[gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Sebastian Pipping]

Hi!


Better late then never.  Posting 72 hours from now the earliest as
advised by GLEP 42.  Feedback welcome as usual.


===========================================================
Title: Apache "-D PHP5" needs update to "-D PHP"
Author: Sebastian Pipping <sping@gentoo.org>
Content-Type: text/plain
Posted: 2016-01-04
Revision: 1
News-Item-Format: 1.0
Display-If-Installed: app-eselect/eselect-php[apache2]

With >=app-eselect/eselect-php-0.8.1, to enable PHP support
for Apache 2.x file /etc/conf.d/apache2 no longer
needs to read

  APACHE2_OPTS="......... -D PHP5"

but

  APACHE2_OPTS="......... -D PHP"

, i.e. without "5" at the end.  This change is related to
unification in context of the advent of PHP 7.x.

With that change, guard "<IfDefine PHP>" in file
/etc/apache2/modules.d/70_mod_php.conf
has a chance to actually pull in PHP support.

Without updating APACHE2_OPTS, websites could end up serving
PHP code (include configuration files with passwords)
unprocessed to website visitors!


The origin of this news item is:
https://bugs.gentoo.org/show_bug.cgi?id=569042
===========================================================


Best



Sebastian

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Jeroen Roovers]

On Mon, 4 Jan 2016 01:26:28 +0100
Sebastian Pipping <sping@gentoo.org> wrote:

> Hi!
> 
> 
> Better late then never.  Posting 72 hours from now the earliest as
> advised by GLEP 42.  Feedback welcome as usual.
> 
> 
> ===========================================================
> Title: Apache "-D PHP5" needs update to "-D PHP"
> Author: Sebastian Pipping <sping@gentoo.org>
> Content-Type: text/plain
> Posted: 2016-01-04
> Revision: 1
> News-Item-Format: 1.0
> Display-If-Installed: app-eselect/eselect-php[apache2]
> 
> With >=app-eselect/eselect-php-0.8.1, to enable PHP support
> for Apache 2.x file /etc/conf.d/apache2 no longer

... 2.x, the file ...

> needs to read

=> should no longer read

> 
>   APACHE2_OPTS="......... -D PHP5"
> 
> but
> 
>   APACHE2_OPTS="......... -D PHP"
> 
> , i.e. without "5" at the end.  This change is related to

instead, i.e. ...

> unification in context of the advent of PHP 7.x.

Vague.

> With that change, guard "<IfDefine PHP>" in file
> /etc/apache2/modules.d/70_mod_php.conf
> has a chance to actually pull in PHP support.

We'd like to be pretty certain that PHP application server is going to
"actually" do that.

> Without updating APACHE2_OPTS, websites could end up serving
> PHP code (include configuration files with passwords)
> unprocessed to website visitors!

That would mean there is an additional (local) security problem.



     jer

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 12:11 AM, Jeroen Roovers wrote:
> 
>> Without updating APACHE2_OPTS, websites could end up serving
>> PHP code (include configuration files with passwords)
>> unprocessed to website visitors!
> 
> That would mean there is an additional (local) security problem.
> 

All PHP applications are written by the sort of people who will tell you
to put a config file in the public DocumentRoot, and that's not easy to
fix as the system administrator. Those virtual hosts should really
really really really really be wrapped in <IfModule> statements.

[gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 01/04/2016 01:26 AM, Sebastian Pipping wrote:
> Hi!
> 
> 
> Better late then never.  Posting 72 hours from now the earliest as
>  advised by GLEP 42.  Feedback welcome as usual.

Do you have any timeline in place for the change happening in tree (in
particular for stable users).

> 
> Without updating APACHE2_OPTS, websites could end up serving PHP 
> code (include configuration files with passwords) unprocessed to 
> website visitors!
> 

Such a change should really be avoided if possible. Would it be
possible to have a conditional approach where either one can be used,
or maybe set the new variable/defin if the old one is used?

