4 files changed, 264 insertions, 3 deletions
diff --git a/www-servers/Manifest.gz b/www-servers/Manifest.gz
index 5208f6b1399f..488c65622657 100644
--- a/www-servers/Manifest.gz
+++ b/www-servers/Manifest.gz
diff --git a/www-servers/apache/Manifest b/www-servers/apache/Manifest
index f8b57963524d..2b98daec2877 100644
--- a/www-servers/apache/Manifest
+++ b/www-servers/apache/Manifest
@@ -2,6 +2,9 @@ AUX 41_mod_http2.conf 189 BLAKE2B 70f006ead657b250bb4c30a332484baf698541d44d9224
 AUX apache.conf 94 BLAKE2B b0330849adfc5fc048622b3a256ecb727f3bfa339e6cc7f50843597d3e8d7b6d4463986d8f9a73f3580c93ce571d01f9ba571e0328356b62e5680ede913acc4b SHA512 e954c66da825fd6f84753cd7a50ae2da86daf5da27b37dba484019e8e1adaeb57122ba9a8fd1222e80edac04ca78d807265ef8b275278e4eeef12feb6043597b
 AUX apache2.4-hardened.service 933 BLAKE2B 60cbe1a55ded29299ba7fc453a6f13c456bc702ec77a31ede0904a52c9d726d57ec4d477df74d46e4edab157a2bf930750620c8d369a0b6900b049d9a4619a5c SHA512 711899777ea59995cecda007dca8d9ff6d0650b80990ea3b387f914e923df703e0c71ebaee5d967590c46fc5c588d35390d7c34023ef673c1791a60850efd0e8
 DIST gentoo-apache-2.4.62-20240719.tar.bz2 26207 BLAKE2B 0c0b52620d27f9f96643f8f18221e04c97a80849470f21695359f569be4cebcea0e1588bfce0744ffb86267185fe7a235c3f7b4976a6b68cd8c30c1ac0cb966a SHA512 689362c5171e72afb439dae57c73750ac1cd559a15d2b6fe57a08cc7b489f6921d0265f90e3d4551b75269f60b7222fe20c792c0c14ff5ff3303c9fc974d43f8
+DIST gentoo-apache-2.4.63-20250207.tar.bz2 26241 BLAKE2B 6d2c4d8b8997c52a71e86828ebb7d88f9319e69dd4fe331c37e644cb41a4c09e8b897452f7e24c5efca747ba98151615df6f2bdfbdc021141e7f2988964fcfd5 SHA512 98b6b0a010bbbd9ea8dfa7fbf6c1c280b563f0265d862c4677c7aadd4bd7b0f340a5fc24789a712e8feeec7257a4f64400dba592b9015052c992828ea7138842
 DIST httpd-2.4.62.tar.bz2 7521661 BLAKE2B 0e5c3b05819771e6ff72933ad715695199a32c384f63de6598e179ff5803580f04639437829305150305c9a2b7d309178552d8c9a2d7248a034c98f445193b95 SHA512 7db1876805d5c0f60f49bcb51f75cdf567120f2ff6349e68f084e9a86ae38265d9f1c67e7fca0082c9db136f3c408a88501ee11f26b1b68724ba240867171d77
-EBUILD apache-2.4.62.ebuild 7829 BLAKE2B aba6aa3e29cb0808774ea6dd0eeda80e54ac8d0485988718386fb8374935296f516cbfff0f0460d968aa03d0c99aa0217f6459dd1612bd5bc8d03021a4e7a4fe SHA512 50e0a390b585a0ea8963cc572dfb2363203b86d90b112f450c469bacb640d5781140d02b3592a4636a7e881ae9ada83dd6c2bf3d011a06bf1de3aa7c5fcb6dcb
+DIST httpd-2.4.63.tar.bz2 7517972 BLAKE2B adc4b3ad640919a2df1eaae9a4a7d004f60b2d59a6fa4a624c7e97758c0e244378cb06f11d69a54e789dd216f8f3fb8e967b2e01fd3bdab10ce1ae332d2a4d07 SHA512 a804ca564dfee5907fe4ce4f36884815bace0621bc7b8c9aa7c99472a954aa19cb13733f90678ff3d58ab3c76cc0e33a27e1035dc1d8cb597a9622154c59ef48
