORDS="abstract,and,array,as,break,case,catch,cfunction,class,"+"clone,const,continue,declare,default,do,else,elseif,enddeclare,endfor,"+"endforeach,endif,endswitch,endwhile,extends,final,for,foreach,function,"+"global,goto,if,implements,interface,instanceof,namespace,new,old_function,"+"or,private,protected,public,static,switch,throw,try,use,var,while,xor,"+"die,echo,empty,exit,eval,include,include_once,isset,list,require,"+"require_once,return,print,unset";var PYTHON_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"and,as,assert,class,def,del,"+"elif,except,exec,finally,from,global,import,in,is,lambda,"+"nonlocal,not,or,pass,print,raise,try,with,yield,"+"False,True,None"];var RUBY_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"alias,and,begin,case,class,"+"def,defined,elsif,end,ensure,false,in,module,next,nil,not,or,redo,"+"rescue,retry,self,super,then,true,undef,unless,until,when,yield,"+"BEGIN,END"];var SH_KEYWORDS=[FLOW_CONTROL_KEYWORDS,"case,done,elif,esac,eval,fi,"+"function,in,local,set,then,until,echo"];var CONFIG_ENVS=["User-Agent,HTTP_USER_AGENT,HTTP_REFERER,HTTP_COOKIE,HTTP_FORWARDED,HTTP_HOST,HTTP_PROXY_CONNECTION,HTTP_ACCEPT,REMOTE_ADDR,REMOTE_HOST,REMOTE_PORT,REMOTE_USER,REMOTE_IDENT,REQUEST_METHOD,SCRIPT_FILENAME,PATH_INFO,QUERY_STRING,AUTH_TYPE,DOCUMENT_ROOT,SERVER_ADMIN,SERVER_NAME,SERVER_ADDR,SERVER_PORT,SERVER_PROTOCOL,SERVER_SOFTWARE,TIME_YEAR,TIME_MON,TIME_DAY,TIME_HOUR,TIME_MIN,TIME_SEC,TIME_WDAY,TIME,API_VERSION,THE_REQUEST,REQUEST_URI,REQUEST_FILENAME,IS_SUBREQ,HTTPS,REQUEST_SCHEME"];var CONFIG_KEYWORDS=["<AuthnProviderAlias>,<AuthzProviderAlias>,<Directory>,<DirectoryMatch>,<Else>,<ElseIf>,<Files>,<FilesMatch>,<If>,<IfDefine>,<IfModule>,<IfVersion>,<Limit>,<LimitExcept>,<Location>,<LocationMatch>,<MDomainSet>,<Macro>,<Proxy>,<ProxyMatch>,<RequireAll>,<RequireAny>,<RequireNone>,<VirtualHost>,AcceptFilter,AcceptPathInfo,AccessFileName,Action,AddAlt,AddAltByEncoding,AddAltByType,AddCharset,AddDefaultCharset,AddDescription,AddEncoding,AddHandler,AddIcon,AddIconByEncoding,AddIconByType,AddInputFilter,AddLanguage,AddModuleInfo,AddOutputFilter,AddOutputFilterByType,AddType,Alias,AliasMatch,Allow,AllowCONNECT,AllowEncodedSlashes,AllowMethods,AllowOverride,AllowOverrideList,Anonymous,Anonymous_LogEmail,Anonymous_MustGiveEmail,Anonymous_NoUserID,Anonymous_VerifyEmail,AsyncRequestWorkerFactor,AuthBasicAuthoritative,AuthBasicFake,AuthBasicProvider,AuthBasicUseDigestAlgorithm,AuthDBDUserPWQuery,AuthDBDUserRealmQuery,AuthDBMGroupFile,AuthDBMType,AuthDBMUserFile,AuthDigestAlgorithm,AuthDigestDomain,AuthDigestNonceLifetime,AuthDigestProvider,AuthDigestQop,AuthDigestShmemSize,AuthFormAuthoritative,AuthFormBody,AuthFormDisableNoStore,AuthFormFakeBasicAuth,AuthFormLocation,AuthFormLoginRequiredLocation,AuthFormLoginSuccessLocation,AuthFormLogoutLocation,AuthFormMethod,AuthFormMimetype,AuthFormPassword,AuthFormProvider,AuthFormSitePassphrase,AuthFormSize,AuthFormUsername,AuthGroupFile,AuthLDAPAuthorizePrefix,AuthLDAPBindAuthoritative,AuthLDAPBindDN,AuthLDAPBindPassword,AuthLDAPCharsetConfig,AuthLDAPCompareAsUser,AuthLDAPCompareDNOnServer,AuthLDAPDereferenceAliases,AuthLDAPGroupAttribute,AuthLDAPGroupAttributeIsDN,AuthLDAPInitialBindAsUser,AuthLDAPInitialBindPattern,AuthLDAPMaxSubGroupDepth,AuthLDAPRemoteUserAttribute,AuthLDAPRemoteUserIsDN,AuthLDAPSearchAsUser,AuthLDAPSubGroupAttribute,AuthLDAPSubGroupClass,AuthLDAPUrl,AuthMerging,AuthName,AuthType,AuthUserFile,AuthnCacheContext,AuthnCacheEnable,AuthnCacheProvideFor,AuthnCacheSOCache,AuthnCacheTimeout,AuthnzFcgiCheckAuthnProvider,AuthnzFcgiDefineProvider,AuthzDBDLoginToReferer,AuthzDBDQuery,AuthzDBDRedirectQuery,AuthzDBMType,AuthzSendForbiddenOnFailure,BalancerGrowth,BalancerInherit,BalancerMember,BalancerPersist,BrotliAlterETag,BrotliCompressionMaxInputBlock,BrotliCompressionQuality,BrotliCompressionWindow,BrotliFilterNote,BrowserMatch,BrowserMatchNoCase,BufferSize,BufferedLogs,CGIDScriptTimeout,CGIMapExtension,CGIPassAuth,CGIVar,CacheDefaultExpire,CacheDetailHeader,CacheDirLength,CacheDirLevels,CacheDisable,CacheEnable,CacheFile,CacheHeader,CacheIgnoreCacheControl,CacheIgnoreHeaders,CacheIgnoreNoLastMod,CacheIgnoreQueryString,CacheIgnoreURLSessionIdentifiers,CacheKeyBaseURL,CacheLastModifiedFactor,CacheLock,CacheLockMaxAge,CacheLockPath,CacheMaxExpire,CacheMaxFileSize,CacheMinExpire,CacheMinFileSize,CacheNegotiatedDocs,CacheQuickHandler,CacheReadSize,CacheReadTime,CacheRoot,CacheSocache,CacheSocacheMaxSize,CacheSocacheMaxTime,CacheSocacheMinTime,CacheSocacheReadSize,CacheSocacheReadTime,CacheStaleOnError,CacheStoreExpired,CacheStoreNoStore,CacheStorePrivate,CharsetDefault,CharsetOptions,CharsetSourceEnc,CheckCaseOnly,CheckSpelling,ChrootDir,ContentDigest,CookieDomain,CookieExpires,CookieName,CookieStyle,CookieTracking,CoreDumpDirectory,CustomLog,DBDExptime,DBDInitSQL,DBDKeep,DBDMax,DBDMin,DBDParams,DBDPersist,DBDPrepareSQL,DBDriver,DTracePrivileges,Dav,DavDepthInfinity,DavGenericLockDB,DavLockDB,DavMinTimeout,DefaultIcon,DefaultLanguage,DefaultRuntimeDir,DefaultType,Define,DeflateBufferSize,DeflateCompressionLevel,DeflateFilterNote,DeflateInflateLimitRequestBody,DeflateInflateRatioBurst,DeflateInflateRatioLimit,DeflateMemLevel,DeflateWindowSize,Deny,DirectoryCheckHandler,DirectoryIndex,DirectoryIndexRedirect,DirectorySlash,DocumentRoot,DumpIOInput,DumpIOOutput,EnableExceptionHook,EnableMMAP,EnableSendfile,Error,ErrorDocument,ErrorLog,ErrorLogFormat,Example,ExpiresActive,ExpiresByType,ExpiresDefault,ExtFilterDefine,ExtFilterOptions,ExtendedStatus,FallbackResource,FileETag,FilterChain,FilterDeclare,FilterProtocol,FilterProvider,FilterTrace,ForceLanguagePriority,ForceType,ForensicLog,GlobalLog,GprofDir,GracefulShutdownTimeout,Group,H2CopyFiles,H2Direct,H2EarlyHints,H2MaxSessionStreams,H2MaxWorkerIdleSeconds,H2MaxWorkers,H2MinWorkers,H2ModernTLSOnly,H2Push,H2PushDiarySize,H2PushPriority,H2PushResource,H2SerializeHeaders,H2StreamMaxMemSize,H2TLSCoolDownSecs,H2TLSWarmUpSize,H2Upgrade,H2WindowSize,Header,HeaderName,HeartbeatAddress,HeartbeatListen,HeartbeatMaxServers,HeartbeatStorage,HeartbeatStorage,HostnameLookups,HttpProtocolOptions,ISAPIAppendLogToErrors,ISAPIAppendLogToQuery,ISAPICacheFile,ISAPIFakeAsync,ISAPILogNotSupported,ISAPIReadAheadBuffer,IdentityCheck,IdentityCheckTimeout,ImapBase,ImapDefault,ImapMenu,Include,IncludeOptional,IndexHeadInsert,IndexIgnore,IndexIgnoreReset,IndexOptions,IndexOrderDefault,IndexStyleSheet,InputSed,KeepAlive,KeepAliveTimeout,KeptBodySize,LDAPCacheEntries,LDAPCacheTTL,LDAPConnectionPoolTTL,LDAPConnectionTimeout,LDAPLibraryDebug,LDAPOpCacheEntries,LDAPOpCacheTTL,LDAPReferralHopLimit,LDAPReferrals,LDAPRetries,LDAPRetryDelay,LDAPSharedCacheFile,LDAPSharedCacheSize,LDAPTimeout,LDAPTrustedClientCert,LDAPTrustedGlobalCert,LDAPTrustedMode,LDAPVerifyServerCert,LanguagePriority,LimitInternalRecursion,LimitRequestBody,LimitRequestFieldSize,LimitRequestFields,LimitRequestLine,LimitXMLRequestBody,Listen,ListenBackLog,ListenCoresBucketsRatio,LoadFile,LoadModule,LogFormat,LogIOTrackTTFB,LogLevel,LogMessage,LuaAuthzProvider,LuaCodeCache,LuaHookAccessChecker,LuaHookAuthChecker,LuaHookCheckUserID,LuaHookFixups,LuaHookInsertFilter,LuaHookLog,LuaHookMapToStorage,LuaHookTranslateName,LuaHookTypeChecker,LuaInherit,LuaInputFilter,LuaMapHandler,LuaOutputFilter,LuaPackageCPath,LuaPackagePath,LuaQuickHandler,LuaRoot,LuaScope,MDBaseServer,MDCAChallenges,MDCertificateAgreement,MDCertificateAuthority,MDCertificateProtocol,MDDriveMode,MDHttpProxy,MDMember,MDMembers,MDMustStaple,MDNotifyCmd,MDPortMap,MDPrivateKeys,MDRenewWindow,MDRequireHttps,MDStoreDir,MDomain,MMapFile,MaxConnectionsPerChild,MaxKeepAliveRequests,MaxMemFree,MaxRangeOverlaps,MaxRangeReversals,MaxRanges,MaxRequestWorkers,MaxSpareServers,MaxSpareThreads,MaxThreads,MemcacheConnTTL,MergeTrailers,MetaDir,MetaFiles,MetaSuffix,MimeMagicFile,MinSpareServers,MinSpareThreads,ModMimeUsePathInfo,ModemStandard,MultiviewsMatch,Mutex,NWSSLTrustedCerts,NWSSLUpgradeable,NameVirtualHost,NoProxy,Options,Order,OutputSed,PassEnv,PidFile,PrivilegesMode,Protocol,ProtocolEcho,Protocols,ProtocolsHonorOrder,ProxyAddHeaders,ProxyBadHeader,ProxyBlock,ProxyDomain,ProxyErrorOverride,ProxyExpressDBMFile,ProxyExpressDBMType,ProxyExpressEnable,ProxyFCGIBackendType,ProxyFCGISetEnvIf,ProxyFtpDirCharset,ProxyFtpEscapeWildcards,ProxyFtpListOnWildcard,ProxyHCExpr,ProxyHCTPsize,ProxyHCTemplate,ProxyHTMLBufSize,ProxyHTMLCharsetOut,ProxyHTMLDocType,ProxyHTMLEnable,ProxyHTMLEvents,ProxyHTMLExtended,ProxyHTMLFixups,ProxyHTMLInterp,ProxyHTMLLinks,ProxyHTMLMeta,ProxyHTMLStripComments,ProxyHTMLURLMap,ProxyIOBufferSize,ProxyMaxForwards,ProxyPass,ProxyPassInherit,ProxyPassInterpolateEnv,ProxyPassMatch,ProxyPassReverse,ProxyPassReverseCookieDomain,ProxyPassReverseCookiePath,ProxyPreserveHost,ProxyReceiveBufferSize,ProxyRemote,ProxyRemoteMatch,ProxyRequests,ProxySCGIInternalRedirect,ProxySCGISendfile,ProxySet,ProxySourceAddress,ProxyStatus,ProxyTimeout,ProxyVia,QualifyRedirectURL,RLimitCPU,RLimitMEM,RLimitNPROC,ReadmeName,ReceiveBufferSize,Redirect,RedirectMatch,RedirectPermanent,RedirectTemp,ReflectorHeader,RegisterHttpMethod,RemoteIPHeader,RemoteIPInternalProxy,RemoteIPInternalProxyList,RemoteIPProxiesHeader,RemoteIPTrustedProxy,RemoteIPTrustedProxyList,RemoveCharset,RemoveEncoding,RemoveHandler,RemoveInputFilter,RemoveLanguage,RemoveOutputFilter,RemoveType,RequestHeader,RequestReadTimeout,Require,RewriteBase,RewriteCond,RewriteEngine,RewriteMap,RewriteOptions,RewriteRule,SSIETag,SSIEndTag,SSIErrorMsg,SSILastModified,SSILegacyExprParser,SSIStartTag,SSITimeFormat,SSIUndefinedEcho,SSLCACertificateFile,SSLCACertificatePath,SSLCADNRequestFile,SSLCADNRequestPath,SSLCARevocationCheck,SSLCARevocationFile,SSLCARevocationPath,SSLCertificateChainFile,SSLCertificateFile,SSLCertificateKeyFile,SSLCipherSuite,SSLCompression,SSLCryptoDevice,SSLEngine,SSLFIPS,SSLHonorCipherOrder,SSLInsecureRenegotiation,SSLOCSPDefaultResponder,SSLOCSPEnable,SSLOCSPNoverify,SSLOCSPOverrideResponder,SSLOCSPProxyURL,SSLOCSPResponderCertificateFile,SSLOCSPResponderTimeout,SSLOCSPResponseMaxAge,SSLOCSPResponseTimeSkew,SSLOCSPUseRequestNonce,SSLOpenSSLConfCmd,SSLOptions,SSLPassPhraseDialog,SSLProtocol,SSLProxyCACertificateFile,SSLProxyCACertificatePath,SSLProxyCARevocationCheck,SSLProxyCARevocationFile,SSLProxyCARevocationPath,SSLProxyCheckPeerCN,SSLProxyCheckPeerExpire,SSLProxyCheckPeerName,SSLProxyCipherSuite,SSLProxyEngine,SSLProxyMachineCertificateChainFile,SSLProxyMachineCertificateFile,SSLProxyMachineCertificatePath,SSLProxyProtocol,SSLProxyVerify,SSLProxyVerifyDepth,SSLRandomSeed,SSLRenegBufferSize,SSLRequire,SSLRequireSSL,SSLSRPUnknownUserSeed,SSLSRPVerifierFile,SSLSessionCache,SSLSessionCacheTimeout,SSLSessionTicketKeyFile,SSLSessionTickets,SSLStaplingCache,SSLStaplingErrorCacheTimeout,SSLStaplingFakeTryLater,SSLStaplingForceURL,SSLStaplingResponderTimeout,SSLStaplingResponseMaxAge,SSLStaplingResponseTimeSkew,SSLStaplingReturnResponderErrors,SSLStaplingStandardCacheTimeout,SSLStrictSNIVHostCheck,SSLUseStapling,SSLUserName,SSLVerifyClient,SSLVerifyDepth,Satisfy,ScoreBoardFile,Script,ScriptAlias,ScriptAliasMatch,ScriptInterpreterSource,ScriptLog,ScriptLogBuffer,ScriptLogLength,ScriptSock,SecureListen,SeeRequestTail,SendBufferSize,ServerAdmin,ServerAlias,ServerLimit,ServerName,ServerPath,ServerRoot,ServerSignature,ServerTokens,Session,SessionCookieName,SessionCookieName2,SessionCookieRemove,SessionCryptoCipher,SessionCryptoDriver,SessionCryptoPassphrase,SessionCryptoPassphraseFile,SessionDBDCookieName,SessionDBDCookieName2,SessionDBDCookieRemove,SessionDBDDeleteLabel,SessionDBDInsertLabel,SessionDBDPerUser,SessionDBDSelectLabel,SessionDBDUpdateLabel,SessionEnv,SessionExclude,SessionHeader,SessionInclude,SessionMaxAge,SetEnv,SetEnvIf,SetEnvIfExpr,SetEnvIfNoCase,SetHandler,SetInputFilter,SetOutputFilter,StartServers,StartThreads,Substitute,SubstituteInheritBefore,SubstituteMaxLineLength,Suexec,SuexecUserGroup,ThreadLimit,ThreadStackSize,ThreadsPerChild,TimeOut,TraceEnable,TransferLog,TypesConfig,UnDefine,UndefMacro,UnsetEnv,Use,UseCanonicalName,UseCanonicalPhysicalPort,User,UserDir,VHostCGIMode,VHostCGIPrivs,VHostGroup,VHostPrivs,VHostSecure,VHostUser,VirtualDocumentRoot,VirtualDocumentRootIP,VirtualScriptAlias,VirtualScriptAliasIP,WatchdogInterval,XBitHack,xml2EncAlias,xml2EncDefault,xml2StartParse"]
+var CONFIG_OPTIONS=/^[\\+\\-]?(AuthConfig|IncludesNOEXEC|ExecCGI|FollowSymLinks|MultiViews|Includes|Indexes|SymLinksIfOwnerMatch)\b/i;var ALL_KEYWORDS=[CPP_KEYWORDS,CSHARP_KEYWORDS,JSCRIPT_KEYWORDS,PERL_KEYWORDS+
+PYTHON_KEYWORDS,RUBY_KEYWORDS,SH_KEYWORDS,CONFIG_KEYWORDS,PHP_KEYWORDS];var C_TYPES=/^(DIR|FILE|vector|(de|priority_)?queue|list|stack|(const_)?iterator|(multi)?(set|map)|bitset|u?(int|float|char|void|const|static|struct)\d*(_t)?\b)|[a-z_]+_rec|cmd_parms\b/;var PR_STRING='str';var PR_KEYWORD='kwd';var PR_COMMENT='com';var PR_TYPE='typ';var PR_LITERAL='lit';var PR_PUNCTUATION='pun';var PR_PLAIN='pln';var PR_TAG='tag';var PR_DECLARATION='dec';var PR_SOURCE='src';var PR_ATTRIB_NAME='atn';var PR_ATTRIB_VALUE='atv';var PR_NOCODE='nocode';var REGEXP_PRECEDER_PATTERN='(?:^^\\.?|[+-]|[!=]=?=?|\\#|%=?|&&?=?|\\(|\\*=?|[+\\-]=|->|\\/=?|::?|<<?=?|>>?>?=?|,|;|\\?|@|\\[|~|{|\\^\\^?=?|\\|\\|?=?|break|case|continue|delete|do|else|finally|instanceof|return|throw|try|typeof)\\s*';function combinePrefixPatterns(regexs){var capturedGroupIndex=0;var needToFoldCase=false;var ignoreCase=false;for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.ignoreCase){ignoreCase=true;}else if(/[a-z]/i.test(regex.source.replace(/\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|\\[^ux]/gi,''))){needToFoldCase=true;ignoreCase=false;break;}}
+var escapeCharToCodeUnit={'b':8,'t':9,'n':0xa,'v':0xb,'f':0xc,'r':0xd};function decodeEscape(charsetPart){var cc0=charsetPart.charCodeAt(0);if(cc0!==92){return cc0;}
+var c1=charsetPart.charAt(1);cc0=escapeCharToCodeUnit[c1];if(cc0){return cc0;}else if('0'<=c1&&c1<='7'){return parseInt(charsetPart.substring(1),8);}else if(c1==='u'||c1==='x'){return parseInt(charsetPart.substring(2),16);}else{return charsetPart.charCodeAt(1);}}
