Packages with httpd needs - Debian

This is a discussion on Packages with httpd needs - Debian ; Dear list, as I do not know, where to write, as there is no debian-packages, I will try it here. Well, I wondered, whenever an application needs a http-demon (for example phpgroupware, egroupware, prelude and many others), all packages force ...

+ Reply to Thread
Results 1 to 14 of 14

Thread: Packages with httpd needs

  1. Packages with httpd needs

    Dear list,

    as I do not know, where to write, as there is no debian-packages, I will try
    it here.

    Well, I wondered, whenever an application needs a http-demon (for example
    phpgroupware, egroupware, prelude and many others), all packages force to
    install apache. There is no way, to get rid of this. As we say "Small is
    beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    install mighty apache ! A simple http demon (I prefer thttpd) would do the
    same but would be more secure.

    So it would be nice, if all maintainers could build the packages, with an "OR"
    opoortunity like "recommended apache or thttpd or whatevereslse" , so the
    user could choose, which http-demon he would like to use.

    Doing so, this would be another step to security.

    I would be pleased, if this input will be discussed among the developers or
    those, who build packages.

    Thank you for reading this mail !

    Cheers

    Hans


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  2. Re: Packages with httpd needs

    Hans-J. Ullrich wrote:
    > Dear list,
    >
    > Well, I wondered, whenever an application needs a http-demon (for example
    > phpgroupware, egroupware, prelude and many others), all packages force to
    > install apache. There is no way, to get rid of this. As we say "Small is
    > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need,to
    > install mighty apache !


    Many of the lower level packages concerned use apache modules to do some
    of the tasks. Alternatives would need to be found for those because the
    apache2 modules will not work with a different server. Probably the best
    starting point is working out whether packages that use
    libapache2-mod-php5, libapache2-mod-perl2 or libapache2-mod-python could
    use libfoo-mod-bar instead and then work the alternatives into the
    dependency chain at that point. It would be a slow process - it is not
    as simple as you may think.

    > So it would be nice, if all maintainers could build the packages, with an "OR"
    > opoortunity like "recommended apache or thttpd or whatevereslse" , so the
    > user could choose, which http-demon he would like to use.


    There's no point offering an alternative httpd if the package has not
    been tested with the alternative - let alone the other reverse
    dependencies. If you are willing to do the testing and show that X
    package can work with an alternative httpd, file a wishlist bug against
    the package asking for the alternative.

    This kind of thing needs someone to do the testing and development - are
    you volunteering?

    --


    Neil Williams
    =============
    http://www.data-freedom.org/
    http://www.nosoftwarepatents.com/
    http://www.linux.codehelp.co.uk/



    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFHTGP2iAEJSii8s+MRAiEfAJsFJWgdgfpZilCo+hziqQ 4IpTjeHACggzvv
    aZpT1agKlh9O9mzbeOYHPEE=
    =tTXF
    -----END PGP SIGNATURE-----


  3. Re: Packages with httpd needs

    * Hans-J. Ullrich [Tue, 27 Nov 2007 15:24:59 +0100]:

    > Dear list,


    Hello Hans. If you verify that a given package can actually work with
    some HTTP server that is not apache, and the depends line of that
    package is like "Depends: apache" instead of "Depends: apache | httpd",
    please by all means file a bug asking for the "| httpd" bit to be added.

    Just for the record, it seems we have 64 packages that depend on apache
    but are not an apache module without an alternative dependency on httpd,
    versus 82 that have such alternative. But many of those 64 will be
    "false positives".

    (grep-available -FDepends apache -a --not -FPackage apache -a --not -FDepends 'httpd' -c)

    Let me repeat, please only file bugs when there's proof or reasonable
    ground to believe that the package will work with non-apache servers.

