[Buildroot] [PATCH] package/apache-utils: new package

[Buildroot] [PATCH] package/apache-utils: new package

[Giulio Benetti]

From: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>

Build htdigest and htpasswd utilities only without building entire Apache
package.

Cc: Jim Reinhart <jimr@tekvox.com>
Cc: James Autry <jautry@tekvox.com>
Cc: Matthew Maron <matthewm@tekvox.com>
Signed-off-by: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
---
 DEVELOPERS                                    |  1 +
 package/Config.in                             |  1 +
 .../apache-utils/0001-nios2_is_not_os2.patch  | 19 ++++++++++
 package/apache-utils/Config.in                | 15 ++++++++
 package/apache-utils/apache-utils.hash        |  5 +++
 package/apache-utils/apache-utils.mk          | 37 +++++++++++++++++++
 6 files changed, 78 insertions(+)
 create mode 100644 package/apache-utils/0001-nios2_is_not_os2.patch
 create mode 100644 package/apache-utils/Config.in
 create mode 100644 package/apache-utils/apache-utils.hash
 create mode 100644 package/apache-utils/apache-utils.mk

diff --git a/DEVELOPERS b/DEVELOPERS
index f0c6f9cb52..806429f433 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -1196,6 +1196,7 @@ F:	configs/freescale_imx6ullevk_defconfig
 F:	configs/imx6ullevk_defconfig
 F:	configs/imxrt1050-evk_defconfig
 F:	configs/olimex_a*
+F:	package/apache-utils/
 F:	package/at/
 F:	package/binutils/
 F:	package/cryptsetup/
diff --git a/package/Config.in b/package/Config.in
index e8dbadadf3..f5c9f9d321 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -2278,6 +2278,7 @@ menu "Networking applications"
 	source "package/alfred/Config.in"
 	source "package/aoetools/Config.in"
 	source "package/apache/Config.in"
+	source "package/apache-utils/Config.in"
 if BR2_PACKAGE_APACHE
 menu "External Apache modules"
 	source "package/modsecurity2/Config.in"
diff --git a/package/apache-utils/0001-nios2_is_not_os2.patch b/package/apache-utils/0001-nios2_is_not_os2.patch
new file mode 100644
index 0000000000..ac9b3fb373
--- /dev/null
+++ b/package/apache-utils/0001-nios2_is_not_os2.patch
@@ -0,0 +1,19 @@
+Fix nios2 detection.
+
+Apache treats nios2 as OS/2.
+
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+Signed-off-by: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
+
+diff -uNr httpd-2.4.12.org/configure.in httpd-2.4.12/configure.in
+--- httpd-2.4.12.org/configure.in	2015-01-22 18:33:07.000000000 +0100
++++ httpd-2.4.12/configure.in	2015-04-02 22:01:32.851102219 +0200
+@@ -268,7 +268,7 @@
+ AC_MSG_NOTICE([])
+ 
+ case $host in
+-  *os2*)
++  *-os2*)
+       # Use a custom made libtool replacement
+       echo "using aplibtool"
+       LIBTOOL="$abs_srcdir/srclib/apr/build/aplibtool"
diff --git a/package/apache-utils/Config.in b/package/apache-utils/Config.in
new file mode 100644
index 0000000000..d83874c9ea
--- /dev/null
+++ b/package/apache-utils/Config.in
@@ -0,0 +1,15 @@
+config BR2_PACKAGE_APACHE_UTILS
+	bool "apache-utils"
+	depends on !BR2_STATIC_LIBS
+	depends on BR2_TOOLCHAIN_HAS_THREADS
+	depends on BR2_USE_MMU # apr
+	select BR2_PACKAGE_APR_UTIL
+	select BR2_PACKAGE_PCRE2
+	help
+	  Apache utilities htdigest and htpasswd
+
+	  https://httpd.apache.org
+
+comment "apache-utils needs a toolchain w/ dynamic library, threads"
+	depends on BR2_USE_MMU
+	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS
diff --git a/package/apache-utils/apache-utils.hash b/package/apache-utils/apache-utils.hash
new file mode 100644
index 0000000000..1f0020f65a
--- /dev/null
+++ b/package/apache-utils/apache-utils.hash
@@ -0,0 +1,5 @@
+# From https://archive.apache.org/dist/httpd/httpd-2.4.57.tar.bz2.{sha256,sha512}
+sha256  dbccb84aee95e095edfbb81e5eb926ccd24e6ada55dcd83caecb262e5cf94d2a  httpd-2.4.57.tar.bz2
+sha512  4d1e0a274ee90bdfb5f38d4a7d73a7367ed1c6388e26280e640014e49abc0df03683705b88dcfe2ec2da313dda4c7b4a3b86daffa1911f58e224eba89d82d155  httpd-2.4.57.tar.bz2
+# Locally computed
+sha256  47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43  LICENSE
diff --git a/package/apache-utils/apache-utils.mk b/package/apache-utils/apache-utils.mk
new file mode 100644
index 0000000000..f632eaec24
--- /dev/null
+++ b/package/apache-utils/apache-utils.mk
@@ -0,0 +1,37 @@
+################################################################################
+#
+# apache-utils
+#
+################################################################################
+
+APACHE_UTILS_VERSION = 2.4.57
+APACHE_UTILS_SOURCE = httpd-$(APACHE_UTILS_VERSION).tar.bz2
+APACHE_UTILS_SITE = https://downloads.apache.org/httpd
+APACHE_UTILS_LICENSE = Apache-2.0
+APACHE_UTILS_LICENSE_FILES = LICENSE
+# We have a patch touching configure.in and Makefile.in,
+# so we need to autoreconf:
+APACHE_UTILS_AUTORECONF = YES
+APACHE_UTILS_DEPENDENCIES = apr apr-util pcre2
+
+APACHE_UTILS_CONF_ENV= \
+	ap_cv_void_ptr_lt_long=no \
+	PCRE_CONFIG=$(STAGING_DIR)/usr/bin/pcre2-config
+
+APACHE_UTILS_CONF_OPTS = \
+	--with-apr=$(STAGING_DIR)/usr \
+	--with-apr-util=$(STAGING_DIR)/usr \
+	--with-pcre=$(STAGING_DIR)/usr/bin/pcre2-config \
+	--with-static-htdigest \
+	--with-static-htpasswd
+
+define APACHE_UTILS_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D)/support htdigest htpasswd
+endef
+
+define APACHE_UTILS_INSTALL_TARGET_CMDS
+	$(INSTALL) -m 0755 -D $(@D)/support/htdigest $(TARGET_DIR)/usr/bin/htdigest
+	$(INSTALL) -m 0755 -D $(@D)/support/htpasswd $(TARGET_DIR)/usr/bin/htpasswd
+endef
+
+$(eval $(autotools-package))
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/apache-utils: new package