+function encodeEscape(charCode){if(charCode<0x20){return(charCode<0x10?'\\x0':'\\x')+charCode.toString(16);}
+var ch=String.fromCharCode(charCode);return(ch==='\\'||ch==='-'||ch===']'||ch==='^')?"\\"+ch:ch;}
+function caseFoldCharset(charSet){var charsetParts=charSet.substring(1,charSet.length-1).match(new RegExp('\\\\u[0-9A-Fa-f]{4}'
++'|\\\\x[0-9A-Fa-f]{2}'
++'|\\\\[0-3][0-7]{0,2}'
++'|\\\\[0-7]{1,2}'
++'|\\\\[\\s\\S]'
++'|-'
++'|[^-\\\\]','g'));var ranges=[];var inverse=charsetParts[0]==='^';var out=['['];if(inverse){out.push('^');}
+for(var i=inverse?1:0,n=charsetParts.length;i<n;++i){var p=charsetParts[i];if(/\\[bdsw]/i.test(p)){out.push(p);}else{var start=decodeEscape(p);var end;if(i+2<n&&'-'===charsetParts[i+1]){end=decodeEscape(charsetParts[i+2]);i+=2;}else{end=start;}
+ranges.push([start,end]);if(!(end<65||start>122)){if(!(end<65||start>90)){ranges.push([Math.max(65,start)|32,Math.min(end,90)|32]);}
+if(!(end<97||start>122)){ranges.push([Math.max(97,start)&~32,Math.min(end,122)&~32]);}}}}
+ranges.sort(function(a,b){return(a[0]-b[0])||(b[1]-a[1]);});var consolidatedRanges=[];var lastRange=[];for(var i=0;i<ranges.length;++i){var range=ranges[i];if(range[0]<=lastRange[1]+1){lastRange[1]=Math.max(lastRange[1],range[1]);}else{consolidatedRanges.push(lastRange=range);}}
+for(var i=0;i<consolidatedRanges.length;++i){var range=consolidatedRanges[i];out.push(encodeEscape(range[0]));if(range[1]>range[0]){if(range[1]+1>range[0]){out.push('-');}
+out.push(encodeEscape(range[1]));}}
+out.push(']');return out.join('');}
+function allowAnywhereFoldCaseAndRenumberGroups(regex){var parts=regex.source.match(new RegExp('(?:'
++'\\[(?:[^\\x5C\\x5D]|\\\\[\\s\\S])*\\]'
++'|\\\\u[A-Fa-f0-9]{4}'
++'|\\\\x[A-Fa-f0-9]{2}'
++'|\\\\[0-9]+'
++'|\\\\[^ux0-9]'
++'|\\(\\?[:!=]'
++'|[\\(\\)\\^]'
++'|[^\\x5B\\x5C\\(\\)\\^]+'
++')','g'));var n=parts.length;var capturedGroups=[];for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue){if(decimalValue<=groupIndex){capturedGroups[decimalValue]=-1;}else{parts[i]=encodeEscape(decimalValue);}}}}
+for(var i=1;i<capturedGroups.length;++i){if(-1===capturedGroups[i]){capturedGroups[i]=++capturedGroupIndex;}}
+for(var i=0,groupIndex=0;i<n;++i){var p=parts[i];if(p==='('){++groupIndex;if(!capturedGroups[groupIndex]){parts[i]='(?:';}}else if('\\'===p.charAt(0)){var decimalValue=+p.substring(1);if(decimalValue&&decimalValue<=groupIndex){parts[i]='\\'+capturedGroups[decimalValue];}}}
+for(var i=0;i<n;++i){if('^'===parts[i]&&'^'!==parts[i+1]){parts[i]='';}}
+if(regex.ignoreCase&&needToFoldCase){for(var i=0;i<n;++i){var p=parts[i];var ch0=p.charAt(0);if(p.length>=2&&ch0==='['){parts[i]=caseFoldCharset(p);}else if(ch0!=='\\'){parts[i]=p.replace(/[a-zA-Z]/g,function(ch){var cc=ch.charCodeAt(0);return'['+String.fromCharCode(cc&~32,cc|32)+']';});}}}
+return parts.join('');}
+var rewritten=[];for(var i=0,n=regexs.length;i<n;++i){var regex=regexs[i];if(regex.global||regex.multiline){throw new Error(''+regex);}
+rewritten.push('(?:'+allowAnywhereFoldCaseAndRenumberGroups(regex)+')');}
+return new RegExp(rewritten.join('|'),ignoreCase?'gi':'g');}
+function extractSourceSpans(node,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var chunks=[];var length=0;var spans=[];var k=0;function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){return;}
+for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}
+var nodeName=node.nodeName.toLowerCase();if('br'===nodeName||'li'===nodeName){chunks[k]='\n';spans[k<<1]=length++;spans[(k++<<1)|1]=node;}
+break;case 3:case 4:var text=node.nodeValue;if(text.length){if(!isPreformatted){text=text.replace(/[ \t\r\n]+/g,' ');}else{text=text.replace(/\r\n?/g,'\n');text=text.replace(/^(\r?\n\s*)+/g,'');text=text.replace(/^\s*/g,'');text=text.replace(/(\r?\n\s*)+$/g,'');}
+chunks[k]=text;spans[k<<1]=length;length+=text.length;spans[(k++<<1)|1]=node;}
+break;}}
+walk(node);return{sourceCode:chunks.join('').replace(/\n$/,''),spans:spans};}
+function appendDecorations(basePos,sourceCode,langHandler,out){if(!sourceCode){return;}
+var job={sourceCode:sourceCode,basePos:basePos};langHandler(job);out.push.apply(out,job.decorations);}
+var notWs=/\S/;function childContentWrapper(element){var wrapper=undefined;for(var c=element.firstChild;c;c=c.nextSibling){var type=c.nodeType;wrapper=(type===1)?(wrapper?element:c):(type===3)?(notWs.test(c.nodeValue)?element:wrapper):wrapper;}
+return wrapper===element?undefined:wrapper;}
+function createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns){var shortcuts={};var tokenizer;(function(){var allPatterns=shortcutStylePatterns.concat(fallthroughStylePatterns);var allRegexs=[];var regexKeys={};for(var i=0,n=allPatterns.length;i<n;++i){var patternParts=allPatterns[i];var shortcutChars=patternParts[3];if(shortcutChars){for(var c=shortcutChars.length;--c>=0;){shortcuts[shortcutChars.charAt(c)]=patternParts;}}
+var regex=patternParts[1];var k=''+regex;if(!regexKeys.hasOwnProperty(k)){allRegexs.push(regex);regexKeys[k]=null;}}
+allRegexs.push(/[\0-\uffff]/);tokenizer=combinePrefixPatterns(allRegexs);})();var nPatterns=fallthroughStylePatterns.length;var decorate=function(job){var sourceCode=job.sourceCode,basePos=job.basePos;var decorations=[basePos,PR_PLAIN];var pos=0;var tokens=sourceCode.match(tokenizer)||[];var styleCache={};for(var ti=0,nTokens=tokens.length;ti<nTokens;++ti){var token=tokens[ti];var style=styleCache[token];var match=void 0;var isEmbedded;if(typeof style==='string'){isEmbedded=false;}else{var patternParts=shortcuts[token.charAt(0)];if(patternParts){match=token.match(patternParts[1]);style=patternParts[0];}else{for(var i=0;i<nPatterns;++i){patternParts=fallthroughStylePatterns[i];match=token.match(patternParts[1]);if(match){style=patternParts[0];break;}}
+if(!match){style=PR_PLAIN;}}
+isEmbedded=style.length>=5&&'lang-'===style.substring(0,5);if(isEmbedded&&!(match&&typeof match[1]==='string')){isEmbedded=false;style=PR_SOURCE;}
+if(!isEmbedded){styleCache[token]=style;}}
+var tokenStart=pos;pos+=token.length;if(!isEmbedded){decorations.push(basePos+tokenStart,style);}else{var embeddedSource=match[1];var embeddedSourceStart=token.indexOf(embeddedSource);var embeddedSourceEnd=embeddedSourceStart+embeddedSource.length;if(match[2]){embeddedSourceEnd=token.length-match[2].length;embeddedSourceStart=embeddedSourceEnd-embeddedSource.length;}
+var lang=style.substring(5);appendDecorations(basePos+tokenStart,token.substring(0,embeddedSourceStart),decorate,decorations);appendDecorations(basePos+tokenStart+embeddedSourceStart,embeddedSource,langHandlerForExtension(lang,embeddedSource),decorations);appendDecorations(basePos+tokenStart+embeddedSourceEnd,token.substring(embeddedSourceEnd),decorate,decorations);}}
+job.decorations=decorations;};return decorate;}
