diff --git a/00-base.conf b/00-base.conf index 28dacb3..7cabce0 100644 --- a/00-base.conf +++ b/00-base.conf @@ -55,6 +55,7 @@ LoadModule slotmem_plain_module modules/mod_slotmem_plain.so LoadModule slotmem_shm_module modules/mod_slotmem_shm.so LoadModule socache_dbm_module modules/mod_socache_dbm.so LoadModule socache_memcache_module modules/mod_socache_memcache.so +LoadModule socache_redis_module modules/mod_socache_redis.so LoadModule socache_shmcb_module modules/mod_socache_shmcb.so LoadModule status_module modules/mod_status.so LoadModule substitute_module modules/mod_substitute.so diff --git a/httpd-2.4.33-sslciphdefault.patch b/httpd-2.4.33-sslciphdefault.patch deleted file mode 100644 index f2919b8..0000000 --- a/httpd-2.4.33-sslciphdefault.patch +++ /dev/null @@ -1,33 +0,0 @@ - -https://bugzilla.redhat.com/show_bug.cgi?id=1109119 - -Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite. - ---- httpd-2.4.33/modules/ssl/ssl_engine_config.c.sslciphdefault -+++ httpd-2.4.33/modules/ssl/ssl_engine_config.c -@@ -758,8 +758,10 @@ - SSLSrvConfigRec *sc = mySrvConfig(cmd->server); - SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; - -- /* always disable null and export ciphers */ -- arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); -+ /* Disable null and export ciphers by default, except for PROFILE= -+ * configs where the parser doesn't cope. */ -+ if (strncmp(arg, "PROFILE=", 8) != 0) -+ arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); - - if (cmd->path) { - dc->szCipherSuite = arg; -@@ -1502,8 +1504,10 @@ - { - SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg; - -- /* always disable null and export ciphers */ -- arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); -+ /* Disable null and export ciphers by default, except for PROFILE= -+ * configs where the parser doesn't cope. */ -+ if (strncmp(arg, "PROFILE=", 8) != 0) -+ arg = apr_pstrcat(cmd->pool, arg, ":!aNULL:!eNULL:!EXP", NULL); - - dc->proxy->auth.cipher_suite = arg; - diff --git a/httpd-2.4.34-sslciphdefault.patch b/httpd-2.4.34-sslciphdefault.patch new file mode 100644 index 0000000..6060f24 --- /dev/null +++ b/httpd-2.4.34-sslciphdefault.patch @@ -0,0 +1,34 @@ + +https://bugzilla.redhat.com/show_bug.cgi?id=1109119 + +Don't prepend !aNULL etc if PROFILE= is used with SSLCipherSuite. + +--- httpd-2.4.34/modules/ssl/ssl_engine_config.c.sslciphdefault ++++ httpd-2.4.34/modules/ssl/ssl_engine_config.c +@@ -774,9 +774,11 @@ + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + if (cmd->path) { ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->szCipherSuite = arg2; + } + else { +@@ -1540,8 +1542,10 @@ + } + + if (!strcmp("SSL", arg1)) { +- /* always disable null and export ciphers */ +- arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); ++ /* Disable null and export ciphers by default, except for PROFILE= ++ * configs where the parser doesn't cope. */ ++ if (strncmp(arg2, "PROFILE=", 8) != 0) ++ arg2 = apr_pstrcat(cmd->pool, arg2, ":!aNULL:!eNULL:!EXP", NULL); + dc->proxy->auth.cipher_suite = arg2; + return NULL; + } diff --git a/httpd-2.4.37-r1857129.patch b/httpd-2.4.37-r1857129.patch new file mode 100644 index 0000000..4dbf05a --- /dev/null +++ b/httpd-2.4.37-r1857129.patch @@ -0,0 +1,65 @@ +# ./pullrev.sh 1857129 +http://svn.apache.org/viewvc?view=revision&revision=1857129 + +--- httpd-2.4.37/modules/filters/mod_reqtimeout.c ++++ httpd-2.4.37/modules/filters/mod_reqtimeout.c +@@ -31,7 +31,7 @@ + #define UNSET -1 + #define MRT_DEFAULT_handshake_TIMEOUT 0 /* disabled */ + #define MRT_DEFAULT_handshake_MAX_TIMEOUT 0 +-#define MRT_DEFAULT_handshake_MIN_RATE APR_INT32_MAX ++#define MRT_DEFAULT_handshake_MIN_RATE 0 + #define MRT_DEFAULT_header_TIMEOUT 20 + #define MRT_DEFAULT_header_MAX_TIMEOUT 40 + #define MRT_DEFAULT_header_MIN_RATE 500 +@@ -220,7 +220,7 @@ + if (block == APR_NONBLOCK_READ || mode == AP_MODE_INIT + || mode == AP_MODE_EATCRLF) { + rv = ap_get_brigade(f->next, bb, mode, block, readbytes); +- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS) { ++ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS) { + extend_timeout(ccfg, bb); + } + return rv; +@@ -254,7 +254,7 @@ + } + + if (!APR_BRIGADE_EMPTY(bb)) { +- if (ccfg->cur_stage.rate_factor > 0) { ++ if (ccfg->cur_stage.rate_factor) { + extend_timeout(ccfg, bb); + } + +@@ -315,7 +315,7 @@ + * the real (relevant) bytes to be asked later, within the + * currently alloted time. + */ +- if (ccfg->cur_stage.rate_factor > 0 && rv == APR_SUCCESS ++ if (ccfg->cur_stage.rate_factor && rv == APR_SUCCESS + && mode != AP_MODE_SPECULATIVE) { + extend_timeout(ccfg, bb); + } +@@ -638,17 +638,17 @@ + ap_hook_post_read_request(reqtimeout_before_body, NULL, NULL, + APR_HOOK_MIDDLE); + +-#if MRT_DEFAULT_HANDSHAKE_MIN_RATE > 0 ++#if MRT_DEFAULT_handshake_MIN_RATE + default_handshake_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_HANDSHAKE_MIN_RATE; ++ MRT_DEFAULT_handshake_MIN_RATE; + #endif +-#if MRT_DEFAULT_HEADER_MIN_RATE > 0 ++#if MRT_DEFAULT_header_MIN_RATE + default_header_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_HEADER_MIN_RATE; ++ MRT_DEFAULT_header_MIN_RATE; + #endif +-#if MRT_DEFAULT_BODY_MIN_RATE > 0 ++#if MRT_DEFAULT_body_MIN_RATE + default_body_rate_factor = apr_time_from_sec(1) / +- MRT_DEFAULT_BODY_MIN_RATE; ++ MRT_DEFAULT_body_MIN_RATE; + #endif + } + diff --git a/httpd-2.4.37-sslprotdefault.patch b/httpd-2.4.37-sslprotdefault.patch new file mode 100644 index 0000000..546fa1f --- /dev/null +++ b/httpd-2.4.37-sslprotdefault.patch @@ -0,0 +1,98 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index 55c237e..5467d23 100644 +--- a/modules/ssl/ssl_engine_config.c ++++ b/modules/ssl/ssl_engine_config.c +@@ -119,7 +119,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p) + mctx->ticket_key = NULL; + #endif + +- mctx->protocol = SSL_PROTOCOL_DEFAULT; ++ mctx->protocol = SSL_PROTOCOL_NONE; + mctx->protocol_set = 0; + + mctx->pphrase_dialog_type = SSL_PPTYPE_UNSET; +@@ -262,6 +262,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p, + { + if (add->protocol_set) { + mrg->protocol = add->protocol; ++ mrg->protocol_set = 1; + } + else { + mrg->protocol = base->protocol; +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index e3f62fe..31fc0e6 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -568,6 +568,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + MODSSL_SSL_METHOD_CONST SSL_METHOD *method = NULL; + char *cp; + int protocol = mctx->protocol; ++ int protocol_set = mctx->protocol_set; + SSLSrvConfigRec *sc = mySrvConfig(s); + #if OPENSSL_VERSION_NUMBER >= 0x10100000L + int prot; +@@ -577,12 +578,18 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + * Create the new per-server SSL context + */ + if (protocol == SSL_PROTOCOL_NONE) { +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); +- } ++ if (protocol_set) { ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02231) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + +- cp = apr_pstrcat(p, ++ ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, ++ "Using OpenSSL/system default SSL/TLS protocols"); ++ cp = "default"; ++ } ++ else { ++ cp = apr_pstrcat(p, + #ifndef OPENSSL_NO_SSL3 + (protocol & SSL_PROTOCOL_SSLV3 ? "SSLv3, " : ""), + #endif +@@ -595,7 +602,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + #endif + #endif + NULL); +- cp[strlen(cp)-2] = NUL; ++ cp[strlen(cp)-2] = NUL; ++ } + + ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, + "Creating new SSL context (protocols: %s)", cp); +@@ -696,13 +704,15 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + #endif + } else { +- SSL_CTX_free(ctx); +- mctx->ssl_ctx = NULL; +- ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) +- "No SSL protocols available [hint: SSLProtocol]"); +- return ssl_die(s); ++ if (protocol_set) { ++ SSL_CTX_free(ctx); ++ mctx->ssl_ctx = NULL; ++ ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(03378) ++ "No SSL protocols available [hint: SSLProtocol]"); ++ return ssl_die(s); ++ } + } +- SSL_CTX_set_max_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_max_proto_version(ctx, prot); + + /* Next we scan for the minimal protocol version we should provide, + * but we do not allow holes between max and min */ +@@ -726,7 +736,7 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s, + prot = SSL3_VERSION; + } + #endif +- SSL_CTX_set_min_proto_version(ctx, prot); ++ if (protocol != SSL_PROTOCOL_NONE) SSL_CTX_set_min_proto_version(ctx, prot); + #endif /* if OPENSSL_VERSION_NUMBER < 0x10100000L */ + + #ifdef SSL_OP_CIPHER_SERVER_PREFERENCE diff --git a/httpd-2.4.33-r1830819+.patch b/httpd-2.4.38-r1830819+.patch similarity index 93% rename from httpd-2.4.33-r1830819+.patch rename to httpd-2.4.38-r1830819+.patch index 0b2d90d..7df5ff6 100644 --- a/httpd-2.4.33-r1830819+.patch +++ b/httpd-2.4.38-r1830819+.patch @@ -9,9 +9,11 @@ http://svn.apache.org/viewvc?view=revision&revision=1831173 http://svn.apache.org/viewvc?view=revision&revision=1835240 http://svn.apache.org/viewvc?view=revision&revision=1835242 ---- httpd-2.4.33/modules/ssl/ssl_engine_config.c.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_engine_config.c -@@ -891,7 +891,9 @@ +diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c +index d276fea..5467d23 100644 +--- httpd-2.4.38/modules/ssl/ssl_engine_config.c.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_engine_config.c +@@ -916,7 +916,9 @@ SSLSrvConfigRec *sc = mySrvConfig(cmd->server); const char *err; @@ -22,7 +24,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 return err; } -@@ -907,7 +909,9 @@ +@@ -932,7 +934,9 @@ SSLSrvConfigRec *sc = mySrvConfig(cmd->server); const char *err; @@ -33,9 +35,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 return err; } ---- httpd-2.4.33/modules/ssl/ssl_engine_init.c.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_engine_init.c -@@ -1181,12 +1182,18 @@ +--- httpd-2.4.38/modules/ssl/ssl_engine_init.c.