--- pe-httpd-2.2.29.orig/debian/compat
+++ pe-httpd-2.2.29/debian/compat
@@ -0,0 +1 @@
+7
--- pe-httpd-2.2.29.orig/debian/a2dissite.8
+++ pe-httpd-2.2.29/debian/a2dissite.8
@@ -0,0 +1 @@
+.so man8/a2ensite.8
--- pe-httpd-2.2.29.orig/debian/pe-httpd.postrm
+++ pe-httpd-2.2.29/debian/pe-httpd.postrm
@@ -0,0 +1,94 @@
+#! /bin/bash
+
+set -e
+
+restore_conffile() {
+  if [ -e "${1}.dpkg-pe-httpd-common.old" ] ; then
+    echo "Restoring previous version of ${1} ..."
+    mv "${1}.dpkg-pe-httpd-common.old" "${1}"
+  fi
+}
+
+# Allow HTTPD 2.4 to override what this script does
+if [ -x /etc/puppetlabs/httpd/upgrade-to-2.4-in-progress ] ; then
+  set +e
+  /etc/puppetlabs/httpd/upgrade-to-2.4-in-progress "${0}" "${@}"
+  ret="${?}"
+  set -e
+
+  case ${ret} in
+    42) exit 0 ;;
+    43) DONT_PURGE=1 ;;
+    0) : ;;
+    *) exit $ret ;;
+  esac
+fi
+
+
+# Remove pe-httpd users if they still exist
+case $1 in
+  remove|purge)
+    USERGROUP='pe-apache'
+    if ( /usr/bin/getent passwd "${USERGROUP}" > /dev/null 2>&1 ); then
+      /usr/sbin/userdel "${USERGROUP}"
+    fi
+
+    if ( /usr/bin/getent group "${USERGROUP}" > /dev/null 2>&1 ); then
+      /usr/sbin/groupdel "${USERGROUP}"
+    fi
+  ;;
+esac
+
+# If purging, remove all known traces of lingering pe-httpd logs,
+# metadata, cache data, module configs, etc.
+if [ "${1}" = purge -a "${DONT_PURGE}" != 1 ] ; then
+  rm -f /etc/puppetlabs/httpd/httpd.conf \
+    /var/cache/pe-httpd/reload \
+    /var/log/pe-httpd/access.log* \
+    /var/log/pe-httpd/other_vhosts_access.log* \
+    /var/log/pe-httpd/error.log*
+
+  rm -rf  /var/cache/pe-httpd/proxy \
+    /var/cache/pe-httpd/mod_disk_cache \
+    /var/run/pe-httpd \
+    /var/lock/pe-httpd
+
+  # yes, these short-sighted bits of logic completely ignores
+  # the possibility that there may be links within these locations that don't belong
+  # to any of the pe-httpd packages.
+  for file in /etc/puppetlabs/httpd/sites-enabled/* \
+    /etc/puppetlabs/httpd/mods-enabled/* ; do
+
+    [ -L "${file}" ] && rm -f "${file}"
+  done
+
+  for dir in /etc/puppetlabs/httpd/sites-enabled/ \
+    /etc/puppetlabs/httpd/mods-enabled/ \
+    /etc/puppetlabs/httpd/conf.d \
+    /etc/puppetlabs/httpd \
+    /var/log/pe-httpd \
+    /var/cache/pe-httpd ; do
+      # intentionally don't force the rmdir, so that
+      # directories stay if they still have anything in them
+      rmdir "${dir}" 2> /dev/null || true
+  done
+fi
+
+# if the upgrade fails, try to revert
+if [ "${1}" = abort-upgrade ] ; then
+  restore_conffile /etc/default/pe-httpd
+  restore_conffile /etc/puppetlabs/httpd/ports.conf
+  restore_conffile /etc/puppetlabs/httpd/conf.d/charset
+fi
+
+# if just removing, and index.html is unaltered, remove it too.
+if [ "$1" = remove ] ; then
+  MD5SUM="$(md5sum /var/www/index.html 2>/dev/null | cut -d ' ' -f 1)"
+  case "${MD5SUM}" in
+    5388f60d7695cb57b87c799ee62d20b2 | 21dde95d9d269cbb2fa6560309dca40c )
+      rm -f /var/www/index.html
+    ;;
+  esac
+fi
+
+#DEBHELPER#
--- pe-httpd-2.2.29.orig/debian/pe-httpd.8
+++ pe-httpd-2.2.29/debian/pe-httpd.8
@@ -0,0 +1,81 @@
+.TH "APACHE2" 8 "2008-04-05" "Apache HTTP Server" "apache2"
+
+.SH NAME
+apache2 \- Apache Hypertext Transfer Protocol Server
+.SH "SYNOPSIS"
+.PP
+\fBapache2\fR [ -\fBd\fR \fIserverroot\fR ] [ -\fBf\fR \fIconfig\fR ] [ -\fBC\fR \fIdirective\fR ] [ -\fBc\fR \fIdirective\fR ] [ -\fBD\fR \fIparameter\fR ] [ -\fBe\fR \fIlevel\fR ] [ -\fBE\fR \fIfile\fR ] [ \fB-k\fR start|restart|graceful|stop|graceful-stop ] [ -\fBR\fR \fIdirectory\fR ] [ -\fBh\fR ] [ -\fBl\fR ] [ -\fBL\fR ] [ -\fBS\fR ] [ -\fBt\fR ] [ -\fBv\fR ] [ -\fBV\fR ] [ -\fBX\fR ] [ -\fBM\fR ]
+.SH "SUMMARY"
+.PP
+apache2 is the Apache HyperText Transfer Protocol (HTTP) server program\&. It is designed to be run as a standalone daemon process\&. When used like this it will create a pool of child processes or threads to handle requests\&.
+.PP
+In general, apache2 should not be invoked directly, but rather should be
+invoked via /etc/init.d/apache2 or apache2ctl\&. The default Debian
+configuration requires environment variables that are defined in
+/etc/apache2/envvars and are not available if apache2 is started directly.
+However, apache2ctl can be used to pass arbitrary arguments to apache2.
+.SH "DOCUMENTATION"
+.PP
+The full documentation is available in the apache2-doc package or at
+http://httpd.apache.org/docs/2.2/ . Information about Debian specific changes
+and configuration can be found in
+/usr/share/doc/apache2.2-common/README.Debian.gz .
+.SH "OPTIONS"
+.TP
+-d \fIserverroot\fR
+Set the initial value for the ServerRoot directive to \fIserverroot\fR\&. This can be overridden by the ServerRoot directive in the configuration file\&.
+.TP
+-f \fIconfig\fR
+Uses the directives in the file \fIconfig\fR on startup\&. If \fIconfig\fR does not begin with a /, then it is taken to be a path relative to the ServerRoot\&. The default is /etc/apache2/apache2\&.conf\&.  