    Cheers,

    --
    Adeodato Simó dato at net.com.org.es
    Debian Developer adeodato at debian.org

    He who has not a good memory should never take upon himself the trade of lying.
    -- Michel de Montaigne


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  4. Re: Packages with httpd needs

    Am Dienstag, 27. November 2007 schrieb Adeodato Simó:
    > * Hans-J. Ullrich [Tue, 27 Nov 2007 15:24:59 +0100]:
    > > Dear list,

    >
    > Hello Hans. If you verify that a given package can actually work with
    > some HTTP server that is not apache, and the depends line of that
    > package is like "Depends: apache" instead of "Depends: apache | httpd",
    > please by all means file a bug asking for the "| httpd" bit to be added.
    >
    > Just for the record, it seems we have 64 packages that depend on apache
    > but are not an apache module without an alternative dependency on httpd,
    > versus 82 that have such alternative. But many of those 64 will be
    > "false positives".
    >
    > (grep-available -FDepends apache -a --not -FPackage apache -a --not
    > -FDepends 'httpd' -c)
    >
    > Let me repeat, please only file bugs when there's proof or reasonable
    > ground to believe that the package will work with non-apache servers.
    >
    > Cheers,


    Yes, I understand. Well, I do not expect, all packages now to be changed. My
    intention with my mail was to beg maintainers to take a look, when they will
    build packages (in the future) or newer versions, if it might be able to use
    alternatives to apache2.

    Of course, it might be no problem for me, to change dependencies within a
    package by me, but an update would change this back.

    And I hope, maybe some developers are thinking like me and things will change
    in the future. Please define my mail just as a wish and a feedback to ALL
    maintainers and the securityteam, too, in some kind.

    And to some packages, I know they are working, I will give feedback.

    Best regards

    Hans



    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  5. Re: Packages with httpd needs

    Hans-J. Ullrich wrote:
    > Well, I wondered, whenever an application needs a http-demon (for example
    > phpgroupware, egroupware, prelude and many others), all packages force to
    > install apache. There is no way, to get rid of this. As we say "Small is
    > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need,to
    > install mighty apache ! A simple http demon (I prefer thttpd) would dothe
    > same but would be more secure.


    THTTPD doesn't (AFAIK) support PHP, so the applications you mentioned
    can't be use with it.

    Thanks for the interest in helping out, but please file bugs to specific
    packages when you are certain they could use a suggestion such as yours.

    I don't dismiss your suggestion completely, but bear in mind that given
    the number of people and packages in debian, a non-specific email to
    debian-devel is hardly likely to generate any sort of positive outcome.

    Cheers

    --
    Leo "costela" Antunes
    [insert a witty retort here]


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFHTGiwImLTb3rflGYRAizHAKDlFUFAKWUGo+NZEUQUMo 1lXiYIvwCg0Ogp
    fU1s/VSIMukflKvoIeTOemE=
    =jV0j
    -----END PGP SIGNATURE-----


  6. Re: Packages with httpd needs

    On Tue, Nov 27, 2007 at 03:24:59PM +0100, Hans-J. Ullrich wrote:
    > as I do not know, where to write, as there is no debian-packages, I will try
    > it here.


    > Well, I wondered, whenever an application needs a http-demon (for example
    > phpgroupware, egroupware, prelude and many others), all packages force to
    > install apache.


    Why are you using phpgroupware as an example here?

    Package: phpgroupware
    Depends: apache2 | apache | httpd, php5 | php5-cgi | libapache2-mod-php5 [...]

    This doesn't force you to install apache. It just requires that you have
    apache and php installed, which by default is going to pull in apache2 and
    libapache2-mod-php5 if the dependency isn't previously satisfied. (The php
    depends in this particular example are strange; it should probably depend
    either on "php5" alone, which is a metapackage. But that doesn't change the
    argument.)

    And this has long been the policy for webapps, so I don't understand your
    claim.

    --
    Steve Langasek Give me a lever long enough and a Free OS
    Debian Developer to set it on, and I can move the world.
    Ubuntu Developer http://www.debian.org/
    slangasek@ubuntu.com vorlon@debian.org


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  7. Re: Packages with httpd needs

    Hello,

    On Tue, Nov 27, 2007 at 03:24:59PM +0100, Hans-J. Ullrich wrote:
    >
    > Well, I wondered, whenever an application needs a http-demon (for example
    > phpgroupware, egroupware, prelude and many others), all packages force to
    > install apache. There is no way, to get rid of this. As we say "Small is
    > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    > install mighty apache ! A simple http demon (I prefer thttpd) would do the
    > same but would be more secure.
    >
    > So it would be nice, if all maintainers could build the packages, with an "OR"
    > opoortunity like "recommended apache or thttpd or whatevereslse" , so the
    > user could choose, which http-demon he would like to use.


