Merge ~ahasenack/ubuntu/+source/apache2:trusty-apache-authzalias-1529355 into ubuntu/+source/apache2:ubuntu/trusty-devel

[Andreas Hasenack]

Testing instructions are in the SRU template in the linked bug.

This is a simple fix picked up from upstream, with a simple test case.

Bileto ticket and associated ppa: https://bileto.ubuntu.com/#/ticket/3532

(still running)

In the DEP3 section of the patch, I chose to not use an Author header and stick to an Origin one only, because I couldn't find the author's email, just an svn nick and name: "Eric Covener". The patch was committed by someone else. My reading of DEP3 tells me that Origin is sufficient in this case.

[Andreas Hasenack (ahasenack)]

The SVN failure in DEP8 is odd. The svn module postinst fails to run. I can reproduce that locally, but only when autopkgtest is preparing the VM. If I login right after it failed, a simple "sudo apt -f install" retries the postinst and it works then.

I also tried creating a fresh vm and installing the same packages manually with apt, and it doesn't fail there.. I think the only way to catch this is preparing a special svn package with set -x in its postinst and putting that in the same ppa.

[Andreas Hasenack (ahasenack)]

Got something with -x:
Setting up libapache2-mod-svn (1.8.8-1ubuntu3.4~ppa1) ...
+ [ -f /etc/apache2/#enable_authz_svn# ]
+ true
+ [ -e /usr/share/apache2/apache2-maintscript-helper ]
+ . /usr/share/apache2/apache2-maintscript-helper
+ [ -n ]
+ EXPORT_APACHE2_MAINTSCRIPT_HELPER=1
+ [ -n ]
+ [ -e /etc/apache2/envvars ]
+ [ -z configure ]
+ APACHE2_MAINTSCRIPT_NAME=postinst
+ [ postinst ]
+ APACHE2_MAINTSCRIPT_PACKAGE=libapache2-mod-svn
+ [ -z libapache2-mod-svn ]
+ [ -z ]
+ APACHE2_MAINTSCRIPT_METHOD=configure
+ [ -z ]
+ APACHE2_MAINTSCRIPT_ARGUMENT=
+ apache2_invoke enmod dav_svn
+ local CMD=enmod
+ local CONF=dav_svn
+ local RCD_ACTION=
+ local invoke_rcd=0
+ local check_switch=
+ local invoke_string=
+ [ -x /usr/sbin/a2enmod ]
+ [ -x /usr/sbin/a2query ]
+ check_switch=-m
+ invoke_string=module
+ rcd_action=restart
+ local a2query_ret=0
+ a2query -m dav_svn
+ a2query_ret=1
+ [ 1 -eq 0 ]
+ [ 1 -eq 32 ]
+ APACHE2_NEED_ACTION=1
+ a2enmod -m -q dav_svn
+ return 1
+ exit 1
dpkg: error processing package libapache2-mod-svn (--configure):
 subprocess installed post-installation script returned error exit status 1

[Christian Ehrhardt  (paelzer)]

Ack to the Dep-3 choices as it "as good as possible" anyway

Did you confirm if the tests fail the same way before the change that you are introducing?

The Bileto ticket already recycled the test output :-/
http://autopkgtest.ubuntu.com/packages/a/apache2/trusty/amd64 worked just fine all the time, but I assume it is a different test anyway. Which one is it actually?

review: Needs Information

[Andreas Hasenack (ahasenack)]

A bit more debugging:
+ apache2_invoke enmod dav_svn
+ local CMD=enmod
+ local CONF=dav_svn
+ local RCD_ACTION=
+ local invoke_rcd=0
+ local check_switch=
+ local invoke_string=
+ [ -x /usr/sbin/a2enmod ]
+ [ -x /usr/sbin/a2query ]
+ check_switch=-m
+ invoke_string=module
+ rcd_action=restart
+ local a2query_ret=0
+ a2query -m dav_svn
No module matches dav_svn
+ a2query_ret=1
+ [ 1 -eq 0 ]
+ [ 1 -eq 32 ]
+ APACHE2_NEED_ACTION=1
+ a2enmod -m dav_svn
ERROR: Module dav does not exist!
ERROR: Could not enable dependency dav for dav_svn, aborting
Considering dependency dav for dav_svn:
+ return 1
+ exit 1
dpkg: error processing package libapache2-mod-svn (--configure):
 subprocess installed post-installation script returned error exit status 1