+.TP
+-k start|restart|graceful|stop|graceful-stop
+Signals apache2 to start, restart, or stop\&. See Stopping Apache for more information\&.  
+.TP
+-C \fIdirective\fR
+Process the configuration \fIdirective\fR before reading config files\&.  
+.TP
+-c \fIdirective\fR
+Process the configuration \fIdirective\fR after reading config files\&.  
+.TP
+-D \fIparameter\fR
+Sets a configuration \fIparameter \fRwhich can be used with <IfDefine> sections in the configuration files to conditionally skip or process commands at server startup and restart\&.  
+.TP
+-e \fIlevel\fR
+Sets the LogLevel to \fIlevel\fR during server startup\&. This is useful for temporarily increasing the verbosity of the error messages to find problems during startup\&.  
+.TP
+-E \fIfile\fR
+Send error messages during server startup to \fIfile\fR\&.  
+.TP
+-R \fIdirectory\fR
+When the server is compiled using the SHARED_CORE rule, this specifies the \fIdirectory\fR for the shared object files\&.  
+.TP
+-h
+Output a short summary of available command line options\&.  
+.TP
+-l
+Output a list of modules compiled into the server\&. This will \fBnot\fR list dynamically loaded modules included using the LoadModule directive\&.  
+.TP
+-L
+Output a list of directives together with expected arguments and places where the directive is valid\&.  
+.TP
+-M
+Dump a list of loaded Static and Shared Modules\&.  
+.TP
+-S
+Show the settings as parsed from the config file (currently only shows the virtualhost settings)\&.  
+.TP
+-t
+Run syntax tests for configuration files only\&. The program immediately exits after these syntax parsing tests with either a return code of 0 (Syntax OK) or return code not equal to 0 (Syntax Error)\&. If -D \fIDUMP\fR_\fIVHOSTS \fRis also set, details of the virtual host configuration will be printed\&. If -D \fIDUMP\fR_\fIMODULES \fR is set, all loaded modules will be printed\&.  
+.TP
+-v
+Print the version of apache2, and then exit\&.  
+.TP
+-V
+Print the version and build parameters of apache2, and then exit\&.  
+.TP
+-X
+Run apache2 in debug mode\&. Only one worker will be started and the server will not detach from the console\&.  
+.SH SEE ALSO
+.BR apache2ctl (8),
+.BR /usr/share/doc/apache2.2-common/README.Debian.gz
+
--- pe-httpd-2.2.29.orig/debian/convert_docs
+++ pe-httpd-2.2.29/debian/convert_docs
@@ -0,0 +1,96 @@
+#!/usr/bin/perl -w
+
+use strict;
+use File::Path;
+use Fatal qw/mkpath symlink open close/;
+
+scalar @ARGV == 2 or die;
+
+my $SRC=$ARGV[0];
+my $TGT=$ARGV[1];
+
+# list of languages
+my @lang = glob("$SRC/index.html.*") or die;
+map { s{^.*html\.}{} }  @lang;
+
+# map "ja.euc-jp" to "ja/", ...
+my %lpath;
+foreach my $l (@lang) {
+	my $t=$l;
+	$t =~ s{\..*$}{};
+	$lpath{$l}="$t/";
+}
+
+
+my @html=`find $SRC -name *.html` or die;
+chomp(@html);
+map { s{^$SRC/}{} } @html;
+
+foreach my $h (@html) {
+	my $dir="";
+	if ($h =~ m{^(.*/)}) {
+		$dir=$1;
+	}
+	
+	for my $l (@lang) {
+		my $tdir="$TGT/$lpath{$l}";
+		-d "$tdir$dir" || mkpath("$tdir$dir");
+		
+		my $updir=$dir;
+		$updir =~ s{[^/]+}{..}g;
+		
+		if ($l eq "en") {
+			conv("$SRC/$h.en", "$tdir$h", $h);
+		}
+		elsif ( -f "$SRC/$h.$l" ) {
+			conv("$SRC/$h.$l", "$tdir$h", $h);
+		}
+		else {
+			symlink("${updir}../en/$h", "$tdir$h");
+		}
+		
+	}
+}
+
+open(my $out, ">", "$TGT/index.html");
+print $out '<html><head>',
+	   '<meta http-equiv="refresh" content="0; URL=en/index.html">',
+	   "</head>\n<body>\n<table>";
+foreach my $l (sort values %lpath) {
+	print $out qq{<tr><td><a href="${l}index.html">$l</a></td></tr>\n};
+}
+print $out '</table></body></html>';
+
+
+### END
+
+
+sub conv {
+	my ($old, $new, $name) = @_;
+	
+	open(my $in, "<", $old);
+	local $/;
+	my $file = <$in>;
+	close($in);
+
+	# /mod/ -> /mod/index.html
+	$file =~ s{href="([^:"]*/)"}{href="${1}index.html"}g;
+
+	# style and images now one level up
+	$file =~ s{(src|href)="../(style|images)}{$1="../../$2}g;
+	$file =~ s{(src|href)="./(style|images)}{$1="../$2}g;
+
+	foreach my $l (values %lpath) {
+		# language directories one level up
+		$file =~ s{href="\.\./$l}{href="../../$l}g;
+		$file =~ s{href="\./$l}{href="../$l}g;
+	}
+
+	# Debian tweaks
+	$file =~ s{/usr/local/apache2/conf/httpd[.]conf}{/etc/apache2/apache2.conf}g;
+	$file =~ s{httpd[.]conf}{apache2.conf}g;
+
+	open(my $out, ">", $new);
+	print $out $file;
+	close($out);
+}
--- pe-httpd-2.2.29.orig/debian/rules
+++ pe-httpd-2.2.29/debian/rules
@@ -0,0 +1,388 @@
+#! /usr/bin/make -f
+
+# Code for httpd 2.1, based on apache2 and others.