[Thomas Petazzoni via buildroot]

Hello Giulio,

On Thu, 14 Sep 2023 21:17:26 +0200
Giulio Benetti <giulio.benetti@benettiengineering.com> wrote:

> From: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
> 
> Build htdigest and htpasswd utilities only without building entire Apache
> package.
> 
> Cc: Jim Reinhart <jimr@tekvox.com>
> Cc: James Autry <jautry@tekvox.com>
> Cc: Matthew Maron <matthewm@tekvox.com>
> Signed-off-by: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>

Thanks for the proposal. I'm always a bit "meh" when it comes to adding
a new package that uses the same source code as another package. It
causes extra maintenance work (you need to update both packages, apply
patches to both, keep tracking of CVEs for both, etc.).

What is the use case for needing this without the Apache server? Can we
change the Apache package to instead allow installing only those tools?

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/apache-utils: new package

[Giulio Benetti]

Hi Thomas,

On 14/09/23 21:49, Thomas Petazzoni wrote:
> Hello Giulio,
> 
> On Thu, 14 Sep 2023 21:17:26 +0200
> Giulio Benetti <giulio.benetti@benettiengineering.com> wrote:
> 
>> From: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
>>
>> Build htdigest and htpasswd utilities only without building entire Apache
>> package.
>>
>> Cc: Jim Reinhart <jimr@tekvox.com>
>> Cc: James Autry <jautry@tekvox.com>
>> Cc: Matthew Maron <matthewm@tekvox.com>
>> Signed-off-by: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
> 
> Thanks for the proposal. I'm always a bit "meh" when it comes to adding
> a new package that uses the same source code as another package. It
> causes extra maintenance work (you need to update both packages, apply
> patches to both, keep tracking of CVEs for both, etc.).

I was unsure if deal with it this way and after searching I've found 
packages uboot and uboot-tools.

> What is the use case for needing this without the Apache server?

I need htdigest to manipulate .htdigest file on target used by SWUpdate
to deal with credentials.

> Can we
> change the Apache package to instead allow installing only those tools?

Yes, I can modify by adding an option to package apache like 
BR2_PACKAGE_APACHE_BUILD_TOOLS_ONLY and then in apache.mk I do like:
ifeq ($(BR2_PACKAGE_APACHE_BUILD_UTILS_ONLY),y)
	what I do in apache-utils package
else
	what it's actually done in apache package
endif

This is because I can't build only htdigest and htpasswd by using
standard autotools-package infrastructure and I need to make specific
targets under $(@D)/support. Otherwise it will try to build(and fail)
to build a part of httpd.