+EBUILD apache-2.4.62.ebuild 7827 BLAKE2B 8584c405d1b8e759a53559444dd9e8f7aab426d1aaf9378e84c4a0c4bc07ce31be9ab3393b59c4a85dabb736534e49b4ce459815dd32570177fe739cb451846a SHA512 fdccd06ee020438e1e924fa09a1f7312ced46bf173c66c7fa22f692339d48e6be9ba9999d53a0bfd862407c56533352ef75a28af266f73a1ddcd964493e171f8
+EBUILD apache-2.4.63.ebuild 7944 BLAKE2B 2ecd0efb0af53eed24895cf388a337fcacc6cf501753973f367910ec9c8750aad69b0fda83f977241dd3629e5b89e7f31fc7fa5bfd15e7edd1b5674225283492 SHA512 6f2d8ecc6afe0197fd8c249924fe23ef96c869c6ff1c6dd61103be5d497b8a316010def497471f01392f01f5a951683f3e2218d80537812fa08658f0bead7952
 MISC metadata.xml 978 BLAKE2B 2b2b82339fb2419da3d4e9d77f2c4495235b04a8f5006e61316bf638f307227ea26e2f9eaa26fca5d10118ebdd0bff9fac7319687ae62e2440b49e509e7080e0 SHA512 4a1842f1754473f7168fd38ef4ac2720fddf0f4ad8bfc5df3215b7a50f454cb3fc372e5a84d030a2b84e9744d599f8a38caf3ad5688a93cee7d52bac3d89b43b
diff --git a/www-servers/apache/apache-2.4.62.ebuild b/www-servers/apache/apache-2.4.62.ebuild
index 8779084369f0..275061bd0030 100644
--- a/www-servers/apache/apache-2.4.62.ebuild
+++ b/www-servers/apache/apache-2.4.62.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -149,7 +149,7 @@ SLOT="2"
 KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x64-macos ~x64-solaris"
 
 RDEPEND="
-	apache2_modules_tls? ( >=net-libs/rustls-ffi-0.13.0:= )
+	apache2_modules_tls? ( =net-libs/rustls-ffi-0.13*:= )
 "
 DEPEND="${RDEPEND}"
 
diff --git a/www-servers/apache/apache-2.4.63.ebuild b/www-servers/apache/apache-2.4.63.ebuild
new file mode 100644
index 000000000000..18d0505e8065
--- /dev/null
+++ b/www-servers/apache/apache-2.4.63.ebuild
@@ -0,0 +1,258 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+# latest gentoo apache files
+GENTOO_PATCHSTAMP="20250207"
+GENTOO_DEVELOPER="graaff"
+GENTOO_PATCHNAME="gentoo-apache-2.4.63"
+
+# IUSE/USE_EXPAND magic
+IUSE_MPMS_FORK="prefork"
+IUSE_MPMS_THREAD="event worker"
+
+# << obsolete modules:
+# authn_default authz_default mem_cache
+# mem_cache is replaced by cache_disk
+# ?? buggy modules
+# proxy_scgi: startup error: undefined symbol "ap_proxy_release_connection", no fix found
+# >> added modules for reason:
+# compat: compatibility with 2.2 access control
+# authz_host: new module for access control
+# authn_core: functionality provided by authn_alias in previous versions
+# authz_core: new module, provides core authorization capabilities
+# cache_disk: replacement for mem_cache
+# lbmethod_byrequests: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bytraffic: Split off from mod_proxy_balancer in 2.3
+# lbmethod_bybusyness: Split off from mod_proxy_balancer in 2.3
+# lbmethod_heartbeat: Split off from mod_proxy_balancer in 2.3
+# slotmem_shm: Slot-based shared memory provider (for lbmethod_byrequests).
+# socache_shmcb: shared object cache provider. Default config with ssl needs it
+# unixd: fixes startup error: Invalid command 'User'
+IUSE_MODULES="access_compat actions alias allowmethods asis auth_basic auth_digest auth_form
+authn_anon authn_core authn_dbd authn_dbm authn_file authn_socache authz_core
+authz_dbd authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex
+brotli cache cache_disk cache_socache cern_meta charset_lite cgi cgid dav dav_fs dav_lock
+dbd deflate dir dumpio env expires ext_filter file_cache filter headers http2
+ident imagemap include info lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness
+lbmethod_heartbeat log_config log_forensic logio lua macro md mime mime_magic negotiation
+proxy proxy_ajp proxy_balancer proxy_connect proxy_ftp proxy_hcheck proxy_html proxy_http proxy_scgi
+proxy_http2 proxy_fcgi proxy_uwsgi proxy_wstunnel rewrite ratelimit remoteip reqtimeout
+session session_cookie session_crypto session_dbd setenvif slotmem_shm socache_memcache
+socache_shmcb speling status substitute systemd unique_id userdir usertrack
+unixd version vhost_alias watchdog xml2enc"
+# The following are also in the source as of this version, but are not available
+# for user selection:
+# bucketeer case_filter case_filter_in echo http isapi optional_fn_export
+# optional_fn_import optional_hook_export optional_hook_import
+
+# inter-module dependencies
+# TODO: this may still be incomplete
+MODULE_DEPENDS="
+	auth_form:session
+	brotli:filter
+	dav_fs:dav
+	dav_lock:dav
+	deflate:filter
+	cache_disk:cache
+	ext_filter:filter
+	file_cache:cache
+	lbmethod_byrequests:proxy_balancer
+	lbmethod_byrequests:slotmem_shm
+	lbmethod_bytraffic:proxy_balancer
+	lbmethod_bybusyness:proxy_balancer
+	lbmethod_heartbeat:proxy_balancer
+	log_forensic:log_config
+	logio:log_config
+	cache_disk:cache
+	cache_socache:cache
+	md:watchdog
+	mime_magic:mime
+	proxy_ajp:proxy
+	proxy_balancer:proxy
+	proxy_balancer:slotmem_shm
+	proxy_connect:proxy
+	proxy_ftp:proxy
+	proxy_hcheck:proxy
+	proxy_hcheck:watchdog
+	proxy_html:proxy
+	proxy_html:xml2enc
+	proxy_http:proxy
+	proxy_http2:proxy
+	proxy_scgi:proxy
+	proxy_uwsgi:proxy
+	proxy_fcgi:proxy
+	proxy_wstunnel:proxy
+	session_cookie:session
+	session_dbd:dbd
+	session_dbd:session
+	socache_memcache:cache
+	substitute:filter
+"
+
+# module<->define mappings
+MODULE_DEFINES="
+	auth_digest:AUTH_DIGEST
+	authnz_ldap:AUTHNZ_LDAP
+	cache:CACHE
+	cache_disk:CACHE
+	cache_socache:CACHE
+	dav:DAV
+	dav_fs:DAV
+	dav_lock:DAV
+	file_cache:CACHE
+	http2:HTTP2
+	info:INFO
+	ldap:LDAP
+	lua:LUA
+	md:SSL
+	proxy:PROXY
+	proxy_ajp:PROXY
+	proxy_balancer:PROXY
+	proxy_connect:PROXY
+	proxy_fcgi:PROXY
+	proxy_ftp:PROXY
+	proxy_hcheck:PROXY
+	proxy_html:PROXY
+	proxy_http:PROXY
+	proxy_http2:PROXY
+	proxy_scgi:PROXY
+	proxy_uwsgi:PROXY
+	proxy_wstunnel:PROXY
+	socache_shmcb:SSL
+	socache_memcache:CACHE
+	ssl:SSL
+	status:STATUS
+	suexec:SUEXEC
+	systemd:SYSTEMD
+	userdir:USERDIR
+"
+
+# critical modules for the default config
+MODULE_CRITICAL="
+	authn_core
+	authz_core
+	authz_host
+	dir
+	mime
+	unixd
+"
+inherit apache-2 systemd tmpfiles toolchain-funcs
+
+DESCRIPTION="The Apache Web Server"
+HOMEPAGE="https://httpd.apache.org/"
+
+# some helper scripts are Apache-1.1, thus both are here
+LICENSE="Apache-2.0 Apache-1.1"
+SLOT="2"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x64-macos ~x64-solaris"
+
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	# dependent critical modules which are not allowed in global scope due
+	# to USE flag conditionals (bug #499260)
+	use ssl && MODULE_CRITICAL+=" socache_shmcb"
+	use doc && MODULE_CRITICAL+=" alias negotiation setenvif"
+	apache-2_pkg_setup
+}
+
+src_configure() {
+	# Brain dead check.