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJWijA1AAoJECULev7WN52F/aQH/0JxIUbwzpXsY3canje+A/oo
IsfgksJIZOq3cRZNwNvnE+BBMyuQlGaJ6auuIp+er9VNwjYk2Qiq7tzAanEdVeq9
A6h+eWYu/jTI57op9n7h5k6Jy7fMU1G/YfH6KfDHaoV/mIZFjpTND3v97OvB+uAc
6jt0234PYHjFsSwyOnYZ3/p+P9GELAhGAQQWaDhh5RDdKPfpEULiVpniWbnbTFBq
evQ2dKRw6cifBfyUYcLsGstdtPsqzbjETNOeWSNLwgMMpCh7xViaTnJ1T+9rqK1L
9Jb1+xCuy7Nj6T4mbZZaDZXuGdJm9KgpzplpRR1ivv0FudwgHAbFJ8QyykjvOMA=
=KViT
-----END PGP SIGNATURE-----

[gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Rich Freeman]

On Mon, Jan 4, 2016 at 3:41 AM, Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>
> On 01/04/2016 01:26 AM, Sebastian Pipping wrote:
>> Hi!
>>
>>
>> Better late then never.  Posting 72 hours from now the earliest as
>>  advised by GLEP 42.  Feedback welcome as usual.
>
> Do you have any timeline in place for the change happening in tree (in
> particular for stable users).

++

In particular we should avoid both of these scenarios:
1. Stable users make a change now which breaks their existing config
(because the change isn't deployed to stable yet).
2. Stable users get the news item today, and the change six months
later after they've forgotten about it.

I'm not sure whether either applies in this case.

-- 
Rich

Re: [gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 01/04/2016 09:41 AM, Kristian Fiskerstrand wrote:
> On 01/04/2016 01:26 AM, Sebastian Pipping wrote:
>> Hi!



> 
> Such a change should really be avoided if possible. Would it be 
> possible to have a conditional approach where either one can be 
> used, or maybe set the new variable/defin if the old one is used?
> 

Maybe I'm thinking things too difficult, why not just define both -D
PHP and -D PHP5 in the transition period and suggest this config for
any change?

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJWinPkAAoJECULev7WN52FFkYH/2f9v5dnKeS4nX3mP+ZnzwkY
YpV2W0l8WNN1ZHfM4nsf/zKPw7eJqYFFryaYYtiNebvN37SpjaqdCrn78l1/mJYI
JfKH6Aj7QNi3LuGR0B30yKhDMF6Q5Yu56rtXuweHCdX25zOoTkQAQ8S5n9OOLORP
DP4J0hgc+HQZrMkZMUZGTrToFX91ffQazE/e/ryXROCNO/g8vZBpbCbTC6PuSpMp
z5foF2sD4cfcccvVf0vG4NKwIhFqYPZkvMM8/yYbuj61ZGGf0HtCXBpK4fNLgQKc
nKqVUzKY69YY76oi2sS+GDmEPQohCMTzSdhQztNXGKrTmzz5tccVnqCMlLd8kn4=
=0KpH
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Kristian Fiskerstrand]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 01/04/2016 02:30 PM, Kristian Fiskerstrand wrote:
> On 01/04/2016 09:41 AM, Kristian Fiskerstrand wrote:
>> On 01/04/2016 01:26 AM, Sebastian Pipping wrote:
>>> Hi!
> 
> 
> 
> 
>> Such a change should really be avoided if possible. Would it be 
>> possible to have a conditional approach where either one can be 
>> used, or maybe set the new variable/defin if the old one is
>> used?
> 
> 
> Maybe I'm thinking things too difficult, why not just define both
> -D PHP and -D PHP5 in the transition period and suggest this config
> for any change?
> 

And while at it, in additional to news item, this should likely follow
a few version upgrades as elog messages before actually being
implemented anywhere