+function sourceDecorator(options){var shortcutStylePatterns=[],fallthroughStylePatterns=[];if(options['tripleQuotedStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'\'\'(?:[^\'\\]|\\[\s\S]|\'{1,2}(?=[^\']))*(?:\'\'\'|$)|\"\"\"(?:[^\"\\]|\\[\s\S]|\"{1,2}(?=[^\"]))*(?:\"\"\"|$)|\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$))/,null,'\'"']);}else if(options['multiLineStrings']){shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\']|\\[\s\S])*(?:\'|$)|\"(?:[^\\\"]|\\[\s\S])*(?:\"|$)|\`(?:[^\\\`]|\\[\s\S])*(?:\`|$))/,null,'\'"`']);}else{shortcutStylePatterns.push([PR_STRING,/^(?:\'(?:[^\\\'\r\n]|\\.)*(?:\'|$)|\"(?:[^\\\"\r\n]|\\.)*(?:\"|$))/,null,'"\'']);}
+if(options['verbatimStrings']){fallthroughStylePatterns.push([PR_STRING,/^@\"(?:[^\"]|\"\")*(?:\"|$)/,null]);}
+var hc=options['hashComments'];if(hc){if(options['cStyleComments']){if(hc>1){shortcutStylePatterns.push([PR_COMMENT,/^#(?:##(?:[^#]|#(?!##))*(?:###|$)|.*)/,null,'#']);}else{shortcutStylePatterns.push([PR_COMMENT,/^#(?:(?:define|elif|else|endif|error|ifdef|include|ifndef|line|pragma|undef|warning)\b|[^\r\n]*)/,null,'#']);}
+fallthroughStylePatterns.push([PR_STRING,/^<(?:(?:(?:\.\.\/)*|\/?)(?:[\w-]+(?:\/[\w-]+)+)?[\w-]+\.h(?:h|pp|\+\+)?|[a-z]\w*)>/,null]);}else{shortcutStylePatterns.push([PR_COMMENT,/^#[^\r\n]*/,null,'#']);}}
+if(options['cStyleComments']){fallthroughStylePatterns.push([PR_COMMENT,/^\/\/[^\r\n]*/,null]);fallthroughStylePatterns.push([PR_COMMENT,/^\/\*[\s\S]*?(?:\*\/|$)/,null]);}
+if(options['regexLiterals']){var REGEX_LITERAL=('/(?=[^/*])'
++'(?:[^/\\x5B\\x5C]'
++'|\\x5C[\\s\\S]'
++'|\\x5B(?:[^\\x5C\\x5D]|\\x5C[\\s\\S])*(?:\\x5D|$))+'
++'/');fallthroughStylePatterns.push(['lang-regex',new RegExp('^'+REGEXP_PRECEDER_PATTERN+'('+REGEX_LITERAL+')')]);}
+var types=options['types'];if(types){fallthroughStylePatterns.push([PR_TYPE,types]);}
+if(options['strings']){var strings=(""+options['strings']).replace(/^ | $/g,'').replace(/-/g,'\\-');fallthroughStylePatterns.push([PR_STRING,new RegExp('(?:'+strings.replace(/[\s,]+/g,'|')+')'),,null]);}
+var keywords=(""+options['keywords']).replace(/^ | $/g,'');if(keywords.length){fallthroughStylePatterns.push([PR_KEYWORD,new RegExp('^(?:'+keywords.replace(/[\s,]+/g,'|')+')\\b'),null]);}
+shortcutStylePatterns.push([PR_PLAIN,/^\s+/,null,' \r\n\t\xA0']);if(options['httpdComments']){fallthroughStylePatterns.push([PR_PLAIN,/^.*\S.*#/i,null]);}
+fallthroughStylePatterns.push([PR_LITERAL,/^@[a-z_$][a-z_$@0-9]*|\bNULL\b/i,null],[PR_LITERAL,CONFIG_OPTIONS,null],[PR_TAG,/^\b(AuthzProviderAlias|AuthnProviderAlias|RequireAny|RequireAll|RequireNone|Directory|DirectoryMatch|Location|LocationMatch|VirtualHost|If|Else|ElseIf|Proxy\b|LoadBalancer|Files|FilesMatch|Limit|LimitExcept|IfDefine|IfModule|IfVersion)\b/,null],[PR_TYPE,/^(?:[@_]?[A-Z]+[a-z][A-Za-z_$@0-9]*|\w+_(t|req|module)\b)/,null],[PR_TAG,/^apr_[a-z_0-9]+|ap_[a-z_0-9]+/i,null],[PR_PLAIN,/^[a-z_$][a-z_$@0-9\-]*/i,null],[PR_LITERAL,new RegExp('^(?:'
++'0x[a-f0-9]+'
++'|[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+:[a-f0-9:]+'
++'|(?:\\d(?:_\\d+)*\\d*(?:\\.\\d*)?|\\.\\d\\+)'
++'(?:e[+\\-]?\\d+)?'
++')'
++'[a-z]*','i'),null,'0123456789'],[PR_PLAIN,/^\\[\s\S]?/,null],[PR_PUNCTUATION,/^.[^\s\w\.$@\'\"\`\/\#\\]*/,null]);return createSimpleLexer(shortcutStylePatterns,fallthroughStylePatterns);}
+var decorateSource=sourceDecorator({'keywords':ALL_KEYWORDS,'hashComments':true,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true});function numberLines(node,opt_startLineNum,isPreformatted){var nocode=/(?:^|\s)nocode(?:\s|$)/;var lineBreak=/\r\n?|\n/;var document=node.ownerDocument;var li=document.createElement('li');while(node.firstChild){li.appendChild(node.firstChild);}
+var listItems=[li];function walk(node){switch(node.nodeType){case 1:if(nocode.test(node.className)){break;}
+if('br'===node.nodeName){breakAfter(node);if(node.parentNode){node.parentNode.removeChild(node);}}else{for(var child=node.firstChild;child;child=child.nextSibling){walk(child);}}
+break;case 3:case 4:if(isPreformatted){var text=node.nodeValue;var match=text.match(lineBreak);if(match){var firstLine=text.substring(0,match.index);node.nodeValue=firstLine;var tail=text.substring(match.index+match[0].length);if(tail){var parent=node.parentNode;parent.insertBefore(document.createTextNode(tail),node.nextSibling);}
+breakAfter(node);if(!firstLine){node.parentNode.removeChild(node);}}}
+break;}}
+function breakAfter(lineEndNode){while(!lineEndNode.nextSibling){lineEndNode=lineEndNode.parentNode;if(!lineEndNode){return;}}
+function breakLeftOf(limit,copy){var rightSide=copy?limit.cloneNode(false):limit;var parent=limit.parentNode;if(parent){var parentClone=breakLeftOf(parent,1);var next=limit.nextSibling;parentClone.appendChild(rightSide);for(var sibling=next;sibling;sibling=next){next=sibling.nextSibling;parentClone.appendChild(sibling);}}
+return rightSide;}
+var copiedListItem=breakLeftOf(lineEndNode.nextSibling,0);for(var parent;(parent=copiedListItem.parentNode)&&parent.nodeType===1;){copiedListItem=parent;}
+listItems.push(copiedListItem);}
+for(var i=0;i<listItems.length;++i){walk(listItems[i]);}
+if(opt_startLineNum===(opt_startLineNum|0)){listItems[0].setAttribute('value',opt_startLineNum);}
+var ol=document.createElement('ol');ol.className='linenums';var offset=Math.max(0,((opt_startLineNum-1))|0)||0;for(var i=0,n=listItems.length;i<n;++i){li=listItems[i];li.className='L'+((i+offset)%1);if(!li.firstChild){li.appendChild(document.createTextNode('\xA0'));}
+ol.appendChild(li);}
+node.appendChild(ol);}
+function recombineTagsAndDecorations(job){var isIE8OrEarlier=/\bMSIE\s(\d+)/.exec(navigator.userAgent);isIE8OrEarlier=isIE8OrEarlier&&+isIE8OrEarlier[1]<=8;var newlineRe=/\n/g;var source=job.sourceCode;var sourceLength=source.length;var sourceIndex=0;var spans=job.spans;var nSpans=spans.length;var spanIndex=0;var decorations=job.decorations;var nDecorations=decorations.length;var decorationIndex=0;decorations[nDecorations]=sourceLength;var decPos,i;for(i=decPos=0;i<nDecorations;){if(decorations[i]!==decorations[i+2]){decorations[decPos++]=decorations[i++];decorations[decPos++]=decorations[i++];}else{i+=2;}}
+nDecorations=decPos;for(i=decPos=0;i<nDecorations;){var startPos=decorations[i];var startDec=decorations[i+1];var end=i+2;while(end+2<=nDecorations&&decorations[end+1]===startDec){end+=2;}
+decorations[decPos++]=startPos;decorations[decPos++]=startDec;i=end;}
+nDecorations=decorations.length=decPos;var sourceNode=job.sourceNode;var oldDisplay;if(sourceNode){oldDisplay=sourceNode.style.display;sourceNode.style.display='none';}
+try{var decoration=null;var X=0;while(spanIndex<nSpans){X=X+1;if(X>5000){break;}
+var spanStart=spans[spanIndex];var spanEnd=spans[spanIndex+2]||sourceLength;var decEnd=decorations[decorationIndex+2]||sourceLength;var end=Math.min(spanEnd,decEnd);var textNode=spans[spanIndex+1];var styledText;if(textNode.nodeType!==1&&(styledText=source.substring(sourceIndex,end))){if(isIE8OrEarlier){styledText=styledText.replace(newlineRe,'\r');}