[Andreas Hasenack (ahasenack)]

The same failure happens in the subversion dep8 tests without my changes to apache, i.e., a plain trusty run:

autopkgtest -o dep8-svn-orig -U -s -B subversion -- qemu /var/lib/adt-images/autopkgtest-trusty-amd64.img

Somehow the ordering is different when the test dependencies are installed by autopkgtest than when I install them with "apt-get" in a trusty vm.

[Andreas Hasenack (ahasenack)]

Fun:
From http://autopkgtest.ubuntu.com/packages/s/subversion/trusty/amd64

https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-trusty/trusty/amd64/s/subversion/20180621_103800_1e336@/log.gz

That also shows the error:
Setting up libapache2-mod-svn (1.8.8-1ubuntu3.3) ...
dpkg: error processing package libapache2-mod-svn (--configure):
 subprocess installed post-installation script returned error exit status 1

But it is retried somehow?
autopkgtest: WARNING: Test dependencies are unsatisfiable with using apt pinning. Retrying with using all packages from trusty-proposed

Must be a feature that bileto doesn't have.

[Christian Ehrhardt  (paelzer)]

We discussed the tests retrying the same issue it seems on the INFRA.
Since this was our only remaining blocker +1 this MP

review: Approve

[Andreas Hasenack (ahasenack)]

retested, tagged and uploaded, thanks

diff --git a/debian/changelog b/debian/changelog
index 4829dab..91a6c59 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+apache2 (2.4.7-1ubuntu4.21) trusty; urgency=medium
+
+  * d/p/AuthzProviderAlias-visibility.patch: Allow <AuthzProviderAlias>'es
+    to be seen from auth stanzas under virtual hosts (LP: #1529355)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 23 Nov 2018 17:45:20 -0200
+
 apache2 (2.4.7-1ubuntu4.20) trusty-security; urgency=medium
 
   * SECURITY UPDATE: DoS via missing header with AuthLDAPCharsetConfig
diff --git a/debian/patches/AuthzProviderAlias-visibility.patch b/debian/patches/AuthzProviderAlias-visibility.patch
new file mode 100644
index 0000000..960d4f8
--- /dev/null
+++ b/debian/patches/AuthzProviderAlias-visibility.patch
@@ -0,0 +1,32 @@
+Description: Fix AuthzProviderAlias's visibility
+ Allow <AuthzProviderAlias>'es to be seen from auth stanzas under virtual hosts
+Origin: https://github.com/apache/httpd/commit/4f06dd51b464b66f956ae577f068b16486d3920b
+Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=56870
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1529355
+Last-Update: 2018-11-23
+
+--- a/modules/aaa/mod_authz_core.c
++++ b/modules/aaa/mod_authz_core.c
+@@ -168,6 +168,13 @@
+     return (void*)conf;
+ }
+ 
++/* Only per-server directive we have is GLOBAL_ONLY */
++static void *merge_authz_core_svr_config(apr_pool_t *p,
++                                         void *basev, void *newv)
++{
++    return basev;
++}
++
+ static void *create_authz_core_svr_config(apr_pool_t *p, server_rec *s)
+ {
+     authz_core_srv_conf *authcfg;
+@@ -1140,7 +1147,7 @@
+     create_authz_core_dir_config,   /* dir config creater */
+     merge_authz_core_dir_config,    /* dir merger */
+     create_authz_core_svr_config,   /* server config */
+-    NULL,                           /* merge server config */
++    merge_authz_core_svr_config ,   /* merge server config */
+     authz_cmds,
+     register_hooks                  /* register hooks */
+ };
diff --git a/debian/patches/series b/debian/patches/series
index c06980d..b922bf3 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -44,3 +44,4 @@ CVE-2018-1283.patch
 CVE-2018-1301.patch
 CVE-2018-1303.patch
 CVE-2018-1312.patch
+AuthzProviderAlias-visibility.patch