1.9.4 on RHEL 7 (httpd version difficulties)

[Morin, Monique Marlene]

Hello,

Goal is to install Subversion 1.9.4 from source on a RHEL 7 system.

Subversion configure script (checks for and) is complaining of httpd version 2.4.6 that ships as part of RHEL 7 (

httpd-2.4.6-40.el7_2.4.x86_64), thus install is prevented.

"configure: error: Apache httpd version 2.4.6 includes a broken mod_dav; use a newer version of httpd"

Any suggestions?

Thanks!

[Branko Čibej]

'configure --help' is your friend:

--enable-apache-whitelist=VER
Whitelist a particular Apache version number,
typically used to enable the use of a old version
patched by a distribution.


But be aware that if the RHEL 7 version of httpd is *not* patched, your
SVN server will be broken in subtle ways.

I really have no idea how to check that.


-- Brane

[Daniel Shahaf]

Branko Čibej wrote on Sat, Sep 17, 2016 at 03:29:25 +0200:
> But be aware that if the RHEL 7 version of httpd is *not* patched, your
> SVN server will be broken in subtle ways.
>
> I really have no idea how to check that.

I believe the relevant change is this:

https://svn.apache.org/repos/asf/httpd/httpd/tags/2.4.7/CHANGES
*) mod_dav: dav_resource->uri is treated as unencoded. This was an
unnecessary ABI changed introduced in 2.4.6. PR 55397.

[Nico Kadel-Garcia]

On Fri, Sep 16, 2016 at 9:29 PM, Branko Čibej <br...@apache.org> wrote:
> On 16.09.2016 19:39, Morin, Monique Marlene wrote:
>>
>> Hello,
>>
>>
>> Goal is to install Subversion 1.9.4 from source on a RHEL 7 system.

I've some unmaintained SRPM bundling work at
https://github.com/nkadel/subversion-1.8.x-srpm which may help you
build actual RPM's.

>> Subversion configure script (checks for and) is complaining of httpd
>> version 2.4.6 that ships as part of RHEL 7 (
>>
>> httpd-2.4.6-40.el7_2.4.x86_64), thus install is prevented.
>>
>>
>> "configure: error: Apache httpd version 2.4.6 includes a broken
>> mod_dav; use a newer version of httpd"
>>
>> Any suggestions?
>>
>
> 'configure --help' is your friend:
>
> --enable-apache-whitelist=VER
> Whitelist a particular Apache version number,
> typically used to enable the use of a old version
> patched by a distribution.
>
>
> But be aware that if the RHEL 7 version of httpd is *not* patched, your
> SVN server will be broken in subtle ways.
>
> I really have no idea how to check that.

You can also check the patches for CentOS or RHEL 7 at
https://git.centos.org/, or look in more depth at
https://git.centos.org/summary/rpms!httpd.git

The interface there is still pretty poor: you're actually better off
grabbing the SRPM's at https://vault.centos.org/.

[Zdenek Sedlak]

Hi,

I opened a support case @ Red Hat. Hopefully Red Hat will be willing to back-port this change back to 2.4.6, as this may affect more product relying on DAV.

//Zdenek

[Nico Kadel-Garcia]

You can also dump the whole problem and switch to svn+ssh based
access. I've been a firm supporter of that for years. The default
behavor of the HTTP clients to store passwords in plain text in
$HOME/.subversion/ has been one of my big reasons to recommend against
HTTPS access. And avoiding the possible detrimental behavior of HTTP
or HTTPS proxies is also helpful. There's nothing like being in a
hotel room that says "free wifi!!" and finding out that you have to
register on the local wifi before you can use it, and it *keeps timing
out and forcing a re-registration" right in the midst of publishing
commits upstream.

[Zdenek Sedlak]

Hi,

could any one check if this fixed the problem? https://bugzilla.redhat.com/show_bug.cgi?id=1235383

Or at least point me at something I can test by myself.

Should be fixed in httpd-2.4.6-39 or greater.

//Zdenek

[Zdenek Sedlak]

How I can test if the Subversion 1.9.4 works correctly on RHEL 7? Red Hat stated that the bug should be fixed since httpd-2.4.6-39, but I need to confirm that.

Thanks!

//Zdenek

[Daniel Shahaf]

Zdenek Sedlak wrote on Fri, Sep 30, 2016 at 15:46:07 +0200:
> How I can test if the Subversion 1.9.4 works correctly on RHEL 7? Red
> Hat stated that the bug should be fixed since httpd-2.4.6-39, but I need
> to confirm that.

Try:

cd subversion/tests/cmdline && ./davautocheck.sh basic special_paths_in_repos --bin=${PREFIX}/bin

That runs a single regression test; that test is annotated as expected
to fail when run against a mod_dav that doesn't have the PR55397 fix.

When you run that, "PASS" in green or "XPASS" in red means you don't
have the bug, and "XFAIL" in green or "FAIL" in red means you have the
bug. ${PREFIX} is whatever you passed to configure --prefix, default
/usr/local.

This requires Python 2.7.

Cheers,

Daniel

[Zdenek Sedlak]

Thanks David, I will test it and reply on this list...

//Zdenek

[Zdenek Sedlak]

On 2016-09-30 17:00, Daniel Shahaf wrote:

Well, this is what I got - looks good.

Test VM is CentOS 7.2.1511 x64, HTTPd 2.4.6-40.el7


# APACHE_MPM=event ./davautocheck.sh basic special_paths_in_repos
davautocheck.sh: Using '/usr/bin/apxs'...
davautocheck.sh: Using '/usr/bin/htpasswd'...
davautocheck.sh: Monolithic Auth module not found. Assuming we run against Apache 2.1+
davautocheck.sh: Found modules for Apache 2.3.0+
Stopping previous HTTPD instance...httpd (no pid file) not running

davautocheck.sh: Using directory '/home/vzdse/dev/subversion-1.9.4/subversion/tests/cmdline/httpd-20161004-132305'...
davautocheck.sh: Adding users for lock authentication
Adding password for user jrandom
Adding password for user jconstant
Adding password for user __dumpster__
Adding password for user JRANDOM
Adding password for user JCONSTANT
davautocheck.sh: Adding groups for mod_authz_svn tests
Syntax OK
davautocheck.sh: HTTPD started and listening on 'http://localhost:3691'...
davautocheck.sh: HTTPD is good
davautocheck.sh: starting the tests...
davautocheck.sh: Using default dav library
PASS:  basic_tests.py 38: use folders with names like 'c:hi'
0.72user 1.15system 0:24.29elapsed 7%CPU (0avgtext+0avgdata 13860maxresident)k
0inputs+2480outputs (0major+486764minor)pagefaults 0swaps
davautocheck.sh: Finished testing...
davautocheck.sh: Browse server access log (y/n)? [n]
davautocheck.sh: Browse server error log (y/n)? [n]
davautocheck.sh: Delete HTTPD root directory (y/n)? [y]
davautocheck.sh: Done

//Zdenek