+textNode.nodeValue=styledText;var document=textNode.ownerDocument;var span=document.createElement('span');span.className=decorations[decorationIndex+1];var parentNode=textNode.parentNode;parentNode.replaceChild(span,textNode);span.appendChild(textNode);if(sourceIndex<spanEnd){spans[spanIndex+1]=textNode=document.createTextNode(source.substring(end,spanEnd));parentNode.insertBefore(textNode,span.nextSibling);}}
+sourceIndex=end;if(sourceIndex>=spanEnd){spanIndex+=2;}
+if(sourceIndex>=decEnd){decorationIndex+=2;}}}finally{if(sourceNode){sourceNode.style.display=oldDisplay;}}}
+var langHandlerRegistry={};function registerLangHandler(handler,fileExtensions){for(var i=fileExtensions.length;--i>=0;){var ext=fileExtensions[i];if(!langHandlerRegistry.hasOwnProperty(ext)){langHandlerRegistry[ext]=handler;}else if(win['console']){console['warn']('cannot override language handler %s',ext);}}}
+function langHandlerForExtension(extension,source){if(!(extension&&langHandlerRegistry.hasOwnProperty(extension))){extension=/^\s*</.test(source)?'default-markup':'default-code';}
+return langHandlerRegistry[extension];}
+registerLangHandler(decorateSource,['default-code']);registerLangHandler(createSimpleLexer([],[[PR_PLAIN,/^[^<?]+/],[PR_DECLARATION,/^<!\w[^>]*(?:>|$)/],[PR_COMMENT,/^<\!--[\s\S]*?(?:-\->|$)/],['lang-',/^<\?([\s\S]+?)(?:\?>|$)/],['lang-',/^<%([\s\S]+?)(?:%>|$)/],[PR_PUNCTUATION,/^(?:<[%?]|[%?]>)/],['lang-',/^<xmp\b[^>]*>([\s\S]+?)<\/xmp\b[^>]*>/i],['lang-js',/^<script\b[^>]*>([\s\S]*?)(<\/script\b[^>]*>)/i],['lang-css',/^<style\b[^>]*>([\s\S]*?)(<\/style\b[^>]*>)/i],['lang-in.tag',/^(<\/?[a-z][^<>]*>)/i]]),['default-markup','htm','html','mxml','xhtml','xml','xsl']);registerLangHandler(createSimpleLexer([[PR_PLAIN,/^[\s]+/,null,' \t\r\n'],[PR_ATTRIB_VALUE,/^(?:\"[^\"]*\"?|\'[^\']*\'?)/,null,'\"\'']],[[PR_TAG,/^^<\/?[a-z](?:[\w.:-]*\w)?|\/?>$/i],[PR_ATTRIB_NAME,/^(?!style[\s=]|on)[a-z](?:[\w:-]*\w)?/i],['lang-uq.val',/^=\s*([^>\'\"\s]*(?:[^>\'\"\s\/]|\/(?=\s)))/],[PR_PUNCTUATION,/^[=<>\/]+/],['lang-js',/^on\w+\s*=\s*\"([^\"]+)\"/i],['lang-js',/^on\w+\s*=\s*\'([^\']+)\'/i],['lang-js',/^on\w+\s*=\s*([^\"\'>\s]+)/i],['lang-css',/^style\s*=\s*\"([^\"]+)\"/i],['lang-css',/^style\s*=\s*\'([^\']+)\'/i],['lang-css',/^style\s*=\s*([^\"\'>\s]+)/i]]),['in.tag']);registerLangHandler(createSimpleLexer([],[[PR_ATTRIB_VALUE,/^[\s\S]+/]]),['uq.val']);registerLangHandler(sourceDecorator({'keywords':CPP_KEYWORDS,'hashComments':true,'cStyleComments':true,'types':C_TYPES}),['c','cc','cpp','cxx','cyc','m']);registerLangHandler(sourceDecorator({'keywords':PHP_KEYWORDS,'hashComments':false,'cStyleComments':true,'multiLineStrings':true,'regexLiterals':true}),['php','phtml','inc']);registerLangHandler(sourceDecorator({'keywords':'null,true,false'}),['json']);registerLangHandler(sourceDecorator({'keywords':CSHARP_KEYWORDS,'hashComments':true,'cStyleComments':true,'verbatimStrings':true,'types':C_TYPES}),['cs']);registerLangHandler(sourceDecorator({'keywords':JAVA_KEYWORDS,'cStyleComments':true}),['java']);registerLangHandler(sourceDecorator({'keywords':SH_KEYWORDS,'hashComments':true,'multiLineStrings':true}),['bsh','csh','sh']);registerLangHandler(sourceDecorator({'keywords':PYTHON_KEYWORDS,'hashComments':true,'multiLineStrings':true,'tripleQuotedStrings':true}),['cv','py']);registerLangHandler(sourceDecorator({'keywords':PERL_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['perl','pl','pm']);registerLangHandler(sourceDecorator({'keywords':RUBY_KEYWORDS,'hashComments':true,'multiLineStrings':true,'regexLiterals':true}),['rb']);registerLangHandler(sourceDecorator({'keywords':JSCRIPT_KEYWORDS,'cStyleComments':true,'regexLiterals':true}),['js']);registerLangHandler(sourceDecorator({'keywords':COFFEE_KEYWORDS,'hashComments':3,'cStyleComments':true,'multilineStrings':true,'tripleQuotedStrings':true,'regexLiterals':true}),['coffee']);registerLangHandler(createSimpleLexer([],[[PR_STRING,/^[\s\S]+/]]),['regex']);registerLangHandler(sourceDecorator({'keywords':CONFIG_KEYWORDS,'literals':CONFIG_OPTIONS,'strings':CONFIG_ENVS,'hashComments':true,'cStyleComments':false,'multiLineStrings':false,'regexLiterals':false,'httpdComments':true}),['config']);function applyDecorator(job){var opt_langExtension=job.langExtension;try{var sourceAndSpans=extractSourceSpans(job.sourceNode,job.pre);var source=sourceAndSpans.sourceCode;job.sourceCode=source;job.spans=sourceAndSpans.spans;job.basePos=0;langHandlerForExtension(opt_langExtension,source)(job);recombineTagsAndDecorations(job);}catch(e){if(win['console']){console['log'](e&&e['stack']?e['stack']:e);}}}
+function prettyPrintOne(sourceCodeHtml,opt_langExtension,opt_numberLines){var container=document.createElement('pre');container.innerHTML=sourceCodeHtml;if(opt_numberLines){numberLines(container,opt_numberLines,true);}
+var job={langExtension:opt_langExtension,numberLines:opt_numberLines,sourceNode:container,pre:1};applyDecorator(job);return container.innerHTML;}
+function prettyPrint(opt_whenDone){function byTagName(tn){return document.getElementsByTagName(tn);}
+var codeSegments=[byTagName('pre'),byTagName('code'),byTagName('xmp')];var elements=[];for(var i=0;i<codeSegments.length;++i){for(var j=0,n=codeSegments[i].length;j<n;++j){elements.push(codeSegments[i][j]);}}
+codeSegments=null;var clock=Date;if(!clock['now']){clock={'now':function(){return+(new Date);}};}
+var k=0;var prettyPrintingJob;var langExtensionRe=/\blang(?:uage)?-([\w.]+)(?!\S)/;var prettyPrintRe=/\bprettyprint\b/;var prettyPrintedRe=/\bprettyprinted\b/;var preformattedTagNameRe=/pre|xmp/i;var codeRe=/^code$/i;var preCodeXmpRe=/^(?:pre|code|xmp)$/i;function doWork(){var endTime=(win['PR_SHOULD_USE_CONTINUATION']?clock['now']()+250:Infinity);for(;k<elements.length&&clock['now']()<endTime;k++){var cs=elements[k];var className=cs.className;if(prettyPrintRe.test(className)&&!prettyPrintedRe.test(className)){var nested=false;for(var p=cs.parentNode;p;p=p.parentNode){var tn=p.tagName;if(preCodeXmpRe.test(tn)&&p.className&&prettyPrintRe.test(p.className)){nested=true;break;}}
+if(!nested){cs.className+=' prettyprinted';var langExtension=className.match(langExtensionRe);var wrapper;if(!langExtension&&(wrapper=childContentWrapper(cs))&&codeRe.test(wrapper.tagName)){langExtension=wrapper.className.match(langExtensionRe);}
+if(langExtension){langExtension=langExtension[1];}
+var preformatted;if(preformattedTagNameRe.test(cs.tagName)){preformatted=1;}else{var currentStyle=cs['currentStyle'];var whitespace=(currentStyle?currentStyle['whiteSpace']:(document.defaultView&&document.defaultView.getComputedStyle)?document.defaultView.getComputedStyle(cs,null).getPropertyValue('white-space'):0);preformatted=whitespace&&'pre'===whitespace.substring(0,3);}
+var lineNums=cs.className.match(/\blinenums\b(?::(\d+))?/);lineNums=lineNums?lineNums[1]&&lineNums[1].length?+lineNums[1]:true:false;if(lineNums){numberLines(cs,lineNums,preformatted);}
+prettyPrintingJob={langExtension:langExtension,sourceNode:cs,numberLines:lineNums,pre:preformatted};applyDecorator(prettyPrintingJob);}}}
+if(k<elements.length){setTimeout(doWork,250);}else if(opt_whenDone){opt_whenDone();}}
+doWork();}
+var PR=win['PR']={'createSimpleLexer':createSimpleLexer,'registerLangHandler':registerLangHandler,'sourceDecorator':sourceDecorator,'PR_ATTRIB_NAME':PR_ATTRIB_NAME,'PR_ATTRIB_VALUE':PR_ATTRIB_VALUE,'PR_COMMENT':PR_COMMENT,'PR_DECLARATION':PR_DECLARATION,'PR_KEYWORD':PR_KEYWORD,'PR_LITERAL':PR_LITERAL,'PR_NOCODE':PR_NOCODE,'PR_PLAIN':PR_PLAIN,'PR_PUNCTUATION':PR_PUNCTUATION,'PR_SOURCE':PR_SOURCE,'PR_STRING':PR_STRING,'PR_TAG':PR_TAG,'PR_TYPE':PR_TYPE,'prettyPrintOne':win['prettyPrintOne']=prettyPrintOne,'prettyPrint':win['prettyPrint']=prettyPrint};PR['registerLangHandler'](PR['createSimpleLexer']([[PR['PR_PLAIN'],/^[\t\n\r \xA0]+/,null,'\t\n\r \xA0'],[PR['PR_STRING'],/^(?:\"(?:[^\"\\]|\\[\s\S])*(?:\"|$)|\'(?:[^\'\\]|\\[\s\S])*(?:\'|$))/,null,'"\'']],[[PR['PR_COMMENT'],/^--(?:\[(=*)\[[\s\S]*?(?:\]\1\]|$)|[^\r\n]*)/],[PR['PR_TYPE'],/^nil|false|true/],[PR['PR_STRING'],/^\[(=*)\[[\s\S]*?(?:\]\1\]|$)/],[PR['PR_KEYWORD'],/^(?:and|break|do|else|elseif|end|for|function|if|in|local|not|or|repeat|require|return|then|until|while)\b/,null],[PR['PR_LITERAL'],/^[+-]?(?:0x[\da-f]+|(?:(?:\.\d+|\d+(?:\.\d*)?)(?:e[+\-]?\d+)?))/i],[PR['PR_PLAIN'],/^[a-z_]\w*/i],[PR['PR_PUNCTUATION'],/^[^\w\t\n\r \xA0][^\w\t\n\r \xA0\"\'\-\+=]*/]]),['lua']);if(typeof define==="function"&&define['amd']){define("google-code-prettify",[],function(){return PR;});}})();
 \ No newline at end of file
diff --git a/docs/manual/style/sitemap.dtd b/docs/manual/style/sitemap.dtd
 new file mode 100644
index 0000000..829f326
--- /dev/null
+++ b/docs/manual/style/sitemap.dtd
@@ -0,0 +1,42 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY % common SYSTEM "common.dtd">
+%common;
+
+<!-- <sitemap> is the root element -->
+<!ELEMENT sitemap (title, summary?, seealso*, category*)>
+
+<!ATTLIST sitemap metafile CDATA  #REQUIRED
+                  upgrade  CDATA  #IMPLIED
+>
+
+<!-- <indexpage> is another root element -->
+<!ELEMENT indexpage (parentdocument, title, category*)>
+
+<!ATTLIST indexpage metafile CDATA  #REQUIRED
+                    upgrade  CDATA  #IMPLIED
+>
+
+<!ELEMENT category (title, page*)>
+<!ATTLIST category id ID #IMPLIED>
+
+<!ELEMENT page (#PCDATA)>
+<!ATTLIST page href CDATA #IMPLIED
+               separate (yes | no) "no" >
diff --git a/docs/manual/style/version.ent b/docs/manual/style/version.ent
 new file mode 100644
index 0000000..786d470
--- /dev/null
+++ b/docs/manual/style/version.ent
@@ -0,0 +1,24 @@
+<?xml version='1.0' encoding='UTF-8' ?>
+
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements.  See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License.  You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+
+<!ENTITY httpd.major "2">
+<!ENTITY httpd.minor "4">
+<!ENTITY httpd.patch "34">
+
+<!ENTITY httpd.docs "2.4">
diff --git a/docs/manual/suexec.html b/docs/manual/suexec.html
 new file mode 100644
index 0000000..c4cc65b
--- /dev/null
+++ b/docs/manual/suexec.html
@@ -0,0 +1,21 @@
+# GENERATED FROM XML -- DO NOT EDIT
+
+URI: suexec.html.en
+Content-Language: en
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.fr
+Content-Language: fr
+Content-type: text/html; charset=ISO-8859-1
+
+URI: suexec.html.ja.utf8
+Content-Language: ja
+Content-type: text/html; charset=UTF-8
+
+URI: suexec.html.ko.euc-kr
+Content-Language: ko
+Content-type: text/html; charset=EUC-KR
+
+URI: suexec.html.tr.utf8
+Content-Language: tr
+Content-type: text/html; charset=UTF-8
diff --git a/docs/manual/suexec.html.en b/docs/manual/suexec.html.en
 new file mode 100644
index 0000000..526e793
--- /dev/null
+++ b/docs/manual/suexec.html.en
@@ -0,0 +1,643 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->
+<title>suEXEC Support - Apache HTTP Server Version 2.4</title>
+<link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
+<link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
+<link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="./style/css/prettify.css" />
+<script src="./style/scripts/prettify.min.js" type="text/javascript">
+</script>
+
+<link href="./images/favicon.ico" rel="shortcut icon" /></head>
+<body id="manual-page"><div id="page-header">
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p>
+<p class="apache">Apache HTTP Server Version 2.4</p>
+<img alt="" src="./images/feather.png" /></div>
+<div class="up"><a href="./"><img title="&lt;-" alt="&lt;-" src="./images/left.gif" /></a></div>
+<div id="path">
+<a href="http://www.apache.org/">Apache</a> &gt; <a href="http://httpd.apache.org/">HTTP Server</a> &gt; <a href="http://httpd.apache.org/docs/">Documentation</a> &gt; <a href="./">Version 2.4</a></div><div id="page-content"><div id="preamble"><h1>suEXEC Support</h1>
+<div class="toplang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div>
+
+    <p>The <strong>suEXEC</strong> feature provides users of the Apache
+    HTTP Server the ability
+    to run <strong>CGI</strong> and <strong>SSI</strong> programs
+    under user IDs different from the user ID of the calling
+    web server. Normally, when a CGI or SSI program executes, it
+    runs as the same user who is running the web server.</p>
+
+    <p>Used properly, this feature can reduce
+    considerably the security risks involved with allowing users to
+    develop and run private CGI or SSI programs. However, if suEXEC
+    is improperly configured, it can cause any number of problems
+    and possibly create new holes in your computer's security. If
+    you aren't familiar with managing <em>setuid root</em> programs
+    and the security issues they present, we highly recommend that
+    you not consider using suEXEC.</p>
+  </div>
+<div id="quickview"><a href="https://www.apache.org/foundation/contributing.html" class="badge"><img src="https://www.apache.org/images/SupportApache-small.png" alt="Support Apache!" /></a><ul id="toc"><li><img alt="" src="./images/down.gif" /> <a href="#before">Before we begin</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#model">suEXEC Security Model</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#install">Configuring &amp; Installing
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#enable">Enabling &amp; Disabling
+    suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#usage">Using suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#debug">Debugging suEXEC</a></li>
+<li><img alt="" src="./images/down.gif" /> <a href="#jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></li>
+</ul><h3>See also</h3><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div>
+<div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="before" id="before">Before we begin</a></h2>
+
+    <p>Before jumping head-first into this document,
+    you should be aware that certain assumptions are made about you and
+    the environment in which you will be using suexec.</p>
+
+    <p>First, it is assumed that you are using a UNIX
+    derivative operating system that is capable of
+    <strong>setuid</strong> and <strong>setgid</strong> operations.