- -- 
Kristian Fiskerstrand
Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJWin+hAAoJECULev7WN52FNGYIAIK5xZEaBvUzR9YCyzSphnI/
ymh6i+wUnzcCjX4TYpC5c05yp3nzLTXvKsaNFuMos43ZqhjTG6hny72waIZ5RRmM
KI1XORRItoOHiat6xuYrOg8S9vf881AJnS/w6XhRVkL1MrtGLrUbV2De/5Z7V1PU
3j0M702inkbPHoV3JfRv97ZZmupazCSj7rfrrwcvUFqjKFZNFU4zK76rAwRXYfSk
ZKC7MSAx6lfhcNmy8boUoFMnFwyimkI06hN8ZhaosexkSYqT5HeOUMrX2bpKtXF/
69Ky3bd8Vs8/f9WTqtjf3GJC/iBs1/gpxgSu7/hpy69yFoffLE9VsKe1xHSd3n4=
=C5MO
-----END PGP SIGNATURE-----

Re: [gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Rich Freeman]

On Mon, Jan 4, 2016 at 9:20 AM, Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>
> And while at it, in additional to news item, this should likely follow
> a few version upgrades as elog messages before actually being
> implemented anywhere
>

I don't want to be too prescriptive with the solutions.  However,
clearly /some/ kind of orderly transition is necessary.  News before,
an elog, etc.  And that news needs to be timely - not 12 months before
stable mysteriously breaks one day, unless it is safe to make the
change before the update.  I'd leave it up to the maintainer to decide
whether it is more work to coordinate the timing around all the
communications or to have a more graceful transition so that the
timing isn't as critical.

-- 
Rich

Re: [gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Peter Stuge]

Kristian Fiskerstrand wrote:
> Maybe I'm thinking things too difficult, why not just define both -D
> PHP and -D PHP5 in the transition period and suggest this config for
> any change?

Because it mostly just defers the problem.

If the desire is to move away from PHP5 then I would suggest to force
a failure when starting Apache, if PHP5 is defined when PHP is required.

Ie. fail closed.

I can be talked into supporting the idea to only print a warning when
PHP5 is set and to not fail (no source served) for some period of
time until which the forced failure starts, if PHP5 is still set.

Don't fail open, fail closed. Since manual interaction is required
some people will forget or overlook it, and will get a failure.

I would introduce the failure right away, but maybe a warning will
make some happy who would otherwise have gotten a failure.


//Peter

Re: [gentoo-dev] Re: News item: Apache "-D PHP5" needs update to "-D PHP"

[Brian Evans]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 1/4/2016 3:41 AM, Kristian Fiskerstrand wrote:
> On 01/04/2016 01:26 AM, Sebastian Pipping wrote:
>> Hi!
> 
> 
>> Better late then never.  Posting 72 hours from now the earliest
>> as advised by GLEP 42.  Feedback welcome as usual.
> 
> Do you have any timeline in place for the change happening in tree
> (in particular for stable users).
> 
> 
>> Without updating APACHE2_OPTS, websites could end up serving PHP
>>  code (include configuration files with passwords) unprocessed to
>>  website visitors!
> 
> 
> Such a change should really be avoided if possible. Would it be 
> possible to have a conditional approach where either one can be
> used, or maybe set the new variable/defin if the old one is used?
> 
> 

The problem is really two-fold with the new eselect-php.

For future compatibility (to not have this happen again with say
PHP8), the PHP team changed the symlink created by eselect to be
libphp.so instead of the current libphp${MAJOR}.so.

The user must also reselect with `eselect php set X`, even for the
current PHP versions and not just 7.

mjo explored the option of "<IfDefine PHP5>Define PHP</IfDefine>" but
that is apache-2.4+ only.

If we wanted a "compatibility" layer, it would be the same section
repeated until 2.4 was the only version available.  That might confuse
users even more.

Brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQIcBAEBAgAGBQJWioraAAoJENH3ge/59KO2wNUQAKThJz1QBjOvOmi0ClluVxt8
Lt0fbibQXIgZScJy5zqeOwX3EAUDqBST8sonNhJ8uQT4qbU8gwdYK6vhoDbJS0sX
oNzbdwxumSwNBsi4UCl/D0Dj+XefgIyvmgGBZ0RA8t0x8Ls3uQB6DWI1f36Z3wAs
ULqJc38+d1e5pmNu3jpc5tvG2ybvaVVGbWmNiOI8rafFV12KIsRMDHdDCG4DpkQD
bmWLYTv44Nt5nSY2wmLQQAV57kB2PsaaT0qlQciVhKiqOUA+qlmI0dtM3LLSNitK
dqKWNj7WTQFBM1SLHXD0s4CQk9XhFB9E07zelcB5zuC9XeYj1mbrn9aEtfl5lfVs
hHHJQ97MG3u/XwPTHY04J6wfoaQW4dwaQd74Pz48qJ2DqSW9HV8UTS2enF5cuZok
mFfd+xexHvcz45jyz83BtXM4mRWdHBDdy/3fYEvN12wVgU4hQcjDTKKPwpO3Btsb
uyCar+SgoHoRIEQhfDytnT0Idte2GifCysPq7hG12j+efwT7pt0XXk+TZQaH/opZ
FWRzOvjXZXd41M3RQ7H5D+KXrKV3uY4mE41rceEUXrw9PQrueg6Cw5ujK/opawrv
a8qonCtx7LZrEzYLagCYEBDPdgvxHWzIBb0vdgYoRVzSRwoJiAA66dbRuqC7s34G
JM84VqrtPsaCktCq6vw3
=/gh0
-----END PGP SIGNATURE-----

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Lars Wendler]

[-- Attachment #1: Type: text/plain, Size: 1943 bytes --]

Hi Sebastian,

to be honest I was very upset when I first stumbled upon this problem.
And yes I only found about it when my apache webserver started to
deliver php source code instead of the real sites.
Doing such a change without getting in contact with me as apache
maintainer before the change was done is very... eh... impolite at best.

Kind regards
Lars

On Mon, 4 Jan 2016 01:26:28 +0100 Sebastian Pipping wrote:

>Hi!
>
>
>Better late then never.  Posting 72 hours from now the earliest as
>advised by GLEP 42.  Feedback welcome as usual.
>
>
>===========================================================
>Title: Apache "-D PHP5" needs update to "-D PHP"
>Author: Sebastian Pipping <sping@gentoo.org>
>Content-Type: text/plain
>Posted: 2016-01-04
>Revision: 1
>News-Item-Format: 1.0
>Display-If-Installed: app-eselect/eselect-php[apache2]
>
>With >=app-eselect/eselect-php-0.8.1, to enable PHP support
>for Apache 2.x file /etc/conf.d/apache2 no longer
>needs to read
>
>  APACHE2_OPTS="......... -D PHP5"
>
>but
>
>  APACHE2_OPTS="......... -D PHP"
>
>, i.e. without "5" at the end.  This change is related to
>unification in context of the advent of PHP 7.x.
>
>With that change, guard "<IfDefine PHP>" in file
>/etc/apache2/modules.d/70_mod_php.conf
>has a chance to actually pull in PHP support.
>
>Without updating APACHE2_OPTS, websites could end up serving
>PHP code (include configuration files with passwords)
>unprocessed to website visitors!
>
>
>The origin of this news item is:
>https://bugs.gentoo.org/show_bug.cgi?id=569042
>===========================================================
>
>
>Best
>
>
>
>Sebastian
>



-- 
Lars Wendler
Gentoo package maintainer
GPG: 21CC CF02 4586 0A07 ED93  9F68 498F E765 960E 9B39

Attention! New gpg key! See (self signed server cert for now)
http://www.gentoofan.org/blog/index.php?/archives/9-New-gpg-keys.html

[-- Attachment #2: Digitale Signatur von OpenPGP --]
[-- Type: application/pgp-signature, Size: 819 bytes --]

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1376 bytes --]

On Mon, 4 Jan 2016 11:45:37 +0100
Lars Wendler <polynomial-c@gentoo.org> wrote:

> to be honest I was very upset when I first stumbled upon this problem.
> And yes I only found about it when my apache webserver started to
> deliver php source code instead of the real sites.
> Doing such a change without getting in contact with me as apache
> maintainer before the change was done is very... eh... impolite at best.

Well, if this is the common outcome, then I dare say it's very bad,
at least. Gentoo was never the distribution people could seriously
consider stable, and it not uncommon for breakages like this to happen.
But still, it's very bad if an upgrade is going to suddenly cause
webserver to disclose script sources rather than running it.

While of course the sole fact that this can happen is a complete
disastrous design failure, we can't really do much about it or cause
people to stop using such misdesigned software. Nevertheless, I think
it would be reasonable to at least try to reduce the intentional
breakage to bare minimum.

Therefore, I think you should really work on some kind of backwards
compatibility for people using '-D PHP5' that would prevent those kind
of issues at least for some migration period. With big fat warnings for
people who run it.

-- 
Best regards,
Michał Górny
<http://dev.gentoo.org/~mgorny/>

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 949 bytes --]

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 08:40 AM, Michał Górny wrote:
> 
> Therefore, I think you should really work on some kind of backwards
> compatibility for people using '-D PHP5' that would prevent those kind
> of issues at least for some migration period. With big fat warnings for
> people who run it.
> 

I wasn't able to come up with something that worked on apache-2.2 and
was backwards-compatible or failed "off."

The apache module name for PHP changed with php-7.0. This forces a big
change in 70_mod_php.conf, and a corresponding change in eselect-php
(which must be run once before anything will work). The problem is to
come up with an apache-2.2 config that works for new 5.6 users, 5.6 ->
7.0 eselect switchers, and new 7.0 users. Someone always gets screwed.

If anyone has a concrete idea that works better, it's not too late to
change it.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Peter Stuge]

Michael Orlitzky wrote:
> If anyone has a concrete idea that works better, it's not too late to
> change it.

Add code to init script and service file to check the config before
starting the program, and react if PHP5 is still set.


//Peter

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 10:42 AM, Peter Stuge wrote:
> Michael Orlitzky wrote:
>> If anyone has a concrete idea that works better, it's not too late to
>> change it.
> 
> Add code to init script and service file to check the config before
> starting the program, and react if PHP5 is still set.
> 

Which init script? It's only "bad" to have PHP5 set if the user has
installed >=eselect-php-0.8.1, and run it at least once. You don't want
to e.g. kill working php-5.x installations for people who have apache
keyworded ~arch.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Peter Stuge]

Michael Orlitzky wrote:
> >> If anyone has a concrete idea that works better, it's not too late to
> >> change it.
> > 
> > Add code to init script and service file to check the config before
> > starting the program, and react if PHP5 is still set.
> 
> Which init script?

For Apache.

> It's only "bad" to have PHP5 set if the user has installed
> >=eselect-php-0.8.1, and run it at least once.

So pkg_postinst for >=eselect-php-0.8.1 should say something, but
ideally also the invocation - but I don't know if eselect-php is also
code or only data managed by eselect?


> You don't want to e.g. kill working php-5.x installations for people
> who have apache keyworded ~arch.

IMO that would be a much lesser evil than serving source in another
case, as long as it is clear how to unkill (sed s,PHP5,PHP,) the setup.


//Peter

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 11:11 AM, Peter Stuge wrote:
>
> So pkg_postinst for >=eselect-php-0.8.1 should say something, but
> ideally also the invocation - but I don't know if eselect-php is also
> code or only data managed by eselect?

The pkg_postinst is already there. The eselect-php routines are bash
code so theoretically we can do anything we want. How do people feel
about making eselect-php spit out a warning every time the apache2
module is messed with?


>>
>> Which init script?
> 
> For Apache.
> 
>> You don't want to e.g. kill working php-5.x installations for people
>> who have apache keyworded ~arch.
> 
> IMO that would be a much lesser evil than serving source in another
> case, as long as it is clear how to unkill (sed s,PHP5,PHP,) the setup.
> 

It wouldn't be that simple; at the very least, those people would have
to keyword eselect-php, upgrade it, run it, and fix their config. To do
that properly would make eselect-php a dependency of the new apache, and
that's wrong.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Brian Evans]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 1/4/2016 11:43 AM, Michael Orlitzky wrote:
> On 01/04/2016 11:11 AM, Peter Stuge wrote:
>> 
>> So pkg_postinst for >=eselect-php-0.8.1 should say something,
>> but ideally also the invocation - but I don't know if eselect-php
>> is also code or only data managed by eselect?
> 
> The pkg_postinst is already there. The eselect-php routines are
> bash code so theoretically we can do anything we want. How do
> people feel about making eselect-php spit out a warning every time
> the apache2 module is messed with?