+# Copyright (C) Canonical Ltd, 2005
+
+export DEB_BUILD_HARDENING=1
+export DEB_BUILD_OPTIONS
+export DH_OPTIONS
+export DH_VERBOSE=1
+
+SHELL := bash
+.SHELLFLAGS = -e -x
+
+#enable dpatch
+include /usr/share/dpatch/dpatch.make
+
+name_prefix = pe-
+pe_prefix = opt/puppet
+etc_location = etc/puppetlabs
+
+# These are used for cross-compiling and for saving the configure script
+# from having to guess our platform (since we know it already)
+DEB_HOST_GNU_TYPE   ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_GNU_TYPE  ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+
+LSB_RELEASE := $(shell lsb_release -i -s)
+
+CONFFLAGS += ac_cv_prog_AWK=mawk ac_cv_prog_LYNX_PATH=www-browser
+
+AP2_COMMON_CONFARGS = --enable-layout=Puppet \
+    --enable-so \
+    --with-program-name=$(name_prefix)httpd \
+    --with-ldap=yes \
+    --with-ldap-include=/usr/include \
+    --with-ldap-lib=/usr/lib \
+    --with-ssl=/opt/puppet \
+    --with-suexec-caller=pe-apache \
+    --with-suexec-bin=/$(pe_prefix)/lib/httpd/suexec \
+    --with-suexec-docroot=/$(pe_prefix)/var/www \
+    --with-suexec-userdir=public_html \
+    --with-suexec-logfile=/var/log/pe-httpd/suexec.log \
+    --with-suexec-uidmin=100 \
+    --enable-suexec=shared \
+    --enable-log-config=static \
+    --enable-logio=static \
+    --with-apr=/usr/bin/apr-1-config \
+    --with-apr-util=/usr/bin/apu-1-config \
+    --with-pcre=yes \
+    --enable-pie
+
+AP2_MODS_CONFARGS =   --enable-authn-alias=shared \
+    --enable-authnz-ldap=shared \
+    --enable-disk-cache=shared \
+    --enable-cache=shared \
+    --enable-mem-cache=shared \
+    --enable-file-cache=shared \
+    --enable-cern-meta=shared \
+    --enable-dumpio=shared \
+    --enable-ext-filter=shared \
+    --enable-charset-lite=shared \
+    --enable-cgi=shared \
+    --enable-dav-lock=shared \
+    --enable-log-forensic=shared \
+    --enable-ldap=shared \
+    --enable-proxy=shared \
+    --enable-proxy-connect=shared \
+    --enable-proxy-ftp=shared \
+    --enable-proxy-http=shared \
+    --enable-proxy-ajp=shared \
+    --enable-proxy-scgi=shared \
+    --enable-proxy-balancer=shared \
+    --enable-ssl=shared \
+    --enable-authn-dbm=shared \
+    --enable-authn-anon=shared \
+    --enable-authn-dbd=shared \
+    --enable-authn-file=shared \
+    --enable-authn-default=shared \
+    --enable-authz-host=shared \
+    --enable-authz-groupfile=shared \
+    --enable-authz-user=shared \
+    --enable-authz-dbm=shared \
+    --enable-authz-owner=shared \
+    --enable-authnz-ldap=shared \
+    --enable-authz-default=shared \
+    --enable-auth-basic=shared \
+    --enable-auth-digest=shared \
+    --enable-dbd=shared \
+    --enable-deflate=shared \
+    --enable-include=shared \
+    --enable-filter=shared \
+    --enable-env=shared \
+    --enable-mime-magic=shared \
+    --enable-expires=shared \
+    --enable-headers=shared \
+    --enable-ident=shared \
+    --enable-usertrack=shared \
+    --enable-unique-id=shared \
+    --enable-setenvif=shared \
+    --enable-version=shared \
+    --enable-status=shared \
+    --enable-autoindex=shared \
+    --enable-asis=shared \
+    --enable-info=shared \
+    --enable-cgid=shared \
+    --enable-dav=shared \
+    --enable-dav-fs=shared \
+    --enable-vhost-alias=shared \
+    --enable-negotiation=shared \
+    --enable-dir=shared \
+    --enable-imagemap=shared \
+    --enable-actions=shared \
+    --enable-speling=shared \
+    --enable-userdir=shared \
+    --enable-alias=shared \
+    --enable-rewrite=shared \
+    --enable-mime=shared \
+    --enable-substitute=shared \
+    --enable-reqtimeout=shared
+
+AP2_CFLAGS = -I/opt/puppet/include -I/opt/puppet/include/openssl $(CFLAGS) -g -pipe -I/usr/include/xmltok -Wall -Wformat -Wformat-security -D_FORTIFY_SOURCE=2 -D_OPENSSL_NO_SSL2=1 -fstack-protector
+AP2_LDFLAGS = -L/opt/puppet/lib -Wl,--as-needed -Wl,-z,relro -Wl,-rpath,/opt/puppet/lib
+
+#support noopt building
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+  AP2_CFLAGS += -O0
+else
+  AP2_CFLAGS += -O2
+endif
+
+ifeq (,$(findstring nostrip,$(DEB_BUILD_OPTIONS)))
+DEB_BUILD_STRIP = yes
+endif
+
+ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
+  NUMJOBS = $(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
+  MAKEFLAGS += -j$(NUMJOBS)
+endif
+
+BUILD=debian/build-tree
+REALCURDIR=$(CURDIR)
+INSTALL=/usr/bin/install
+
+clean: unpatch
+	dh_testdir
+	rm -rf $(BUILD) mpm-worker mpm-prefork mpm-event mpm-itk install
+	rm -rf debian/tmp-worker debian/tmp-prefork
+	dh_clean
+
+build: patch-stamp build-stamp
+
+build-stamp: patch-stamp mpm-worker mpm-prefork mpm-event mpm-itk
+	for mpm in prefork event itk ; do \
+		if ! diff -u $(BUILD)/$$mpm/mods.list $(BUILD)/worker/mods.list ; then \
+			echo Different modules built into httpd binaries, will not proceed ;\
+			exit 1 ;\
+		fi \
+	done
+	touch $@
+
+mpm-worker mpm-prefork mpm-event mpm-itk: mpm-%: patch-stamp mpm-%.scripts-stamp
+	dh_testdir
+	mkdir -p $(BUILD)/$*
+	# we don't want modifications done by itk outside of server/mpm/experimental/itk
+	# to appear in the other mpms. Therefore we copy the whole source tree.
+	set -ex ;\
+	if [ $* = itk ] ; then \
+		cp -a `find . -maxdepth 1 -mindepth 1 -not -name debian` $(BUILD)/$* ;\
+		cd $(BUILD)/$* ;\
+		mkdir server/mpm/experimental/itk/ ;\
+		cp server/mpm/prefork/* server/mpm/experimental/itk/ ;\
+		mv server/mpm/experimental/itk/prefork.c server/mpm/experimental/itk/itk.c ;\
+		for PATCH in `tail -n +2 ../../mpm-itk/patches/series`; do \
+			echo Applying $$PATCH ... ;\
+			patch -p1 < ../../mpm-itk/patches/$$PATCH ;\
+			echo ;\
+		done ;\
+		autoheader ;\
+		autoconf ;\
+		CONFIGURE=./configure ;\
+	else \
+		cd $(BUILD)/$* ;\
+		CONFIGURE="$(REALCURDIR)/configure --srcdir=$(REALCURDIR)" ;\
+	fi ;\
+	if [ $* = worker ] ; then \
+		ENABLE_MODULES="$(AP2_MODS_CONFARGS)" ;\
+	else \
+		ENABLE_MODULES=--enable-modules=none ;\
+	fi ;\
+	CFLAGS="$(AP2_CFLAGS)" LDFLAGS="$(AP2_LDFLAGS)" $(CONFFLAGS) $$CONFIGURE \
+		$(AP2_COMMON_CONFARGS) $$ENABLE_MODULES --with-mpm=$*  ;\
+	$(MAKE) ;\
+	./$(name_prefix)httpd -l |grep -v $* > mods.list
+	touch $@
+
+mpm-%.scripts-stamp: debian/mpms.postinst debian/mpms.preinst debian/mpms.prerm debian/mpms.lintian-overrides debian/mpms.dirs debian/mpms.links
+	for f in postinst preinst prerm links dirs ; do \
+		perl -p -e "s/MPMXXX/$*/g" < debian/mpms.$$f > debian/$(name_prefix)httpd-mpm-$*.$$f ;\
+	done
+	perl -p -e "s/^/$(name_prefix)httpd-mpm-$*: /" < debian/mpms.lintian-overrides > debian/$(name_prefix)httpd-mpm-$*.lintian-overrides
+	touch $@
+
+install-worker: mpm-worker
+	dh_testdir
+	dh_testroot
+	cd $(BUILD)/worker ;\
+	$(MAKE) DESTDIR=$(REALCURDIR)/debian/tmp install
+	for m in logresolve ab; do d=$(REALCURDIR)/debian/tmp/$(pe_prefix)/share/man/ ;\
+	    perl -p -e 's/^([.]TH.*?) 8 (.*)/$$1 1 $$2/' < $$d/man8/$$m.8 > $$d/man1/$$m.1 ;\
+	done
+	ln -sf tmp debian/tmp-worker
+
+install-prefork: mpm-prefork
+	dh_testdir
+	dh_testroot
+	cd $(BUILD)/prefork ;\
+	$(MAKE) DESTDIR=$(REALCURDIR)/debian/tmp-prefork install
+
+install-dev: install-worker install-prefork
+	dh_testdir
+	dh_testroot
+	dh_installdirs
+	for i in worker prefork; do \
+		if [ "$$i" = "prefork" ]; then \
+			TARGET=prefork ;\
+		else \
+			TARGET=threaded ;\
+		fi ;\
+		mkdir -p debian/$(name_prefix)httpd-$$TARGET-dev/$(pe_prefix)/share/httpd/build/ ;\
+		cp debian/tmp-$$i/$(pe_prefix)/include/httpd/* debian/$(name_prefix)httpd-$$TARGET-dev/$(pe_prefix)/include/httpd/ ;\
+		cp debian/tmp-$$i/$(pe_prefix)/share/httpd/build/* debian/$(name_prefix)httpd-$$TARGET-dev/$(pe_prefix)/share/httpd/build/ ;\
+		cp $(BUILD)/$$i/support/apxs debian/$(name_prefix)httpd-$$TARGET-dev/$(pe_prefix)/bin/apxs2 ;\
+		chmod +x debian/$(name_prefix)httpd-$$TARGET-dev/$(pe_prefix)/bin/apxs2 ;\
+		perl -p -e s/^P=$(name_prefix)httpd/P=$(name_prefix)httpd-$${TARGET}-dev/ < debian/$(name_prefix)httpd.postinst > debian/$(name_prefix)httpd-$${TARGET}-dev.postinst ;\
+	done
+# Clean up config_vars.mk
+	set -x ; for i in threaded prefork; do \
+		( cd debian/$(name_prefix)httpd-$$i-dev/$(pe_prefix)/share/httpd/build/ ; \
+		grep -v -E '(^|_)(CPP|C)FLAGS' config_vars.mk > tmp_config_vars.mk ; \
+		printf "CPPFLAGS = %s\n" "`grep -E '(^|_)(CPPFLAGS|INCLUDES)' config_vars.mk | cut -d= -f 2- | tr ' ' '\n' | grep -E '^-([DI]|pthread)' | sort | uniq | tr '\n' ' '`" >> tmp_config_vars.mk ; \
+		printf "CFLAGS = %s\n" "`grep -E '(^|_)(CPPFLAGS|CFLAGS|INCLUDES)' config_vars.mk | cut -d= -f 2- | tr ' ' '\n' | grep -E '^-(D|I/|pthread)'  | sort | uniq | tr '\n' ' '`" >> tmp_config_vars.mk ; \
+		printf "NOTEST_CPPFLAGS = \n" >> tmp_config_vars.mk ; \
+		printf "EXTRA_CPPFLAGS = \n" >> tmp_config_vars.mk ; \
+		printf "EXTRA_CFLAGS = \n" >> tmp_config_vars.mk ; \
+		mv tmp_config_vars.mk config_vars.mk ) ; \
+	done
+
+install: build install-dev
+	dh_testroot
+	dh_testdir
+	dh_installdirs
+	
+	#cleanup of death
+	rm -rf debian/tmp/etc/puppetlabs/httpd/original
+	rm -f debian/tmp/$(pe_prefix)/share/man/man8/httpd.8 # We install our own
+	
+	# DO NOT FALL FOR THE TEMPTATION TO MV INTO PACKAGES OR DOOM
+	# WILL FIND YOU.  Use dh_install, this is just because dh_install
+	# can't rename files
+	
+	mv debian/tmp/$(pe_prefix)/share/man/man8/apxs.8 debian/tmp/$(pe_prefix)/share/man/man8/apxs2.8
+	mv debian/tmp/$(pe_prefix)/share/man/man8/apachectl.8 debian/tmp/$(pe_prefix)/share/man/man8/apache2ctl.8
+	for manpage in debian/tmp/$(pe_prefix)/share/man/man{1,8}/*; do \
+	  gzip --verbose --best "$${manpage}" ;\
+	 done
+	
+	mkdir -p debian/tmp/$(pe_prefix)/share/httpd/icons/
+	for i in `ls debian/icons/ | cut -d. -f1,2`; do \
+		uudecode -o debian/tmp/$(pe_prefix)/share/httpd/icons/$$i debian/icons/$$i".uue" ;\
+	done
+	
+	mkdir -p debian/tmp/usr/share/bug/$(name_prefix)httpd
+	install -m644 debian/$(name_prefix)httpd.bug-script debian/tmp/usr/share/bug/$(name_prefix)httpd/script
+	
+	dh_install --list-missing
+	
+	install -m644 debian/$(name_prefix)httpd.ufw.profile debian/$(name_prefix)httpd/etc/ufw/applications.d/$(name_prefix)httpd
+	
+	# standard suexec
+	chmod 4754 debian/$(name_prefix)httpd/$(pe_prefix)/lib/httpd/suexec
+	chmod 644 debian/$(name_prefix)httpd/$(pe_prefix)/lib/httpd/modules/mod_suexec.so
+	
+	# configurable suexec
+	cp debian/build-tree/worker/support/suexec-custom debian/$(name_prefix)httpd/$(pe_prefix)/lib/httpd/suexec
+	cp debian/suexec-custom.config debian/$(name_prefix)httpd/etc/puppetlabs/httpd/suexec/pe-apache
+	chmod 4754 debian/$(name_prefix)httpd/$(pe_prefix)/lib/httpd/suexec
+	
+	cp debian/$(name_prefix)httpd-doc.conf debian/$(name_prefix)httpd/etc/puppetlabs/httpd/conf.d/$(name_prefix)httpd-doc
+	grep -rl apachectl debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual | xargs perl -p -i -e 's/apachectl(?!\.html)/apache2ctl/g'
+	# remove content negotiation
+	mv debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual \
+		debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual.orig
+	perl debian/convert_docs debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual.orig \
+		debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual
+	mv debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual.orig/images \
+		debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual.orig/style \
+		debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual
+	find debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual -type d -print0 | xargs -0 chmod -v 755
+	find debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual -type f -print0 | xargs -0 chmod -v 644
+	rm -rf debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/manual.orig
+	
+	cp debian/logrotate debian/$(name_prefix)httpd/etc/logrotate.d/$(name_prefix)httpd
+	cp debian/default-index.html debian/$(name_prefix)httpd/$(pe_prefix)/share/httpd/default-site/index.html
+	
+	for i in worker prefork event itk; do \
+		install -m 755 $(BUILD)/$$i/$(name_prefix)httpd debian/$(name_prefix)httpd/$(pe_prefix)/lib/httpd/mpm-$$i/$(name_prefix)httpd ;\
+	done
+	
+	for pkg in `awk '/^Package:/ { print $$2 }' debian/control`; do \
+		find debian/$$pkg/ -name .svn -exec rm -rf {} + ;\
+	done
+	
+	dh_installdocs debian/README.backtrace -p$(name_prefix)httpd
+	dh_installdocs debian/README.backtrace debian/README.multiple-instances -p$(name_prefix)httpd
+	dh_installdocs -N$(name_prefix)httpd -N$(name_prefix)httpd
+	cp debian/README.Debian debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/
+	
+	# dh_installman isn't inclusive enough, and hasn't quite got a handle on how
+	# to package the man pages we distribute. It also doesn't gzip them, so out it goes.
+	mkdir -p debian/$(name_prefix)httpd/$(pe_prefix)/share/man/man8
+
+	cp debian/a2dismod.8 \
+		debian/a2dissite.8 \
+		debian/a2enmod.8 \
+		debian/a2ensite.8 \
+		debian/apache2ctl.8 \
+		debian/apachectl.8 \
+		debian/check_forensic.8 \
+		debian/checkgid.8 \
+		debian/httxt2dbm.8 \
+		debian/pe-httpd.8 \
+		debian/split-logfile.8 \
+		debian/$(name_prefix)httpd/$(pe_prefix)/share/man/man8/.
+
+	for manpage in debian/$(name_prefix)httpd/$(pe_prefix)/share/man/man8/*; do \
+		gzip --verbose --best "$${manpage}" ;\
+	done
+	
+	dh_installinit --no-start -r --name=$(name_prefix)httpd -- defaults 85 15
+	dh_installchangelogs CHANGES --package=$(name_prefix)httpd  --no-package=$(name_prefix)httpd-prefork-dev --no-package=$(name_prefix)httpd-threaded-dev
+	dh_lintian
+	rm -f debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/NEWS.Debian
+	
+	dh_strip -X$(pe_prefix)/lib/httpd/mpm
+	if [ "$(LSB_RELEASE)" != "Ubuntu" ] && [ -n "$(DEB_BUILD_STRIP)" ] ; then \
+		for i in worker prefork event itk; do \
+			MPM=$(pe_prefix)/lib/httpd/mpm-$$i/$(name_prefix)httpd ;\
+			strip --remove-section=.comment --remove-section=.note --strip-unneeded \
+					debian/$(name_prefix)httpd/$$MPM ;\
+		done ;\
+	fi
+	
+	cp debian/mpm-itk/README debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/README.mpm-itk
+	cp debian/mpm-itk/CHANGES debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/changelog.mpm-itk
+	cp debian/mpm-itk/debian/changelog debian/$(name_prefix)httpd/usr/share/doc/$(name_prefix)httpd/changelog.mpm-itk.Debian
+	for p in $(name_prefix)httpd-prefork $(name_prefix)httpd-threaded $(name_prefix)httpd-mpm-prefork $(name_prefix)httpd-mpm-event \
+		$(name_prefix)httpd-mpm-worker $(name_prefix)httpd-mpm-itk ;\
+	do \
+	  mkdir -p debian/$$p/usr/share/doc ;\
+		rm -rf debian/$$p/usr/share/doc/$$p ;\
+		ln -s $(name_prefix)httpd debian/$$p/usr/share/doc/$$p ;\
+	done
+	dh_link
+	dh_installexamples
+	dh_compress
+	dh_fixperms -Xsuexec
+	chown root:adm debian/$(name_prefix)httpd/var/log/$(name_prefix)httpd
+	chmod o-rx debian/$(name_prefix)httpd/var/log/$(name_prefix)httpd
+	chmod a+rx debian/$(name_prefix)httpd/$(pe_prefix)/sbin/a2enmod
+	chmod a+rx debian/$(name_prefix)httpd/$(pe_prefix)/sbin/apache2ctl
+	chmod a+rx debian/$(name_prefix)httpd/$(pe_prefix)/sbin/split-logfile
+	
+	touch $@
+
+binary-indep: install
+	dh_installdeb -i
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+binary-arch: install
+	dh_makeshlibs -a -V
+	dh_installdeb -a
+	dh_shlibdeps -a
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-arch binary-indep
--- pe-httpd-2.2.29.orig/debian/split-logfile.8
+++ pe-httpd-2.2.29/debian/split-logfile.8
@@ -0,0 +1,21 @@
+.TH "SPLIT-LOGFILE" 8 "2009-12-06" "Apache HTTP Server" "split-logfile"
+
+.SH NAME
+split-logfile - Split combined virtual hosts access log into one file per virtual host
+
+.SH "SYNOPSIS"
+ 
+.PP
+\fBsplit-logfile\fR < \fIlogfile\fR
+
+.SH "SUMMARY"
+ 
+.PP
+This script will take a combined Web server access log file and break its contents into separate files.
+It assumes that the first field of each line is the virtual host identity (put there by "%v"), and that the logfiles should be named that+".log" in the current directory.
+
+The combined log file is read from stdin.
+Records read will be appended to any existing log files.
+
+.SH "EXAMPLES"
+split-logfile < /var/log/apache2/other_vhosts_access.log
--- pe-httpd-2.2.29.orig/debian/pe-httpd.examples
+++ pe-httpd-2.2.29/debian/pe-httpd.examples
@@ -0,0 +1,3 @@
+debian/setup-instance
+debian/secondary-init-script
+debian/pe-httpd.monit
--- pe-httpd-2.2.29.orig/debian/README.source
+++ pe-httpd-2.2.29/debian/README.source
@@ -0,0 +1,17 @@
+Debian-apache uses dpatch to make changes to the upstream source.
+
+To apply all of the patches run:
+./debian/rules patch
+
+To unapply all of the patches run:
+./debian/rules unpatch
+
+To add (or edit) a patch run:
+dpatch-edit-patch name_of_patch_goes_here
+#make your changes
+exit
+
+dpatch will make a new patch in debian/patches/ if one with that name doesn't already exist, otherwise it will change the existing one.
+To make it get used add it to debian/patches/00list .
+
+To make a patch not get used remove it from debian/patches/00list .
--- pe-httpd-2.2.29.orig/debian/control
+++ pe-httpd-2.2.29/debian/control
@@ -0,0 +1,113 @@
+Source: pe-httpd
+Section: httpd
+Priority: optional
+Maintainer: Puppet Labs <info@puppetlabs.com>
+XSBC-Original-Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+Build-Depends: debhelper (>= 7.0.15), dpatch, lsb-release, libaprutil1, libaprutil1-dev (>= 1.2.12), libapr1-dev (>= 1.2.7-6), pe-openssl, libpcre3-dev, mawk, zlib1g-dev, sharutils, libcap-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], autoconf, hardening-wrapper
+Build-Conflicts: autoconf2.13
+Standards-Version: 3.9.0
+Homepage: http://httpd.apache.org/
+
+Package: pe-httpd
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, pe-httpd-mpm-worker (= ${binary:Version}) | pe-httpd-mpm-prefork (= ${binary:Version}) | pe-httpd-mpm-event (= ${binary:Version}) | pe-httpd-mpm-itk (= ${binary:Version}), libmagic1, mime-support, lsb-base, procps [!hurd-i386], perl, pe-puppet-enterprise-release
+Suggests: www-browser, ufw
+Provides: pe-httpd-dev, pe-httpd-doc, pe-httpd-suexec-custom, pe-httpd-suexec, pe-httpd-utils, pe-httpd-common,  pe-httpd-bin
+Replaces: pe-httpd-dev, pe-httpd-doc, pe-httpd-suexec-custom, pe-httpd-suexec, pe-httpd-utils, pe-httpd-common,  pe-httpd-bin
+Conflicts: pe-httpd-dev, pe-httpd-doc, pe-httpd-suexec-custom, pe-httpd-suexec, pe-httpd-utils, pe-httpd-common,  pe-httpd-bin
+Description: Puppet Enterprise Apache HTTP Server metapackage
+ Puppet Enterprise uses the Apache HTTP Server. The Apache Software Foundation's goal is
+ to build a secure, efficient and extensible HTTP server as standards-compliant open source
+ software. The result has long been the number one web server on the Internet.
+ .
+ This package contains the configuration and support binaries, scripts, and support scripts.
+ To complete a stand-alone server, you need to install one of the pe-httpd-mpm-*
+ packages, such as worker or prefork.
+
+Package: pe-httpd-mpm-worker
+Architecture: any
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version})
+Provides: pe-httpd-mpm
+Conflicts: pe-httpd-mpm
+Description: Apache HTTP Server - high speed threaded model
+ Each Apache Multi-Processing Module provides a different "flavor" of
+ web server binary, compiled with a different processing model.
+ .
+ The worker MPM provides the default threaded implementation. It is
+ recommended especially for high-traffic sites because it is faster
+ and has a smaller memory footprint than the traditional prefork MPM.
+
+Package: pe-httpd-mpm-prefork
+Architecture: any
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version})
+Pre-Depends: pe-httpd (= ${binary:Version})
+Provides: pe-httpd-mpm
+Conflicts: pe-httpd-mpm
+Description: Apache HTTP Server - traditional non-threaded model
+ Each Apache Multi-Processing Module provides a different "flavor" of
+ web server binary, compiled with a different processing model.
+ .
+ The prefork MPM provides a non-threaded, pre-forking implementation
+ that handles requests in a manner similar to Apache 1.3. It is not as
+ fast as threaded models, but is considered to be more stable. It is
+ appropriate for sites that need to maintain compatibility with
+ non-thread-safe libraries, and is the best MPM for isolating each
+ request, so that a problem with a single request will not affect any
+ other.
+
+Package: pe-httpd-mpm-event
+Architecture: any
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version})
+Pre-Depends: pe-httpd (= ${binary:Version})
+Provides: pe-httpd-mpm
+Conflicts: pe-httpd-mpm
+Description: Apache HTTP Server - event driven model
+ Each Apache Multi-Processing Module provides a different "flavor" of
+ web server binary, compiled with a different processing model.
+ .
+ The event MPM is designed to allow more requests to be served
+ simultaneously by passing off some processing work to supporting
+ threads, freeing up the main threads to work on new requests. It is
+ especially suitable for sites that see extensive KeepAlive traffic.
+ .
+ This MPM is experimental and less tested than the worker and prefork MPMs.
+
+Package: pe-httpd-mpm-itk
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version})
+Pre-Depends: pe-httpd (= ${binary:Version})
+Provides: pe-httpd-mpm
+Conflicts: pe-httpd-mpm
+Architecture: any
+Priority: extra
+Description: multiuser MPM for Apache 2.2
+ The ITK Multi-Processing Module (MPM) works in about the same way as the
+ classical "prefork" module (that is, without threads), except that it allows
+ you to constrain each individual vhost to a particular system user. This
+ allows you to run several different web sites on a single server without
+ worrying that they will be able to read each others' files. This is a
+ third-party MPM that is not included in the normal Apache httpd.
+ .
+ Please note that this MPM is somewhat less tested than the MPMs that come with
+ Apache itself.
+
+Package: pe-httpd-prefork-dev
+Architecture: any
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version}), pe-openssl, libaprutil1-dev
+Conflicts: pe-httpd-threaded-dev
+Priority: extra
+Description: Apache development headers - non-threaded MPM
+ This package provides the development headers and apxs2 binary for
+ pe-httpd-mpm-prefork; see the pe-httpd package description for more details.
+ .
+ This should only be used when you absolutely *must* support a non-threaded
+ environment (for PHP, for example).
+
+Package: pe-httpd-threaded-dev
+Architecture: any
+Depends: ${misc:Depends}, pe-httpd (= ${binary:Version}), pe-openssl, libaprutil1-dev
+Conflicts: pe-httpd-prefork-dev
+Priority: extra
+Description: Apache development headers - threaded MPM
+ This package provides the development headers and apxs2 binary for
+ threaded versions of pe-httpd; see the pe-httpd package description
+ for more details.