This is what I've found so far, but maybe I can dig deeper and maybe
find a long sequence of:
--disable-a
--disable-b
etc.
to use autotools infrastructure.

Best regards
-- 
Giulio Benetti
CEO&CTO@Benetti Engineering sas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/apache-utils: new package

[Yann E. MORIN]

Giulio, Thomas, All,

On 2023-09-14 22:11 +0200, Giulio Benetti spake thusly:
> On 14/09/23 21:49, Thomas Petazzoni wrote:
> >On Thu, 14 Sep 2023 21:17:26 +0200
> >Giulio Benetti <giulio.benetti@benettiengineering.com> wrote:
> >>From: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
> >>Build htdigest and htpasswd utilities only without building entire Apache
> >>package.
[--SNIP--]
> >Thanks for the proposal. I'm always a bit "meh" when it comes to adding
> >a new package that uses the same source code as another package. It
> >causes extra maintenance work (you need to update both packages, apply
> >patches to both, keep tracking of CVEs for both, etc.).
> I was unsure if deal with it this way and after searching I've found
> packages uboot and uboot-tools.

We can slightly loosen the restrictions for those special packages, like
the kernel or the bootloaders. U-Boot is a bootloader, so deviation is
kinda acceptable (and unavoidable).

> >What is the use case for needing this without the Apache server?
> I need htdigest to manipulate .htdigest file on target used by SWUpdate
> to deal with credentials.

ACK, valid need √ ;-)

> >Can we
> >change the Apache package to instead allow installing only those tools?
> 
> Yes, I can modify by adding an option to package apache like
> BR2_PACKAGE_APACHE_BUILD_TOOLS_ONLY and then in apache.mk I do like:
> ifeq ($(BR2_PACKAGE_APACHE_BUILD_UTILS_ONLY),y)
> 	what I do in apache-utils package
> else
> 	what it's actually done in apache package
> endif

I am not too fond of that, and it is going to be a bit more complex that
that. Indeed, if building only the tools, we don't want to depend on all
the optional dependencies (zlib, lua, brottli...).

And introducing a whole-file ifeq-else-endif block is not much better
than a duplicate package; I even find it worse, because it obfuscate the
package's .mk...

> This is because I can't build only htdigest and htpasswd by using
> standard autotools-package infrastructure and I need to make specific
> targets under $(@D)/support. Otherwise it will try to build(and fail)
> to build a part of httpd.

I think it would be relatively trivial to provide your own htdigest with
a simple shell script:

    #!/bin/sh

    create=false
    if [ "${1}" = "-c" ]; then
        create=true
        shift
    fi
    passwd_file="${1}"
    realm="${2}"
    user="${3}"

    if create; then
        > "${passwd_file}"
    fi
    if ! [ -f "${passwd_file}"; then
        printf 'Could not open passwd file %s for reading.\n' "${passwd_file}"
        printf 'Use -c option to create new one.\n'
        exit 1
    fi >&2

    if grep -q "^${user}:${realm}:" "${passwd_file}"; then
        printf 'Changing password for user %s in realm %s\n' "${user}" "${realm}"
        sed -r -i -e "/^${user}:${realm}:/d" "${passwd_file}"
    else
        printf 'Adding user %s in realm %s\n' "${user}" "${realm}"
    fi
    exec 3>&1
    exec >/dev/null
    printf 'New password: ' >&3
    read -r passwd
    printf 'Re-type new password: ' >&3
    read -r passwd2
    exec >&3
    exec 3>&-
    if [ "${passwd}" != "${passwd2}" ]; then
        printf "They don't match, sorry.\n"
        exit 1
    fi >&2

    hash="$( printf '%s:%s:%s' "${user}" "${realm}" "${passwd}" |md5sum )"
    printf "${user}:${realm}:${hash%  -}" >>"${passwd_file}"

Totally untested, Use at your own risk...

htpasswd is quite a bit more complex, though., so if you really need it,
impersonating it is not going to be easy...

Bottom line: if only htdigest needed, then a script will help (not sure
we'd need such a package in Buildroot, though). Otherwise, I don;t have
a good idea yet...

Regards,
Yann E. MORIN.