Perhaps grep for -DPHP5 or if -DPHP is missing in the conf.d and shout
then as part of the "eselect php set apache2 X"?

Brian
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)

iQIcBAEBAgAGBQJWiqoTAAoJENH3ge/59KO2XRUP/RFybVPuCNtCDEPclsKWp5AI
rvejArURHwk8hu+OjITLb/0UxYM5VwXN9fOrSkxJ3lsVErNlxfeaLc0UYYh/1qnd
WeofmCq7yx0enOe0+szcY877reca5yfPzPs3ChB+a4+PpVAIuD7quL0lcuhs/NMJ
S9Hoex5mOmmd82jeXdZlvZZzLHxLhsnWwTjDQhmnCL9mkHbx2u1+07et7Wdxd8Gu
Td4O9tiAvp/5KQ3Dmw2P2BQPBbZc0EYqGG/Aghw02dDHp+jq5snVRXCdg/z1L61j
VXPblbNBRY9wA96k0vu6aqGRWGuj66rBHcF3DH8A9+o0LY/8eh9v56n7UGg2LfE8
5GEgfT4yY7d5DYEikWKLc56iOy754auh0UbXC+5IaAK8PfIOcMBFG1AgvEqZY+VU
pXBF7yh1QxaAtsYBjKX8X+DuCr9549vjSsMKtUFN+mCz1cLi1KX9OxtCvVQMJUnM
zx5mK8JNFoKlA/kINERsa//swICDgJ2aN4GX64YV+tnfsrZrM1YSJxHIjiEE7Q1m
Pd3v/0CFMra5snYEMdk8qoYQ7ITQdmsM0vM93OgqBYmaNrEZlNG5T+seMpPxv+lD
BhT8R7W2mDqKShljjm31nzp4FG/30z8DymeBn+JVWxHbdy5IqUlaYa5egpWk1vip
qw0h5uqKkkv6BKwXI8sp
=60JD
-----END PGP SIGNATURE-----

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Rich Freeman]

On Mon, Jan 4, 2016 at 12:21 PM, Brian Evans <grknight@gentoo.org> wrote:
>
> On 1/4/2016 11:43 AM, Michael Orlitzky wrote:
>> On 01/04/2016 11:11 AM, Peter Stuge wrote:
>>>
>>> So pkg_postinst for >=eselect-php-0.8.1 should say something,
>>> but ideally also the invocation - but I don't know if eselect-php
>>> is also code or only data managed by eselect?
>>
>> The pkg_postinst is already there. The eselect-php routines are
>> bash code so theoretically we can do anything we want. How do
>> people feel about making eselect-php spit out a warning every time
>> the apache2 module is messed with?
>
> Perhaps grep for -DPHP5 or if -DPHP is missing in the conf.d and shout
> then as part of the "eselect php set apache2 X"?
>

My understanding (which could be wrong) is that this update will break
things even if the user never runs eselect php afterwards.  I can't
tell you the last time I touched the php eselect module, because major
updates to php are rare.



-- 
Rich

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 12:49 PM, Rich Freeman wrote:
> 
> My understanding (which could be wrong) is that this update will break
> things even if the user never runs eselect php afterwards.  I can't
> tell you the last time I touched the php eselect module, because major
> updates to php are rare.
> 

I was going to say "no, everything should keep working" but I decided to
test a fresh upgrade before sticking my foot in my mouth. Now I know
what people are complaining about.