--- pe-httpd-2.2.29.orig/debian/source.lintian-overrides
+++ pe-httpd-2.2.29/debian/source.lintian-overrides
@@ -0,0 +1,3 @@
+pe-httpd source: ancient-autotools-helper-file srclib/apr-util/xml/expat/conftools/config.sub 2002-03-07
+pe-httpd source: ancient-autotools-helper-file srclib/apr-util/xml/expat/conftools/config.guess 2002-03-20
+pe-httpd source: build-depends-on-obsolete-package build-depends: dpatch
--- pe-httpd-2.2.29.orig/debian/pe-httpd.ufw.profile
+++ pe-httpd-2.2.29/debian/pe-httpd.ufw.profile
@@ -0,0 +1,14 @@
+[Apache]
+title=Web Server
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80/tcp
+
+[Apache Secure]
+title=Web Server (HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=443/tcp
+
+[Apache Full]
+title=Web Server (HTTP,HTTPS)
+description=Apache v2 is the next generation of the omnipresent Apache web server.
+ports=80,443/tcp
--- pe-httpd-2.2.29.orig/debian/default-index.html
+++ pe-httpd-2.2.29/debian/default-index.html
@@ -0,0 +1,4 @@
+<html><body><h1>It works!</h1>
+<p>This is the default web page for this server.</p>
+<p>The web server software is running but no content has been added, yet.</p>
+</body></html>
--- pe-httpd-2.2.29.orig/debian/pe-httpd-threaded-dev.lintian-overrides
+++ pe-httpd-2.2.29/debian/pe-httpd-threaded-dev.lintian-overrides
@@ -0,0 +1,4 @@
+pe-httpd-threaded-dev binary: dir-or-file-in-opt opt/puppet/
+pe-httpd-threaded-dev binary: dir-or-file-in-opt opt/puppet/bin/*
+pe-httpd-threaded-dev binary: dir-or-file-in-opt opt/puppet/include/*
+pe-httpd-threaded-dev binary: dir-or-file-in-opt opt/puppet/share/*
--- pe-httpd-2.2.29.orig/debian/pe-httpd.lintian-overrides
+++ pe-httpd-2.2.29/debian/pe-httpd.lintian-overrides
@@ -0,0 +1,406 @@
+pe-httpd binary: dir-or-file-in-opt opt/puppet/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/ab
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/dbmmanage
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/htdbm
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/htdigest
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/htpasswd
+pe-httpd binary: dir-or-file-in-opt opt/puppet/bin/logresolve
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/cgi-bin/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/httpd.exp
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_actions.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_alias.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_asis.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_auth_basic.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_auth_digest.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_alias.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_anon.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_dbd.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_dbm.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_default.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authn_file.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authnz_ldap.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_dbm.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_default.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_groupfile.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_host.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_owner.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_authz_user.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_autoindex.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_cache.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_cern_meta.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_cgi.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_cgid.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_charset_lite.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dav.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dav_fs.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dav_lock.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dbd.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_deflate.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dir.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_disk_cache.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_dumpio.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_env.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_expires.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_ext_filter.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_file_cache.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_filter.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_headers.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_ident.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_imagemap.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_include.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_info.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_ldap.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_log_forensic.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_mem_cache.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_mime.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_mime_magic.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_negotiation.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_ajp.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_balancer.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_connect.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_ftp.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_http.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_proxy_scgi.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_reqtimeout.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_rewrite.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_setenvif.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_speling.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_ssl.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_status.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_substitute.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_suexec.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_unique_id.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_userdir.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_usertrack.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_version.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/modules/mod_vhost_alias.so
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-event/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-event/pe-httpd
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-itk/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-itk/pe-httpd
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-prefork/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-prefork/pe-httpd
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-worker/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/lib/httpd/mpm-worker/pe-httpd
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/a2dismod
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/a2dissite
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/a2enmod
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/a2ensite
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/apache2ctl
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/check_forensic
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/checkgid
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/htcacheclean
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/httxt2dbm
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/rotatelogs
+pe-httpd binary: dir-or-file-in-opt opt/puppet/sbin/split-logfile
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/build/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/build/envvars-std
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/default-site/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/default-site/index.html
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/contact.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_BAD_GATEWAY.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_BAD_REQUEST.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_FORBIDDEN.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_GONE.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_INTERNAL_SERVER_ERROR.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_LENGTH_REQUIRED.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_METHOD_NOT_ALLOWED.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_NOT_FOUND.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_NOT_IMPLEMENTED.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_PRECONDITION_FAILED.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_REQUEST_TIME_OUT.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_REQUEST_URI_TOO_LARGE.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_SERVICE_UNAVAILABLE.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_UNAUTHORIZED.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/HTTP_VARIANT_ALSO_VARIES.html.var
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/include/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/include/bottom.html
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/include/spacer.html
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/include/top.html
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/error/README
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/a.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/a.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/alert.black.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/alert.black.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/alert.red.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/alert.red.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/apache_pb.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/apache_pb.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/apache_pb2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/apache_pb2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/apache_pb2_ani.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/back.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/back.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ball.gray.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ball.gray.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ball.red.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ball.red.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/binary.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/binary.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/binhex.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/binhex.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/blank.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/blank.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/bomb.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/bomb.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/box1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/box1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/box2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/box2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/broken.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/broken.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/burst.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/burst.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/c.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/c.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/comp.blue.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/comp.blue.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/comp.gray.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/comp.gray.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/compressed.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/compressed.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/continued.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/continued.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/dir.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/dir.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/diskimg.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/diskimg.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/down.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/down.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/dvi.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/dvi.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/f.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/f.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.open.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.open.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.sec.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/folder.sec.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/forward.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/forward.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.red.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.red.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.sec.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/generic.sec.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/hand.right.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/hand.right.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/hand.up.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/hand.up.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/icon.sheet.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/icon.sheet.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image3.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/image3.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/index.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/index.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/layout.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/layout.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/left.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/left.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/link.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/link.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/movie.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/movie.