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_engine_init.c +@@ -1228,12 +1228,18 @@ (certfile = APR_ARRAY_IDX(mctx->pks->cert_files, i, const char *)); i++) { @@ -55,7 +57,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 if ((SSL_CTX_use_certificate_file(mctx->ssl_ctx, certfile, SSL_FILETYPE_PEM) < 1)) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02561) -@@ -1215,12 +1222,46 @@ +@@ -1262,12 +1268,46 @@ ERR_clear_error(); @@ -107,7 +109,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 const unsigned char *ptr; ERR_clear_error(); -@@ -1307,8 +1348,9 @@ +@@ -1354,8 +1394,9 @@ /* * Try to read DH parameters from the (first) SSLCertificateFile */ @@ -119,7 +121,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams); ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540) "Custom DH parameters (%d bits) for %s loaded from %s", -@@ -1320,10 +1362,10 @@ +@@ -1367,10 +1408,10 @@ /* * Similarly, try to read the ECDH curve name from SSLCertificateFile... */ @@ -134,42 +136,27 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey); ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02541) "ECDH curve %s for %s specified in %s", ---- httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_engine_pphrase.c -@@ -143,9 +143,6 @@ +--- httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_engine_pphrase.c +@@ -143,8 +143,6 @@ const char *key_id = asn1_table_vhost_key(mc, p, sc->vhost_id, idx); EVP_PKEY *pPrivateKey = NULL; ssl_asn1_t *asn1; - unsigned char *ucp; - long int length; -- BOOL bReadable; int nPassPhrase = (*pphrases)->nelts; int nPassPhraseRetry = 0; apr_time_t pkey_mtime = 0; -@@ -222,16 +219,12 @@ +@@ -221,7 +219,7 @@ * is not empty. */ ERR_clear_error(); -- bReadable = ((pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, -- NULL, ssl_pphrase_Handle_CB, &ppcb_arg)) != NULL ? -- TRUE : FALSE); -- -- /* -- * when the private key file now was readable, -- * it's fine and we go out of the loop -- */ -- if (bReadable) -- break; +- pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, NULL, + pPrivateKey = modssl_read_privatekey(ppcb_arg.pkey_file, -+ ssl_pphrase_Handle_CB, &ppcb_arg); -+ /* If the private key was successfully read, nothing more to -+ do here. */ -+ if (pPrivateKey != NULL) -+ break; - - /* - * when we have more remembered pass phrases -@@ -356,19 +349,12 @@ + ssl_pphrase_Handle_CB, &ppcb_arg); + /* If the private key was successfully read, nothing more to + do here. */ +@@ -351,19 +349,12 @@ nPassPhrase++; } @@ -192,7 +179,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 asn1->source_mtime = pkey_mtime; } -@@ -619,3 +605,288 @@ +@@ -614,3 +605,288 @@ */ return (len); } @@ -481,9 +468,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 + return APR_SUCCESS; +} +#endif ---- httpd-2.4.33/modules/ssl/ssl_private.h.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_private.h -@@ -976,21 +976,28 @@ +--- httpd-2.4.38/modules/ssl/ssl_private.h.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_private.h +@@ -1002,21 +1002,28 @@ apr_status_t ssl_load_encrypted_pkey(server_rec *, apr_pool_t *, int, const char *, apr_array_header_t **); @@ -521,7 +508,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 /** Mutex Support */ int ssl_mutex_init(server_rec *, apr_pool_t *); -@@ -1078,6 +1085,10 @@ +@@ -1109,6 +1116,10 @@ int ssl_is_challenge(conn_rec *c, const char *servername, X509 **pcert, EVP_PKEY **pkey); @@ -532,9 +519,9 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 #endif /* SSL_PRIVATE_H */ /** @} */ ---- httpd-2.4.33/modules/ssl/ssl_util.c.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_util.c -@@ -181,45 +181,37 @@ +--- httpd-2.4.38/modules/ssl/ssl_util.c.