If you've never touched 70_mod_php5.conf, portage will remove it when
you upgrade eselect-php. That does break an existing installation until
you've run `eselect php...` and munged -DPHP5 to -DPHP. What I intended
was for 70_mod_php5.conf to stick around until you've had a chance to
deal with the configuration change. In that case everything keeps
working until after you've run eselect.

I may be able to fix that by simply including the old 70_mod_php5.conf
for backwards compatibility.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/04/2016 02:27 PM, Michael Orlitzky wrote:
> 
> I may be able to fix that by simply including the old 70_mod_php5.conf
> for backwards compatibility.
> 

I just pushed a new revision with this fix. In eselect-php-0.8.2-r1,
we ship both the new 70_mod_php.conf and the old 70_mod_php5.conf. The
latter comes with a big warning at the top of it, stating that it is for
backwards compatibility only.

The way this should work for upgraders is:

  * You currently have php-5.x eselected, -DPHP5 defined, and a symlink
    to libphp5.so in your apache2 modules directory.

  * You upgrade eselect-php.

  * The way we handle the module symlink and conf.d definition has
    changed, but the new eselect won't touch your old libphp5.so
    symlink, and you still have -DPHP5 defined.

  * With 70_mod_php5.conf still around, everything keeps working
    exactly as it did before the eselect-php upgrade.

  * If you try to use `eselect php ... apache2`, it will create a NEW
    symlink, under the new scheme. Nothing else happens. Hopefully
    this convinces you to read the elog or apache config.

  * If you define both -DPHP5 and -DPHP, you can get problems. Don't do
    that?

  * If you switch from -DPHP5 to -DPHP, the new 70_mod_php.conf kicks
    in, and the new scheme gets used, and your eselect choice will
    start working. Now you can delete 70_mod_php5.conf.

tl;dr it should keep working until you try to eselect and "it doesn't do
anything." Then hopefully you try to figure out why and realize you need
to update to -DPHP. But until then your current PHP keeps running.

If you had trouble with the upgrade, first of all -- sorry, and could
you please give the new revision a try? This upgrade should only be
annoying, not fatal.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Sebastian Pipping]

On 05.01.2016 20:35, Michael Orlitzky wrote:
> I just pushed a new revision with this fix. In eselect-php-0.8.2-r1,
> we ship both the new 70_mod_php.conf and the old 70_mod_php5.conf. The
> latter comes with a big warning at the top of it, stating that it is for
> backwards compatibility only.

Cool, sounds like a great idea to me.

I guess we don't need a news item any more then?



Sebastian

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/06/2016 02:36 PM, Sebastian Pipping wrote:
> On 05.01.2016 20:35, Michael Orlitzky wrote:
>> I just pushed a new revision with this fix. In eselect-php-0.8.2-r1,
>> we ship both the new 70_mod_php.conf and the old 70_mod_php5.conf. The
>> latter comes with a big warning at the top of it, stating that it is for
>> backwards compatibility only.
> 
> Cool, sounds like a great idea to me.
> 
> I guess we don't need a news item any more then?
> 

Upgraders still have a problem, but a much less severe one. After
upgrading eselect-php, further attempts to `eselect php set apache2`
will appear to have no effect, because the old 70_mod_php5.conf is
loading the old symlink to libphp5.so. There are a few options:

1. Leave things as is, and tell people what to do (read the elog) if
   they hit this situation.

2. Proceed with a news item that basically says "read the elog."

3. I could try to hack some magic into eselect-php to detect whether or
   not you have -DPHP5 set. Something simple, like grepping /etc/conf.d
   /apache2 for "PHP5". In that case we could omit a notice.
   This one simultaneously makes the most sense and feels like the
   biggest hack.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Marc Schiffbauer]

[-- Attachment #1: Type: text/plain, Size: 1598 bytes --]