+	tc-is-cross-compiler && export ap_cv_void_ptr_lt_long="no"
+
+	apache-2_src_configure
+}
+
+src_compile() {
+	if tc-is-cross-compiler ; then
+		# This header is the same across targets, so use the build compiler.
+		pushd server >/dev/null
+		emake gen_test_char
+		tc-export_build_env BUILD_CC
+		${BUILD_CC} ${BUILD_CFLAGS} ${BUILD_CPPFLAGS} ${BUILD_LDFLAGS} \
+			gen_test_char.c -o gen_test_char $(apr-1-config --includes) || die
+		popd >/dev/null
+	fi
+
+	default
+}
+
+src_install() {
+	apache-2_src_install
+	local i
+	local apache_tools_prune_list=(
+		/usr/bin/{htdigest,logresolve,htpasswd,htdbm,ab,httxt2dbm}
+		/usr/sbin/{checkgid,fcgistarter,htcacheclean,rotatelogs}
+		/usr/share/man/man1/{logresolve.1,htdbm.1,htdigest.1,htpasswd.1,dbmmanage.1,ab.1}
+		/usr/share/man/man8/{rotatelogs.8,htcacheclean.8}
+	)
+	for i in ${apache_tools_prune_list[@]} ; do
+		rm "${ED}"/${i} || die "Failed to prune apache-tools bits"
+	done
+
+	dobin support/apxs
+
+	# Note: wait for mod_systemd to be included in some forthcoming release,
+	# Then apache2.4.service can be used and systemd support controlled
+	# through --enable-systemd
+	systemd_newunit "${FILESDIR}/apache2.4-hardened.service" "apache2.service"
+	dotmpfiles "${FILESDIR}/apache.conf"
+	#insinto /etc/apache2/modules.d
+	#doins "${FILESDIR}/00_systemd.conf"
+
+	# Install http2 module config
+	insinto /etc/apache2/modules.d
+	doins "${FILESDIR}"/41_mod_http2.conf
+
+	# Fix path to apache libdir
+	sed "s|@LIBDIR@|$(get_libdir)|" -i "${ED}"/usr/sbin/apache2ctl || die
+}
+
+pkg_postinst() {
+	apache-2_pkg_postinst || die "apache-2_pkg_postinst failed"
+
+	tmpfiles_process apache.conf #662544
+
+	# warnings that default config might not work out of the box
+	local mod cmod
+	for mod in ${MODULE_CRITICAL} ; do
+		if ! use "apache2_modules_${mod}"; then
+			echo
+			ewarn "Warning: Critical module not installed!"
+			ewarn "Modules 'authn_core', 'authz_core' and 'unixd'"
+			ewarn "are highly recomended but might not be in the base profile yet."
+			ewarn "Default config for ssl needs module 'socache_shmcb'."
+			ewarn "Enabling the following flags is highly recommended:"
+			for cmod in ${MODULE_CRITICAL} ; do
+				use "apache2_modules_${cmod}" || \
+					ewarn "+ apache2_modules_${cmod}"
+			done
+			echo
+			break
+		fi
+	done
+	# warning for proxy_balancer and missing load balancing scheduler
+	if use apache2_modules_proxy_balancer; then
+		local lbset=
+		for mod in lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat; do
+			if use "apache2_modules_${mod}"; then
+				lbset=1 && break
+			fi
+		done
+		if [[ ! ${lbset} ]] ; then
+			echo
+			ewarn "Info: Missing load balancing scheduler algorithm module"
+			ewarn "(They were split off from proxy_balancer in 2.3)"
+			ewarn "In order to get the ability of load balancing, at least"
+			ewarn "one of these modules has to be present:"
+			ewarn "lbmethod_byrequests lbmethod_bytraffic lbmethod_bybusyness lbmethod_heartbeat"
+			echo
+		fi
+	fi
+
+	# removed in 2.4.63
+	ewarn "Attention: The tls module based on rustls-ffi has been moved to its own package."
+	ewarn "emerge www-apache/mod_tls to continue using the tls module."
+}