    For horde3 package, apache2 is installed by default when you
    "apt-get install horde3". But we have a dependency with the
    virtual package httpd and you can use another HTTP daemon. For
    example : "apt-get install horde3 lighttpd php5-cgi".

    Regards,
    --
    Gregory Colpart GnuPG:1024D/C1027A0E
    Evolix - Informatique et Logiciels Libres http://www.evolix.fr/


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  8. Re: Packages with httpd needs

    On Tue, Nov 27, 2007 at 07:57:44PM +0100, Leo costela Antunes wrote:
    > Hans-J. Ullrich wrote:
    > > Well, I wondered, whenever an application needs a http-demon (for example
    > > phpgroupware, egroupware, prelude and many others), all packages force to
    > > install apache. There is no way, to get rid of this. As we say "Small is
    > > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    > > install mighty apache ! A simple http demon (I prefer thttpd) would do the
    > > same but would be more secure.


    > THTTPD doesn't (AFAIK) support PHP


    Does THTTPD not support CGI or FastCGI?

    --
    Steve Langasek Give me a lever long enough and a Free OS
    Debian Developer to set it on, and I can move the world.
    Ubuntu Developer http://www.debian.org/
    slangasek@ubuntu.com vorlon@debian.org


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  9. Re: Packages with httpd needs

    Leo "costela" Antunes wrote:
    > Hans-J. Ullrich wrote:
    >> Well, I wondered, whenever an application needs a http-demon (for example
    >> phpgroupware, egroupware, prelude and many others), all packages force to
    >> install apache. There is no way, to get rid of this. As we say "Small is
    >> beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    >> install mighty apache ! A simple http demon (I prefer thttpd) would do the
    >> same but would be more secure.

    >
    > THTTPD doesn't (AFAIK) support PHP, so the applications you mentioned
    > can't be use with it.


    lighttpd supports php for example, using fastcgi.

    Imho the best thing here would be to add the libapache2-* stuff to
    Recommends, so it will be installed in default configurations, but it
    also allows the admin to ignore that recommendation.


    --
    Bernd Zeimetz



    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  10. Re: Packages with httpd needs

    On 27-Nov-07, 12:57 (CST), Leo costela Antunes wrote:
    > Hans-J. Ullrich wrote:
    > > Well, I wondered, whenever an application needs a http-demon (for example
    > > phpgroupware, egroupware, prelude and many others), all packages force to
    > > install apache. There is no way, to get rid of this. As we say "Small is
    > > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    > > install mighty apache ! A simple http demon (I prefer thttpd) would do the
    > > same but would be more secure.

    >
    > THTTPD doesn't (AFAIK) support PHP, so the applications you mentioned
    > can't be use with it.


    THTTPD supports CGI, AFAICT, and thus supports PHP, in theory.

    I suspect a lot of packages work fine in non-Apache servers, even when
    they support apache-specific features. One example is wordpress, which
    will write mod_rewrite configuration, but runs quite happily without it.

    Hans, I've had no problem getting maintainers to add "| httpd" to the
    Depends, once I've confirmed that the package does, indeed, work with
    non-apache servers.

    Steve

    --
    Steve Greenland
    The irony is that Bill Gates claims to be making a stable operating
    system and Linus Torvalds claims to be trying to take over the
    world. -- seen on the net


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  11. Re: Packages with httpd needs

    On Tue, Nov 27, 2007 at 12:27:42PM -0800, Steve Langasek wrote:
    >
    > Package: phpgroupware
    > Depends: apache2 | apache | httpd, php5 | php5-cgi | libapache2-mod-php5[...]
    >
    > This doesn't force you to install apache. It just requires that you have
    > apache and php installed, which by default is going to pull in apache2 and
    > libapache2-mod-php5 if the dependency isn't previously satisfied. (The php
    > depends in this particular example are strange; it should probably depend
    > either on "php5" alone, which is a metapackage. But that doesn't change the
    > argument.)
    >

    Actually, your statement (about requiring apache) is not strictly true.
    Lots of packages which are not apache provide httpd:

    for i in `apt-cache search httpd |cut -f1 -d' '` ; do [ `apt-cache show $i|grep '^Provides:.*httpd' |wc -l` -gt 0 ] && apt-cache show $i |grep "^Package\|^Provides" && echo "---------"; done

    Regards,

    -Roberto
    --
    Roberto C. Snchez
    http://people.connexer.com/~roberto
    http://www.connexer.com

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)

    iD8DBQFHTLeF5SXWIKfIlGQRAl/7AJ4nTp+zhGjgW3xcWhnkGf6ifqz8YwCfQwBe
    1Aw79j6QYjJ+GuzA6M5scL4=
    =shHQ
    -----END PGP SIGNATURE-----


  12. Re: Packages with httpd needs

    On Tue, Nov 27, 2007 at 07:34:13PM -0500, Roberto C. Snchez wrote:
    > On Tue, Nov 27, 2007 at 12:27:42PM -0800, Steve Langasek wrote:


    > > Package: phpgroupware
    > > Depends: apache2 | apache | httpd, php5 | php5-cgi | libapache2-mod-php5 [...]


    > > This doesn't force you to install apache. It just requires that you have
    > > apache and php installed, which by default is going to pull in apache2 and
    > > libapache2-mod-php5 if the dependency isn't previously satisfied. (The php
    > > depends in this particular example are strange; it should probably depend
    > > either on "php5" alone, which is a metapackage. But that doesn't change the
    > > argument.)


    > Actually, your statement (about requiring apache) is not strictly true.
    > Lots of packages which are not apache provide httpd:


    Er, yes. That should have been "It just requires that you have a webserver
    and php installed".

    --
    Steve Langasek Give me a lever long enough and a Free OS
    Debian Developer to set it on, and I can move the world.
    Ubuntu Developer http://www.debian.org/
    slangasek@ubuntu.com vorlon@debian.org


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  13. Re: Packages with httpd needs

    It looks like thttpd works okay with php[45]-cgi, provided that all of the
    ..php files have the appropriate #!/usr/bin/php[45]-cgi set

    On Nov 27, 2007 10:57 AM, Leo costela Antunes wrote:

    > Hans-J. Ullrich wrote:
    > > Well, I wondered, whenever an application needs a http-demon (for

    > example
    > > phpgroupware, egroupware, prelude and many others), all packages force

    > to
    > > install apache. There is no way, to get rid of this. As we say "Small is
    > > beautifull" or "KISS = Keep it simple stupid" , IMO there is no need, to
    > > install mighty apache ! A simple http demon (I prefer thttpd) would do

    > the
    > > same but would be more secure.

    >
    > THTTPD doesn't (AFAIK) support PHP, so the applications you mentioned
    > can't be use with it.
    >
    > Thanks for the interest in helping out, but please file bugs to specific
    > packages when you are certain they could use a suggestion such as yours.
    >
    > I don't dismiss your suggestion completely, but bear in mind that given
    > the number of people and packages in debian, a non-specific email to
    > debian-devel is hardly likely to generate any sort of positive outcome.
    >
    > Cheers
    >
    > --
    > Leo "costela" Antunes
    > [insert a witty retort here]
    >
    >



    --
    moo.


  14. Re: Packages with httpd needs

    Steve Langasek wrote:
    > On Tue, Nov 27, 2007 at 07:57:44PM +0100, Leo costela Antunes wrote:
    >> THTTPD doesn't (AFAIK) support PHP

    >
    > Does THTTPD not support CGI or FastCGI?
    >


    Oops, you're right.
    But would the apps run "out of the box" with php-cgi? If so, then yes,
    these bugs could be filed in the appropriate packages.
    (even if not, probably related wishlist bugs could also be filed, asking
    for CGI compat)

    Cheers

    --
    Leo "costela" Antunes
    [insert a witty retort here]


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.6 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFHTWfNImLTb3rflGYRAnHUAKCI3unK7rT772bYyEhGj5 BpPJgHsQCg3lRh
    y7Ng8NuO5TL3Bh8vhRgFx9k=
    =AH2o
    -----END PGP SIGNATURE-----


+ Reply to Thread