+    All command examples are given in this regard. Other platforms,
+    if they are capable of supporting suEXEC, may differ in their
+    configuration.</p>
+
+    <p>Second, it is assumed you are familiar with
+    some basic concepts of your computer's security and its
+    administration. This involves an understanding of
+    <strong>setuid/setgid</strong> operations and the various
+    effects they may have on your system and its level of
+    security.</p>
+
+    <p>Third, it is assumed that you are using an
+    <strong>unmodified</strong> version of suEXEC code. All code
+    for suEXEC has been carefully scrutinized and tested by the
+    developers as well as numerous beta testers. Every precaution
+    has been taken to ensure a simple yet solidly safe base of
+    code. Altering this code can cause unexpected problems and new
+    security risks. It is <strong>highly</strong> recommended you
+    not alter the suEXEC code unless you are well versed in the
+    particulars of security programming and are willing to share
+    your work with the Apache HTTP Server development team for consideration.</p>
+
+    <p>Fourth, and last, it has been the decision of
+    the Apache HTTP Server development team to <strong>NOT</strong> make suEXEC part of
+    the default installation of Apache httpd. To this end, suEXEC
+    configuration requires of the administrator careful attention
+    to details. After due consideration has been given to the
+    various settings for suEXEC, the administrator may install
+    suEXEC through normal installation methods. The values for
+    these settings need to be carefully determined and specified by
+    the administrator to properly maintain system security during
+    the use of suEXEC functionality. It is through this detailed
+    process that we hope to limit suEXEC
+    installation only to those who are careful and determined
+    enough to use it.</p>
+
+    <p>Still with us? Yes? Good. Let's move on!</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="model" id="model">suEXEC Security Model</a></h2>
+
+    <p>Before we begin configuring and installing
+    suEXEC, we will first discuss the security model you are about
+    to implement. By doing so, you may better understand what
+    exactly is going on inside suEXEC and what precautions are
+    taken to ensure your system's security.</p>
+
+    <p><strong>suEXEC</strong> is based on a setuid
+    "wrapper" program that is called by the main Apache HTTP Server.
+    This wrapper is called when an HTTP request is made for a CGI
+    or SSI program that the administrator has designated to run as
+    a userid other than that of the main server. When such a
+    request is made, Apache httpd provides the suEXEC wrapper with the
+    program's name and the user and group IDs under which the
+    program is to execute.</p>
+
+    <p>The wrapper then employs the following process
+    to determine success or failure -- if any one of these
+    conditions fail, the program logs the failure and exits with an
+    error, otherwise it will continue:</p>
+
+    <ol>
+      <li>
+        <strong>Is the user executing this wrapper a valid user of
+        this system?</strong>
+
+        <p class="indent">
+          This is to ensure that the user executing the wrapper is
+          truly a user of the system.
+        </p>
+     </li>
+
+     <li>
+        <strong>Was the wrapper called with the proper number of
+        arguments?</strong>
+
+        <p class="indent">
+          The wrapper will only execute if it is given the proper
+          number of arguments. The proper argument format is known
+          to the Apache HTTP Server. If the wrapper is not receiving
+          the proper number of arguments, it is either being
+          hacked, or there is something wrong with the suEXEC
+          portion of your Apache httpd binary.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is this valid user allowed to run the
+        wrapper?</strong>
+
+        <p class="indent">
+          Is this user the user allowed to run this wrapper? Only
+          one user (the Apache user) is allowed to execute this
+          program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI or SSI program have an unsafe
+        hierarchical reference?</strong>
+
+        <p class="indent">
+          Does the target CGI or SSI program's path contain a leading
+          '/' or have a '..' backreference? These are not allowed; the
+          target CGI/SSI program must reside within suEXEC's document
+          root (see <code>--with-suexec-docroot=<em>DIR</em></code>
+          below).
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user name valid?</strong>
+
+        <p class="indent">
+          Does the target user exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group name valid?</strong>
+
+        <p class="indent">
+          Does the target group exist?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user <em>NOT</em> superuser?</strong>
+
+
+        <p class="indent">
+          suEXEC does not allow <code><em>root</em></code>
+          to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target userid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum user ID number is specified during
+          configuration. This allows you to set the lowest possible
+          userid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" accounts.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target group <em>NOT</em> the superuser
+        group?</strong>
+
+        <p class="indent">
+          Presently, suEXEC does not allow the <code><em>root</em></code>
+          group to execute CGI/SSI programs.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target groupid <em>ABOVE</em> the minimum ID
+        number?</strong>
+
+        <p class="indent">
+          The minimum group ID number is specified during
+          configuration. This allows you to set the lowest possible
+          groupid that will be allowed to execute CGI/SSI programs.
+          This is useful to block out "system" groups.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can the wrapper successfully become the target user
+        and group?</strong>
+
+        <p class="indent">
+          Here is where the program becomes the target user and
+          group via setuid and setgid calls. The group access list
+          is also initialized with all of the groups of which the
+          user is a member.
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we change directory to the one in which the target
+        CGI/SSI program resides?</strong>
+
+        <p class="indent">
+          If it doesn't exist, it can't very well contain files. If we
+          can't change directory to it, it might as well not exist.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory within the httpd webspace?</strong>
+
+        <p class="indent">
+          If the request is for a regular portion of the server, is
+          the requested directory within suEXEC's document root? If
+          the request is for a <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>, is the requested directory
+          within the directory configured as suEXEC's userdir (see
+          <a href="#install">suEXEC's configuration options</a>)?
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the directory <em>NOT</em> writable by anyone
+        else?</strong>
+
+        <p class="indent">
+          We don't want to open up the directory to others; only
+          the owner user may be able to alter this directories
+          contents.
+        </p>
+      </li>
+
+      <li>
+        <strong>Does the target CGI/SSI program exist?</strong>
+
+        <p class="indent">
+          If it doesn't exists, it can't very well be executed.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> writable
+        by anyone else?</strong>
+
+        <p class="indent">
+          We don't want to give anyone other than the owner the
+          ability to change the CGI/SSI program.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target CGI/SSI program <em>NOT</em> setuid or
+        setgid?</strong>
+
+        <p class="indent">
+          We do not want to execute programs that will then change
+          our UID/GID again.
+        </p>
+      </li>
+
+      <li>
+        <strong>Is the target user/group the same as the program's
+        user/group?</strong>
+
+        <p class="indent">
+          Is the user the owner of the file?
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully clean the process environment
+        to ensure safe operations?</strong>
+
+        <p class="indent">
+          suEXEC cleans the process' environment by establishing a
+          safe execution PATH (defined during configuration), as
+          well as only passing through those variables whose names
+          are listed in the safe environment list (also created
+          during configuration).
+        </p>
+      </li>
+
+      <li>
+        <strong>Can we successfully become the target CGI/SSI program
+        and execute?</strong>
+
+        <p class="indent">
+          Here is where suEXEC ends and the target CGI/SSI program begins.
+        </p>
+      </li>
+    </ol>
+
+    <p>This is the standard operation of the
+    suEXEC wrapper's security model. It is somewhat stringent and
+    can impose new limitations and guidelines for CGI/SSI design,
+    but it was developed carefully step-by-step with security in
+    mind.</p>
+
+    <p>For more information as to how this security
+    model can limit your possibilities in regards to server
+    configuration, as well as what security risks can be avoided
+    with a proper suEXEC setup, see the <a href="#jabberwock">"Beware the Jabberwock"</a> section of this
+    document.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="install" id="install">Configuring &amp; Installing
+    suEXEC</a></h2>
+
+    <p>Here's where we begin the fun.</p>
+
+    <p><strong>suEXEC configuration
+    options</strong><br />
+    </p>
+
+    <dl>
+      <dt><code>--enable-suexec</code></dt>
+
+      <dd>This option enables the suEXEC feature which is never
+      installed or activated by default. At least one
+      <code>--with-suexec-xxxxx</code> option has to be provided
+      together with the <code>--enable-suexec</code> option to let
+      APACI accept your request for using the suEXEC feature.</dd>
+
+      <dt><code>--with-suexec-bin=<em>PATH</em></code></dt>
+
+      <dd>The path to the <code>suexec</code> binary must be hard-coded
+      in the server for security reasons. Use this option to override
+      the default path. <em>e.g.</em>
+      <code>--with-suexec-bin=/usr/sbin/suexec</code></dd>
+
+      <dt><code>--with-suexec-caller=<em>UID</em></code></dt>
+
+      <dd>The <a href="mod/mpm_common.html#user">username</a> under which
+      httpd normally runs. This is the only user allowed to
+      execute the suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-userdir=<em>DIR</em></code></dt>
+
+      <dd>Define to be the subdirectory under users' home
+      directories where suEXEC access should be allowed. All
+      executables under this directory will be executable by suEXEC
+      as the user so they should be "safe" programs. If you are
+      using a "simple" <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>
+      directive (ie. one without a "*" in it) this should be set to the same
+      value. suEXEC will not work properly in cases where the <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> directive points to
+      a location that is not the same as the user's home directory
+      as referenced in the <code>passwd</code> file. Default value is
+      "<code>public_html</code>".<br />