> This is what I've found so far, but maybe I can dig deeper and maybe
> find a long sequence of:
> --disable-a
> --disable-b
> etc.
> to use autotools infrastructure.
> 
> Best regards
> -- 
> Giulio Benetti
> CEO&CTO@Benetti Engineering sas
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/apache-utils: new package

[Giulio Benetti]

Hi Yann, Thomas, All,

On 16/09/23 00:17, Yann E. MORIN wrote:
> Giulio, Thomas, All,
> 
> On 2023-09-14 22:11 +0200, Giulio Benetti spake thusly:
>> On 14/09/23 21:49, Thomas Petazzoni wrote:
>>> On Thu, 14 Sep 2023 21:17:26 +0200
>>> Giulio Benetti <giulio.benetti@benettiengineering.com> wrote:
>>>> From: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
>>>> Build htdigest and htpasswd utilities only without building entire Apache
>>>> package.
> [--SNIP--]
>>> Thanks for the proposal. I'm always a bit "meh" when it comes to adding
>>> a new package that uses the same source code as another package. It
>>> causes extra maintenance work (you need to update both packages, apply
>>> patches to both, keep tracking of CVEs for both, etc.).
>> I was unsure if deal with it this way and after searching I've found
>> packages uboot and uboot-tools.
> 
> We can slightly loosen the restrictions for those special packages, like
> the kernel or the bootloaders. U-Boot is a bootloader, so deviation is
> kinda acceptable (and unavoidable).
> 
>>> What is the use case for needing this without the Apache server?
>> I need htdigest to manipulate .htdigest file on target used by SWUpdate
>> to deal with credentials.
> 
> ACK, valid need √ ;-)

I've forgotten to mention that Mongoose requires it for a webpage with
credentials too,

> 
>>> Can we
>>> change the Apache package to instead allow installing only those tools?
>>
>> Yes, I can modify by adding an option to package apache like
>> BR2_PACKAGE_APACHE_BUILD_TOOLS_ONLY and then in apache.mk I do like:
>> ifeq ($(BR2_PACKAGE_APACHE_BUILD_UTILS_ONLY),y)
>> 	what I do in apache-utils package
>> else
>> 	what it's actually done in apache package
>> endif
> 
> I am not too fond of that, and it is going to be a bit more complex that
> that. Indeed, if building only the tools, we don't want to depend on all
> the optional dependencies (zlib, lua, brottli...).
> 
> And introducing a whole-file ifeq-else-endif block is not much better
> than a duplicate package; I even find it worse, because it obfuscate the
> package's .mk...
> 
>> This is because I can't build only htdigest and htpasswd by using
>> standard autotools-package infrastructure and I need to make specific
>> targets under $(@D)/support. Otherwise it will try to build(and fail)
>> to build a part of httpd.
> 
> I think it would be relatively trivial to provide your own htdigest with
> a simple shell script:
> 
>      #!/bin/sh
> 
>      create=false
>      if [ "${1}" = "-c" ]; then
>          create=true
>          shift
>      fi
>      passwd_file="${1}"
>      realm="${2}"
>      user="${3}"
> 
>      if create; then
>          > "${passwd_file}"
>      fi
>      if ! [ -f "${passwd_file}"; then
>          printf 'Could not open passwd file %s for reading.\n' "${passwd_file}"
>          printf 'Use -c option to create new one.\n'
>          exit 1
>      fi >&2
> 
>      if grep -q "^${user}:${realm}:" "${passwd_file}"; then
>          printf 'Changing password for user %s in realm %s\n' "${user}" "${realm}"
>          sed -r -i -e "/^${user}:${realm}:/d" "${passwd_file}"
>      else
>          printf 'Adding user %s in realm %s\n' "${user}" "${realm}"
>      fi
>      exec 3>&1
>      exec >/dev/null
>      printf 'New password: ' >&3
>      read -r passwd
>      printf 'Re-type new password: ' >&3
>      read -r passwd2
>      exec >&3
>      exec 3>&-
>      if [ "${passwd}" != "${passwd2}" ]; then
>          printf "They don't match, sorry.\n"
>          exit 1
>      fi >&2
> 
>      hash="$( printf '%s:%s:%s' "${user}" "${realm}" "${passwd}" |md5sum )"
>      printf "${user}:${realm}:${hash%  -}" >>"${passwd_file}"
> 
> Totally untested, Use at your own risk...

Thank you for the script, but I prefer to use tools already provided and
tested. And htdigest and htpasswd can be useful for other usage in
Buildroot

> htpasswd is quite a bit more complex, though., so if you really need it,
> impersonating it is not going to be easy...
> 
> Bottom line: if only htdigest needed, then a script will help (not sure
> we'd need such a package in Buildroot, though). Otherwise, I don;t have
> a good idea yet...

In the end I've sent a patch[0] for package apache and it looks good to
me. Using autotools is a real mess, so I've moved what I've done for
package apache-utils to package apache checking for option 
BR2_PACKAGE_APACHE_UTILS_ONLY=y

[0]: 
https://patchwork.ozlabs.org/project/buildroot/patch/20230917202539.365838-1-giulio.benetti@benettiengineering.com/

Best regards
-- 
Giulio Benetti
CEO&CTO@Benetti Engineering sas
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot