Subject: [alpine-aports] [PATCH] testing/nginx-naxsi: update to 1.9.1

From: Stuart Cardall <[email-masked]>
Date: Sat, 30 May 2015 01:57:59 +0000

http-sysguard: repo & release created
upstream-fair: alternative repo with a release used

http-sysguard updated to use the latest features in tengine 2.1.0:
http://tengine.taobao.org/document/http_sysguard.html
---
 testing/nginx-naxsi/APKBUILD | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/testing/nginx-naxsi/APKBUILD b/testing/nginx-naxsi/APKBUILD
index 6dfbed7..b09f46c 100644
--- a/testing/nginx-naxsi/APKBUILD
+++ b/testing/nginx-naxsi/APKBUILD
@@ -5,10 +5,12 @@
 
 pkgname=nginx-naxsi
 _pkgname=nginx
-pkgver=1.9.0
+pkgver=1.9.1
 _ngx_naxsi_ver=0.54rc2
 _ngx_cache_purge_ver=2.3
-pkgrel=1
+_ngx_upstream_fair_ver=0.1.0
+_ngx_http_sysguard_ver=2.1.0
+pkgrel=0
 pkgdesc="lightweight HTTP and reverse proxy server with Naxsi WAF support, see also 'nxapi'"
 url="http://www.nginx.org | https://github.com/nbs-system/naxsi"
 arch="all"
@@ -21,8 +23,8 @@ _httpsysguard_sha="3fcdf27ff91482e1e54eb6fae4e059e814b85d78"
 source="http://nginx.org/download/$_pkgname-$pkgver.tar.gz
 	naxsi-$_ngx_naxsi_ver.tar.gz::https://github.com/nbs-system/naxsi/archive/$_ngx_naxsi_ver.tar.gz
 	ngx_cache_purge-$_ngx_cache_purge_ver.tar.gz::https://github.com/FRiCKLE/ngx_cache_purge/archive/$_ngx_cache_purge_ver.tar.gz
-	upstream-fair-${_upstreamfair_sha}.tar.gz::https://github.com/gnosek/nginx-upstream-fair/tarball/${_upstreamfair_sha}
-	sysguard-${_httpsysguard_sha}.tar.gz::https://github.com/alibaba/nginx-http-sysguard/tarball/${_httpsysguard_sha}
+	upstream-fair-$_ngx_upstream_fair_ver.tar.gz::https://github.com/hnlq715/nginx-upstream-fair/archive/v$_ngx_upstream_fair_ver.tar.gz
+	sysguard-$_ngx_http_sysguard_ver.tar.gz::https://github.com/itoffshore/nginx-http-sysguard/archive/$_ngx_http_sysguard_ver.tar.gz
 
 	anonymise.patch
 	ipv6.patch
@@ -48,7 +50,7 @@ build() {
 	cd "$_builddir"
 	./configure \
 		--add-module="$srcdir/naxsi-$_ngx_naxsi_ver/naxsi_src" \
-		--add-module="$srcdir/alibaba-nginx-http-sysguard-3fcdf27" \
+		--add-module="$srcdir/nginx-http-sysguard-$_ngx_http_sysguard_ver" \
 		--prefix=/usr \
 		--conf-path=/etc/$_pkgname/$_pkgname.conf \
 		--pid-path=/var/run/$_pkgname.pid \
@@ -74,7 +76,7 @@ build() {
 		--with-http_stub_status_module \
 		--with-http_auth_request_module \
 		--add-module="$srcdir/ngx_cache_purge-$_ngx_cache_purge_ver" \
-		--add-module="$srcdir/gnosek-nginx-upstream-fair-a18b409" \
+		--add-module="$srcdir/nginx-upstream-fair-$_ngx_upstream_fair_ver" \
 		|| return 1
 	make || return 1
 }
@@ -93,31 +95,31 @@ package() {
 	install -m644 -D LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
 	install -m644 -D "$srcdir"/naxsi-$_ngx_naxsi_ver/naxsi_config/naxsi_core.rules "$pkgdir"/etc/nginx/naxsi_core.rules
 }
-md5sums="487c26cf0470d8869c41a73621847268  nginx-1.9.0.tar.gz
+md5sums="fc054d51effa7c80a2e143bc4e2ae6a7  nginx-1.9.1.tar.gz
 6b091c34a0aa76184effaaeb26af7c09  naxsi-0.54rc2.tar.gz
 dc4c0688ed03ca7f5563097c2a8a76ca  ngx_cache_purge-2.3.tar.gz
-ac5e7f485476af70e0ee1c52016cddaf  upstream-fair-a18b4099fbd458111983200e098b6f0c8efed4bc.tar.gz
-bbbcf5d949f5e335a2bd49c1f0e0c89d  sysguard-3fcdf27ff91482e1e54eb6fae4e059e814b85d78.tar.gz
+f3562ef6573f616e254d382d6f86b8e1  upstream-fair-0.1.0.tar.gz
+fdb072dc8d67b573a0ea7983530a7d2b  sysguard-2.1.0.tar.gz
 a07569b8a023f1b89dcd11e0beda4df6  anonymise.patch
 801a87f7f9d27f8ad85b41a78b4c4461  ipv6.patch
 50357b75049d878c0bcce10d0c60f9ed  sysguard.patch
 609ea97ab6c3c30f9e8329968aadc4f3  nginx.initd
 8823274a834332d3db4f62bf7dd1fb7d  nginx.logrotate"
-sha256sums="e12aa1d5b701edde880ebcc7be47ca171c3fbeed8fa7c8c62054a6f19d27f248  nginx-1.9.0.tar.gz
+sha256sums="09f555fae694c0944f172b575ad239f56d40d14559d98e843de0a690f38c1dad  nginx-1.9.1.tar.gz
 2f7f2c0fb4dacf489febb719e7834a2b16c9b471e16ef1125e7f87174defeecc  naxsi-0.54rc2.tar.gz
 cb7d5f22919c613f1f03341a1aeb960965269302e9eb23425ccaabd2f5dcbbec  ngx_cache_purge-2.3.tar.gz
-0306f503f6052abbe5da9a6936b595bedcd5ef1b7a89a694ae8e2212cbb794a5  upstream-fair-a18b4099fbd458111983200e098b6f0c8efed4bc.tar.gz
-39c9bd87d4660017a16909a9804dddd259d0bf0db803f725c2b9bb95d8e52c70  sysguard-3fcdf27ff91482e1e54eb6fae4e059e814b85d78.tar.gz
+dd0bfb79d2489f48ea63ac004d91890cd471eb4020500ce9179c3612cb13246c  upstream-fair-0.1.0.tar.gz
+97e0cc9a36fcce375c5b0667b002d2f7acd580e968a2318e3276fbdc1b99f8e4  sysguard-2.1.0.tar.gz
 1923ebdb4a64a22f8903c3da619677bd3aaf769c99bee1aa4262edac58f05ba3  anonymise.patch
 a24ef5843ae0afa538b00c37eb7da7870f9d7f146f52a9668678f7296cf71d9b  ipv6.patch
 18090329435c32d91621a5943acc5b8bbe89aaa3c2fa334c3a4cdeb00efb6226  sysguard.patch
 8cbef405295eac299dfc3b9b119c02bda354a9b335923bed6ff6992c1fd8f493  nginx.initd
 cea0c6f8de55a4c3a3eccc57910de1c3116634082c8e5b660630fb927a29f38d  nginx.logrotate"
-sha512sums="a7750b8b9a0c89b2de9467b14b4af6fb61e5064995a6ef7bb04cd10424ce4fd2fda31eee0f24551c222ceef491be4621e88d30708f3b2cc088767c8e8bb70589  nginx-1.9.0.tar.gz
+sha512sums="5f5bd0bd31ab002d900a5182d00292ddf262a3ded57692a13bd903c5fb73915a8587e2e17daa3f497a14867ad2748f855343a2e3df90207c8aa08a49a2f21397  nginx-1.9.1.tar.gz
 cd79ed8aa51482edaa68bd6f34cd64848bb990a31452fe4da14b17bf94a178102892fb51868cdc39d7712b523a0d3a85135af3f9d02f7eb566a0b87fc0cf6414  naxsi-0.54rc2.tar.gz
 81929ca57ce5c2e1af6ec43882a54ff1da8dc77786bfb7505ff94fbcf970ae8870b419dc5c0bc7b80794d75a359e0100f360c1cf458a300f802b1d8bd7053811  ngx_cache_purge-2.3.tar.gz
-843f2037fca792a215daf3ab33ca5bb1ffc159a0bfb3f54f1d7c5e992ec394bc5d41a01f01b4a9ede02bab795b1d1f8f06dc88ae1a1d60480fc10a5cfc51a6a1  upstream-fair-a18b4099fbd458111983200e098b6f0c8efed4bc.tar.gz
-aa7f912c0507f8f59df0410f0295896232772bfc19cbcb602da33705a959c3e334608bee1c77041cc27eb781c3b0264c33eeafe9761b64e5c6323a9f54876127  sysguard-3fcdf27ff91482e1e54eb6fae4e059e814b85d78.tar.gz
+2ff9894986c5cd483ecee97d8818675ef6d063e5f45bb66e8cf56c78bbd043b9c0c37eb3cf650b7cfb6d40da9f7a4ba0e030fe39de5ef1f715cbcd6560248428  upstream-fair-0.1.0.tar.gz
+f9587b8aa7a2b09be016dc6f7a07fe3fee154d16172194e899bf3c78a3f4e373c78f79932794cd9ac75793514c606ab878f88be9400b70e37528d263f1541b34  sysguard-2.1.0.tar.gz
 5899097b6b6ed04deb7ae474fb65205d9c50843f30929c1370c0c1d70df3f02fe51b8ea90d3d2c3b4c53aeb3895717729e0c9773b880ca529e89a5b07fc26a5b  anonymise.patch
 68d64a84568ec2df0366925ab282a05ebe21a85044b6c7844a47573cfd8cc8ed119cc772358bc3fff36e2d4fdf583a730592825f5f98632993ca86d1f8438d5f  ipv6.patch
 2dca2ac74fb92e330fde7b6b6120b2fd2565c377a629c9536cf77beebe41aa4b092d4229d5b487b0fb02be4f2cc5b897c429c87bbbbc7b0d31e1cbb94231ddce  sysguard.patch
-- 
2.4.1

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Thu, 4 Jun 2015 14:51:10 +0200

On Sat, 30 May 2015 01:57:59 +0000

> http://tengine.taobao.org/document/http_sysguard.html

I have applied this. Thanks!

But to be honest, I am not to happy with that we need an nginx build
for every single module. If nginx gets an update we need to update *
number-of-modules. If we want an improvement in the nginx init.d
script, then we need to update * number-of-modules.

If there is a security issue, then we will have to patch *
number-of-modules.

This is a maintenance nightmare.

Why can not modules be implemented as dynamic libs (like tengine does).

-nc

---