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_util.c +@@ -192,45 +192,37 @@ return TRUE; } @@ -596,7 +583,7 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 } ssl_asn1_t *ssl_asn1_table_get(apr_hash_t *table, -@@ -469,3 +461,13 @@ +@@ -480,3 +472,13 @@ } #endif /* #if APR_HAS_THREADS && MODSSL_USE_OPENSSL_PRE_1_1_API */ @@ -610,8 +597,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 + return 0; +#endif +} ---- httpd-2.4.33/modules/ssl/ssl_util_ssl.c.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_util_ssl.c +--- httpd-2.4.38/modules/ssl/ssl_util_ssl.c.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_util_ssl.c @@ -74,7 +74,7 @@ ** _________________________________________________________________ */ @@ -672,8 +659,8 @@ http://svn.apache.org/viewvc?view=revision&revision=1835242 /* _________________________________________________________________ ** ** Smart shutdown ---- httpd-2.4.33/modules/ssl/ssl_util_ssl.h.r1830819+ -+++ httpd-2.4.33/modules/ssl/ssl_util_ssl.h +--- httpd-2.4.38/modules/ssl/ssl_util_ssl.h.r1830819+ ++++ httpd-2.4.38/modules/ssl/ssl_util_ssl.h @@ -64,8 +64,11 @@ void modssl_init_app_data2_idx(void); void *modssl_get_app_data2(SSL *); diff --git a/httpd.spec b/httpd.spec index c90d5c5..672436b 100644 --- a/httpd.spec +++ b/httpd.spec @@ -12,8 +12,8 @@ Summary: Apache HTTP Server Name: httpd -Version: 2.4.34 -Release: 3%{?dist} +Version: 2.4.39 +Release: 1.1%{?dist} URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: index.html @@ -72,13 +72,15 @@ Patch29: httpd-2.4.33-systemd.patch Patch30: httpd-2.4.4-cachehardmax.patch Patch31: httpd-2.4.33-sslmultiproxy.patch Patch34: httpd-2.4.17-socket-activation.patch -Patch35: httpd-2.4.33-sslciphdefault.patch -Patch36: httpd-2.4.33-r1830819+.patch +Patch35: httpd-2.4.34-sslciphdefault.patch +Patch36: httpd-2.4.38-r1830819+.patch +Patch37: httpd-2.4.37-sslprotdefault.patch # Bug fixes # https://bugzilla.redhat.com/show_bug.cgi?id=1397243 Patch58: httpd-2.4.34-r1738878.patch Patch59: httpd-2.4.34-r1555631.patch +Patch61: httpd-2.4.37-r1857129.patch # Security fixes @@ -234,9 +236,11 @@ interface for storing and accessing per-user session data. %patch34 -p1 -b .socketactivation %patch35 -p1 -b .sslciphdefault %patch36 -p1 -b .r1830819+ +%patch37 -p1 -b .sslprotdefault %patch58 -p1 -b .r1738878 -%patch59 -p1 -b .r1555631 +#%patch59 -p1 -b .r1555631 +%patch61 -p1 -b .r1857129 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -725,6 +729,15 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri May 3 2019 Joe Orton - 2.4.39-1.1 +- mod_reqtimeout: fix default values regression (PR 63325) + +* Tue Apr 02 2019 Lubos Uhliarik - 2.4.39-1 +- new version 2.4.39 + +* Mon Nov 26 2018 Lubos Uhliarik - 2.4.34-4 +- Resolves: #1652678 - TLS connection allowed while all protocols are forbidden + * Fri Jul 20 2018 Joe Orton - 2.4.34-3 - mod_ssl: fix OCSP regression (upstream r1555631) diff --git a/sources b/sources index 1840642..248974a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (httpd-2.4.34.tar.bz2) = 2bc09213f08a4722e305929fbac5f5060c7a8444704494894bb9b61f17e4d20bb6e3d663bb93fc5b2030b04a43fb12373d260cc291422b210b299725aaf3b5c8 +SHA512 (httpd-2.4.39.tar.bz2) = 9742202040b3dc6344b301540f54b2d3f8e36898410d24206a7f8dcecb1bea7d7230fabc7256752724558af249facf64bffe2cf678b8f7cccb64076737abfda7