curl portion done since 7.57.0-1ubuntu1 - setting fix released.
** Changed in: curl (Ubuntu)
Assignee: ChristianEhrhardt (paelzer) => LocutusOfBorg
(costamagnagianfranco)
** Changed in: curl (Ubuntu)
Status: Triaged => Fix Released
--
You received this bug notification because you
For completeness referencing the Debian bug I submitted the test.
Since this is not "the bug" which we adressed (enable http2) I do not fully
link it as task.
=> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=884068
** Bug watch added: Debian Bug tracker #884068
This bug was fixed in the package apache2 - 2.4.29-1ubuntu2
---
apache2 (2.4.29-1ubuntu2) bionic; urgency=medium
* enable http2 (LP: #1687454) by stopping to disable it
- debian/control: no more removed libnghttp2-dev Build-Depends (in
universe).
-
Override component to main
nghttp2 1.28.0-1 in bionic: universe/misc -> main
Override [y|N]? y
1 publication overridden.
Override component to main
libnghttp2-14 1.28.0-1 in bionic amd64: universe/libs/optional/100% -> main
libnghttp2-14 1.28.0-1 in bionic arm64: universe/libs/optional/100% ->
LocutusOfBorg will cover the curl enablement on the current merge.
I tested from his ppa and it was ok.
Also tested the apache2 enablement - fine as well.
I not only dropped our disabling of http2 but also added a basic check to test
it.
apache2 with changes is building in bionic-proposed now.
This will be enabled in apache2 for server support but since we bring it into
main we also "no more disable" it in curl.
This can then also be used to test http2.
Added bug tasks and assigned me for now to test that.
** Also affects: apache2 (Ubuntu)
Importance: Undecided
Status: New
Maybe you don't want to MIR the -doc package here, since it Depends on
lynx | www-browser. There are www-browser's in main, but not typically
installed on a server (w3m is in main but not part of the default
install).
--
You received this bug notification because you are a member of Ubuntu
Bugs,
I quickly re-reviewed nghttp2; it's fine to MIR (and has security team
approval). MIR ACKed.
Let's try to fix the missing bindnow though in a future upload...
I: libnghttp2-14: hardening-no-bindnow
usr/lib/x86_64-linux-gnu/libnghttp2.so.14.14.0
** Changed in: nghttp2 (Ubuntu)
Status: New
@cyphermox, with the security team's approval, is this now ack-able?
** Changed in: nghttp2 (Ubuntu)
Status: Incomplete => New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1687454
Title:
I reviewed nghttp2 version 1.25.0-1 as checked into Debian unstable. This
shouldn't be considered a full security audit but rather a quick gauge of
maintainability.
nghttp2 provides an http/2 protocol interface that can be used by clients
and servers to handle the far more complicated http/2
** Description changed:
Availability: src:nghttp2 is in artful/universe and builds binary
packages for all available architectures.
Rationale: In order to enable apache2's support for HTTP/2,
libnghttp2-14 must be in main (libnghttp2-dev is added as a b-d for
src:apache2, but it can
** Changed in: nghttp2 (Ubuntu)
Status: New => Incomplete
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1687454
Title:
[MIR] nghttp2
To manage notifications about this bug go to:
The only issue I see is not a blocker, but should probably be fixed:
I: libnghttp2-14: hardening-no-bindnow
usr/lib/x86_64-linux-gnu/libnghttp2.so.14.13.3
Otherwise, since this is meant to support a reverse proxy, it should get
a review by the Security Team. Reverse proxies are often security-
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: nghttp2 (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1687454
Title:
** Description changed:
Availability: src:nghttp2 is in artful/universe and builds binary
packages for all available architectures.
Rationale: In order to enable apache2's support for HTTP/2,
libnghttp2-14 must be in main (libnghttp2-dev is added as a b-d for
src:apache2, but it can
** Description changed:
Availability: src:nghttp2 is in artful/universe and builds binary
packages for all available architectures.
Rationale: In order to enable apache2's support for HTTP/2,
libnghttp2-14 must be in main (libnghttp2-dev is added as a b-d for
src:apache2, but it can
16 matches
Mail list logo