* Michael Orlitzky schrieb am 06.01.16 um 20:53 Uhr:
> On 01/06/2016 02:36 PM, Sebastian Pipping wrote:
> > On 05.01.2016 20:35, Michael Orlitzky wrote:
> >> I just pushed a new revision with this fix. In eselect-php-0.8.2-r1,
> >> we ship both the new 70_mod_php.conf and the old 70_mod_php5.conf. The
> >> latter comes with a big warning at the top of it, stating that it is for
> >> backwards compatibility only.
> > 
> > Cool, sounds like a great idea to me.
> > 
> > I guess we don't need a news item any more then?
> > 
> 
> Upgraders still have a problem, but a much less severe one. After
> upgrading eselect-php, further attempts to `eselect php set apache2`
> will appear to have no effect, because the old 70_mod_php5.conf is
> loading the old symlink to libphp5.so. There are a few options:
> 
> 1. Leave things as is, and tell people what to do (read the elog) if
>    they hit this situation.
> 
> 2. Proceed with a news item that basically says "read the elog."
> 
> 3. I could try to hack some magic into eselect-php to detect whether or
>    not you have -DPHP5 set. Something simple, like grepping /etc/conf.d
>    /apache2 for "PHP5". In that case we could omit a notice.
>    This one simultaneously makes the most sense and feels like the
>    biggest hack.

+1 for 3.

You can remove the hack in a year or so. I think most important is a 
good user experience. If this requires a hack because the design of the 
tools give you no other choice than be it.


-- 
0x35A64134 - 8AAC 5F46 83B4 DB70 8317
             3723 296C 6CCA 35A6 4134

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Michael Orlitzky]

On 01/07/2016 07:52 PM, Marc Schiffbauer wrote:
>>
>> 3. I could try to hack some magic into eselect-php to detect whether or
>>    not you have -DPHP5 set. Something simple, like grepping /etc/conf.d
>>    /apache2 for "PHP5". In that case we could omit a notice.
>>    This one simultaneously makes the most sense and feels like the
>>    biggest hack.
> 
> +1 for 3.
> 
> You can remove the hack in a year or so. I think most important is a 
> good user experience. If this requires a hack because the design of the 
> tools give you no other choice than be it.
> 

Done in recent eselect-php:

  $ sudo eselect php set apache2 1
  !!! Warning: The apache2 configuration has changed in this
  !!! Warning: version of eselect-php. You should define "-D PHP"
  !!! Warning: and not "-D PHP5" for apache. The module is now
  !!! Warning: loaded by 70_mod_php.conf (was 70_mod_php5.conf).
  !!! Warning: After you have changed "-D PHP5" to "-D PHP",
  !!! Warning: you should remove 70_mod_php5.conf to eliminate
  !!! Warning: this warning. Until you have done so, your eselect
  !!! Warning: choices for apache2 will have no effect.

  Please restart apache for the changes to take effect.

Users may get that warning more than once if we reinstall
70_mod_php5.conf, but it's harmless and less hacky than grepping
/etc/conf.d/apache2.

I think we can forego the news item? Thanks for the suggestions.

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Sebastian Pipping]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04.01.2016 11:45, Lars Wendler wrote:
> Hi Sebastian,
> 
> to be honest I was very upset when I first stumbled upon this
> problem. And yes I only found about it when my apache webserver
> started to deliver php source code instead of the real sites.

Exactly the same with me.


> Doing such a change without getting in contact with me as apache 
> maintainer before the change was done is very... eh... impolite at
> best.

Just for the record, it wasn't me :)

Best



Sebastian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iEYEARECAAYFAlaNbXwACgkQsAvGakAaFgDNmgCfXwHI2i15LT30MFw6eV7cDgyk
sZYAnRwFHtwDAG/Z/p5zS4UvFXyvemGX
=Xlrd
-----END PGP SIGNATURE-----

Re: [gentoo-dev] News item: Apache "-D PHP5" needs update to "-D PHP"

[Hanno Böck]

On Mon, 4 Jan 2016 01:26:28 +0100
Sebastian Pipping <sping@gentoo.org> wrote:

> Better late then never.  Posting 72 hours from now the earliest as
> advised by GLEP 42.  Feedback welcome as usual.

afaics this only affects users using the mod_php variant of PHP and not
any fcgid or fpm solution. I think this should be mentioned.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: BBB51E42