+      If you have virtual hosts with a different <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code> for each,
+      you will need to define them to all reside in one parent
+      directory; then name that parent directory here. <strong>If
+      this is not defined properly, "~userdir" cgi requests will
+      not work!</strong></dd>
+
+      <dt><code>--with-suexec-docroot=<em>DIR</em></code></dt>
+
+      <dd>Define as the DocumentRoot set for httpd. This will be
+      the only hierarchy (aside from <code class="directive"><a href="./mod/mod_userdir.html#userdir">UserDir</a></code>s) that can be used for suEXEC behavior. The
+      default directory is the <code>--datadir</code> value with the suffix
+      "<code>/htdocs</code>", <em>e.g.</em> if you configure with
+      "<code>--datadir=/home/apache</code>" the directory
+      "<code>/home/apache/htdocs</code>" is used as document root for the
+      suEXEC wrapper.</dd>
+
+      <dt><code>--with-suexec-uidmin=<em>UID</em></code></dt>
+
+      <dd>Define this as the lowest UID allowed to be a target user
+      for suEXEC. For most systems, 500 or 100 is common. Default
+      value is 100.</dd>
+
+      <dt><code>--with-suexec-gidmin=<em>GID</em></code></dt>
+
+      <dd>Define this as the lowest GID allowed to be a target
+      group for suEXEC. For most systems, 100 is common and
+      therefore used as default value.</dd>
+
+      <dt><code>--with-suexec-logfile=<em>FILE</em></code></dt>
+
+      <dd>This defines the filename to which all suEXEC
+      transactions and errors are logged (useful for auditing and
+      debugging purposes). By default the logfile is named
+      "<code>suexec_log</code>" and located in your standard logfile
+      directory (<code>--logfiledir</code>).</dd>
+
+      <dt><code>--with-suexec-safepath=<em>PATH</em></code></dt>
+
+      <dd>Define a safe PATH environment to pass to CGI
+      executables. Default value is
+      "<code>/usr/local/bin:/usr/bin:/bin</code>".</dd>
+    </dl>
+
+    <h3>Compiling and installing the suEXEC wrapper</h3>
+      
+
+      <p>If you have enabled the suEXEC feature with the
+      <code>--enable-suexec</code> option the <code>suexec</code> binary
+      (together with httpd itself) is automatically built if you execute
+      the <code>make</code> command.</p>
+
+      <p>After all components have been built you can execute the
+      command <code>make install</code> to install them. The binary image
+      <code>suexec</code> is installed in the directory defined by the
+      <code>--sbindir</code> option. The default location is
+      "/usr/local/apache2/bin/suexec".</p>
+
+      <p>Please note that you need <strong><em>root
+      privileges</em></strong> for the installation step. In order
+      for the wrapper to set the user ID, it must be installed as
+      owner <code><em>root</em></code> and must have the setuserid
+      execution bit set for file modes.</p>
+    
+
+    <h3>Setting paranoid permissions</h3>
+      
+
+      <p>Although the suEXEC wrapper will check to ensure that its
+      caller is the correct user as specified with the
+      <code>--with-suexec-caller</code> <code class="program"><a href="./programs/configure.html">configure</a></code>
+      option, there is
+      always the possibility that a system or library call suEXEC uses
+      before this check may be exploitable on your system. To counter
+      this, and because it is best-practise in general, you should use
+      filesystem permissions to ensure that only the group httpd
+      runs as may execute suEXEC.</p>
+
+      <p>If for example, your web server is configured to run as:</p>
+
+      <pre class="prettyprint lang-config">User www
+Group webgroup</pre>
+
+
+      <p>and <code class="program"><a href="./programs/suexec.html">suexec</a></code> is installed at
+      "/usr/local/apache2/bin/suexec", you should run:</p>
+
+      <div class="example"><p><code>
+          chgrp webgroup /usr/local/apache2/bin/suexec<br />
+          chmod 4750 /usr/local/apache2/bin/suexec<br />
+      </code></p></div>
+
+      <p>This will ensure that only the group httpd runs as can even
+      execute the suEXEC wrapper.</p>
+    
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="enable" id="enable">Enabling &amp; Disabling
+    suEXEC</a></h2>
+
+    <p>Upon startup of httpd, it looks for the file
+    <code class="program"><a href="./programs/suexec.html">suexec</a></code> in the directory defined by the
+    <code>--sbindir</code> option (default is
+    "/usr/local/apache/sbin/suexec"). If httpd finds a properly
+    configured suEXEC wrapper, it will print the following message
+    to the error log:</p>
+
+<div class="example"><p><code>
+    [notice] suEXEC mechanism enabled (wrapper: <var>/path/to/suexec</var>)
+</code></p></div>
+
+    <p>If you don't see this message at server startup, the server is
+    most likely not finding the wrapper program where it expects
+    it, or the executable is not installed <em>setuid root</em>.</p>
+
+     <p>If you want to enable the suEXEC mechanism for the first time
+    and an Apache HTTP Server is already running you must kill and
+    restart httpd. Restarting it with a simple HUP or USR1 signal
+    will not be enough. </p>
+     <p>If you want to disable suEXEC you should kill and restart
+    httpd after you have removed the <code class="program"><a href="./programs/suexec.html">suexec</a></code> file.</p>
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="usage" id="usage">Using suEXEC</a></h2>
+
+    <p>Requests for CGI programs will call the suEXEC wrapper only if
+    they are for a virtual host containing a <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive or if
+    they are processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code>.</p>
+
+    <p><strong>Virtual Hosts:</strong><br /> One way to use the suEXEC
+    wrapper is through the <code class="directive"><a href="./mod/mod_suexec.html#suexecusergroup">SuexecUserGroup</a></code> directive in
+    <code class="directive"><a href="./mod/core.html#virtualhost">VirtualHost</a></code> definitions.  By
+    setting this directive to values different from the main server
+    user ID, all requests for CGI resources will be executed as the
+    <em>User</em> and <em>Group</em> defined for that <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code>. If this
+    directive is not specified for a <code class="directive"><a href="./mod/core.html#virtualhost">&lt;VirtualHost&gt;</a></code> then the main server userid
+    is assumed.</p>
+
+    <p><strong>User directories:</strong><br /> Requests that are
+     processed by <code class="module"><a href="./mod/mod_userdir.html">mod_userdir</a></code> will call the suEXEC
+     wrapper to execute CGI programs under the userid of the requested
+     user directory.  The only requirement needed for this feature to
+     work is for CGI execution to be enabled for the user and that the
+     script must meet the scrutiny of the <a href="#model">security
+     checks</a> above.  See also the
+     <code>--with-suexec-userdir</code> <a href="#install">compile
+     time option</a>.</p> </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="debug" id="debug">Debugging suEXEC</a></h2>
+
+    <p>The suEXEC wrapper will write log information
+    to the file defined with the <code>--with-suexec-logfile</code>
+    option as indicated above. If you feel you have configured and
+    installed the wrapper properly, have a look at this log and the
+    error_log for the server to see where you may have gone astray.</p>
+
+</div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif" /></a></div>
+<div class="section">
+<h2><a name="jabberwock" id="jabberwock">Beware the Jabberwock:
+    Warnings &amp; Examples</a></h2>
+
+    <p><strong>NOTE!</strong> This section may not be
+    complete. For the latest revision of this section of the
+    documentation, see the <a href="http://httpd.apache.org/docs/2.4/suexec.html">Online
+    Documentation</a> version.</p>
+
+    <p>There are a few points of interest regarding
+    the wrapper that can cause limitations on server setup. Please
+    review these before submitting any "bugs" regarding suEXEC.</p>
+
+    <ul>
+      <li><strong>suEXEC Points Of Interest</strong></li>
+
+      <li>
+        Hierarchy limitations
+
+        <p class="indent">
+          For security and efficiency reasons, all suEXEC requests
+          must remain within either a top-level document root for
+          virtual host requests, or one top-level personal document
+          root for userdir requests. For example, if you have four
+          VirtualHosts configured, you would need to structure all
+          of your VHosts' document roots off of one main httpd
+          document hierarchy to take advantage of suEXEC for
+          VirtualHosts. (Example forthcoming.)
+        </p>
+      </li>
+
+      <li>
+        suEXEC's PATH environment variable
+
+        <p class="indent">
+          This can be a dangerous thing to change. Make certain
+          every path you include in this define is a
+          <strong>trusted</strong> directory. You don't want to
+          open people up to having someone from across the world
+          running a trojan horse on them.
+        </p>
+      </li>
+
+      <li>
+        Altering the suEXEC code
+
+        <p class="indent">
+          Again, this can cause <strong>Big Trouble</strong> if you
+          try this without knowing what you are doing. Stay away
+          from it if at all possible.
+        </p>
+      </li>
+    </ul>
+
+</div></div>
+<div class="bottomlang">
+<p><span>Available Languages: </span><a href="./en/suexec.html" title="English">&nbsp;en&nbsp;</a> |
+<a href="./fr/suexec.html" hreflang="fr" rel="alternate" title="Fran�ais">&nbsp;fr&nbsp;</a> |
+<a href="./ja/suexec.html" hreflang="ja" rel="alternate" title="Japanese">&nbsp;ja&nbsp;</a> |
+<a href="./ko/suexec.html" hreflang="ko" rel="alternate" title="Korean">&nbsp;ko&nbsp;</a> |
+<a href="./tr/suexec.html" hreflang="tr" rel="alternate" title="T�rk�e">&nbsp;tr&nbsp;</a></p>
+</div><div class="top"><a href="#page-header"><img src="./images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&amp;A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div>
+<script type="text/javascript"><!--//--><![CDATA[//><!--
+var comments_shortname = 'httpd';
+var comments_identifier = 'http://httpd.apache.org/docs/2.4/suexec.html';
+(function(w, d) {
+    if (w.location.hostname.toLowerCase() == "httpd.apache.org") {
+        d.write('<div id="comments_thread"><\/div>');
+        var s = d.createElement('script');
+        s.type = 'text/javascript';
+        s.async = true;
+        s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
+        (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
+    }
+    else { 
+        d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>');
+    }
+})(window, document);
+//--><!]]></script></div><div id="footer">
+<p class="apache">Copyright 2018 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
+<p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!--
+if (typeof(prettyPrint) !== 'undefined') {
+    prettyPrint();
+}
+//--><!]]></script>
+</body></html>
 \ No newline at end of file
diff --git a/docs/manual/suexec.html.fr b/docs/manual/suexec.html.fr
 new file mode 100644
index 0000000..97e7a37
--- /dev/null
+++ b/docs/manual/suexec.html.fr
@@ -0,0 +1,689 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="fr" xml:lang="fr"><head>
+<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" />
+<!--
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+              This file is generated from xml source: DO NOT EDIT
+        XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      -->