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odb-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odc-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odf-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odg-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odi-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odm-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odp-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6ods-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6odt-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6otc-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6otf-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6otg-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6oth-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6oti-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6otp-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6ots-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/odf6ott-20x22.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/p.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/p.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/patch.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/patch.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pdf.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pdf.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie0.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie0.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie3.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie3.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie4.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie4.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie5.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie5.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie6.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie6.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie7.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie7.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie8.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/pie8.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/portal.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/portal.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ps.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/ps.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/quill.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/quill.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/README
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/README.html
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/right.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/right.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/screw1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/screw1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/screw2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/screw2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/script.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/script.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/back.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/back.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/binary.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/binary.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/binhex.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/binhex.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/blank.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/blank.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/broken.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/broken.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/burst.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/burst.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/comp1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/comp1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/comp2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/comp2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/compressed.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/compressed.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/continued.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/continued.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/dir.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/dir.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/dir2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/dir2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/doc.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/doc.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/forward.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/forward.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic3.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/generic3.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/image.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/image.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/image2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/image2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/index.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/index.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/key.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/key.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/movie.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/movie.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/patch.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/patch.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/ps.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/ps.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/rainbow.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/rainbow.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/sound.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/sound.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/sound2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/sound2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/tar.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/tar.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/text.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/text.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/transfer.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/transfer.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/unknown.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/unknown.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/uu.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/small/uu.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sound1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sound1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sound2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sound2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sphere1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sphere1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sphere2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/sphere2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/tar.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/tar.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/tex.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/tex.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/text.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/text.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/transfer.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/transfer.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/unknown.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/unknown.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/up.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/up.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/uu.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/uu.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/uuencoded.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/uuencoded.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/world1.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/world1.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/world2.gif
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/httpd/icons/world2.png
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/ab.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/dbmmanage.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/htdbm.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/htdigest.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/htpasswd.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man1/logresolve.1
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/a2dismod.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/a2dissite.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/a2enmod.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/a2ensite.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/apache2ctl.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/apachectl.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/check_forensic.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/checkgid.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/htcacheclean.8
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/httxt2dbm.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/pe-httpd.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/rotatelogs.8
+pe-httpd binary: dir-or-file-in-opt opt/puppet/share/man/man8/split-logfile.8.gz
+pe-httpd binary: dir-or-file-in-opt opt/puppet/var/
+pe-httpd binary: dir-or-file-in-opt opt/puppet/var/www/
+pe-httpd binary: non-standard-dir-perm var/log/pe-httpd/ 0750 != 0755
+pe-httpd binary: package-contains-empty-directory opt/puppet/lib/cgi-bin/
+pe-httpd binary: setuid-binary opt/puppet/lib/httpd/suexec 4754 root/pe-apache
+pe-httpd binary: unstripped-binary-or-object ./opt/puppet/lib/httpd/mpm-event/pe-httpd
+pe-httpd binary: unstripped-binary-or-object ./opt/puppet/lib/httpd/mpm-itk/pe-httpd
+pe-httpd binary: unstripped-binary-or-object ./opt/puppet/lib/httpd/mpm-prefork/pe-httpd
+pe-httpd binary: unstripped-binary-or-object ./opt/puppet/lib/httpd/mpm-worker/pe-httpd
+pe-httpd binary: unstripped-binary-or-object opt/puppet/lib/httpd/mpm-event/pe-httpd
+pe-httpd binary: unstripped-binary-or-object opt/puppet/lib/httpd/mpm-itk/pe-httpd
+pe-httpd binary: unstripped-binary-or-object opt/puppet/lib/httpd/mpm-prefork/pe-httpd
+pe-httpd binary: unstripped-binary-or-object opt/puppet/lib/httpd/mpm-worker/pe-httpd
--- pe-httpd-2.2.29.orig/debian/apachectl.8
+++ pe-httpd-2.2.29/debian/apachectl.8
@@ -0,0 +1 @@
+.so man8/apache2ctl.8
--- pe-httpd-2.2.29.orig/debian/changelog
+++ pe-httpd-2.2.29/debian/changelog
@@ -0,0 +1,288 @@
+pe-httpd (2.2.29-1puppet5) lucid squeeze precise wheezy trusty; urgency=low
+
+  * Update to 2.2.29 with release 5
+
+ -- Puppet Labs Release <info@puppetlabs.com>  Fri, 05 Jun 2015 14:17:14 -0700
+
+pe-httpd (2.2.29-1puppet5) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-4749) Add patch to help mitigate Logjam SSL vulnerability.
+
+-- Ryan McKern <mckern@puppetlabs.com>  Wed, 13 Aug 2014 09:24:43 -0700
+
+pe-httpd (2.2.27-1puppet11) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-2559) Add patches to Debs for August 2014 HTTPD CVEs
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Wed, 13 Aug 2014 09:24:43 -0700
+
+pe-httpd (2.2.27-1puppet10) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (PE-2098) Unify pe-httpd-bin, pe-httpd-common, pe-httpd-utilities
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Fri, 08 Aug 2014 09:22:51 -0700
+
+pe-httpd (2.2.27-1puppet9) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (PE-4519) Dpkg pe-httpd init script uses bad logic to get pid
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Wed, 11 Jun 2014 16:37:22 -0700
+
+pe-httpd (2.2.27-1puppet8) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Activate mod_rewrite properly on upgrades
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 27 May 2014 15:00:17 -0700
+
+pe-httpd (2.2.27-1puppet7) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Move the version check function similarly to rpm
+
+ -- AJ Roetker <andrew.roetker@puppetlabs.com>  Wed, 21 May 2014 10:32:17 -0700
+
+pe-httpd (2.2.27-1puppet6) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Bump release to 2.2.27-1puppet6 to avoid version conflict with PE 3.2.x
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Mon, 19 May 2014 10:32:17 -0700
+
+pe-httpd (2.2.27-1puppet4) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Rebuild against latest pe-openssl release
+
+ -- Ryan McKern <ryan.mckern@puppetlabs.com>  Tue, 29 Apr 2014 11:44:23 -0700
+
+pe-httpd (2.2.27-1puppet3) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Update debian/changelog
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Fri, 28 Mar 2014 09:17:10 -0700
+
+pe-httpd (2.2.27-1puppet2) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-1427) Bump release for PE 3.2.2
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Thu, 27 Mar 2014 13:25:29 -0700
+
+pe-httpd (2.2.27-1puppet1) squeeze lucid precise; urgency=low
+
+  * (RE-1425) Update to 2.2.27 for CVE-2014-0098 and CVE-2013-6438
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Thu, 27 Mar 2014 18:12:59 +0000
+
+pe-httpd (2.2.25-1puppet8) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-1189) Update pe-apache to link against pe-openssl
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Fri, 21 Mar 2014 10:55:45 -0700
+
+pe-httpd (2.2.25-1puppet7) lucid squeeze precise wheezy; urgency=low
+
+  * (QA-554) Specify the version check host:port in answer file
+
+ -- Andrew Roetker <andrew.roetker@puppetlabs.com>  Fri, 03 Jan 2014 14:00:00 +0000
+
+pe-httpd (2.2.25-1puppet6) lucid squeeze precise wheezy; urgency=low
+
+  * (pe-2195) Puppetdb.conf exist? before update check
+
+ -- Andrew Roetker <andrew.roetker@puppetlabs.com>  Mon, 25 Nov 2013 14:00:00 +0000
+
+pe-httpd (2.2.25-1puppet5) lucid squeeze precise wheezy; urgency=low
+
+  * (PE-1940) gzip JSON output
+  * (PE-1569) Remove license check from init script
+
+ -- Lindsey Smith <lindsey@puppetlabs.com>  Tue, 19 Nov 2013 17:00:00 +0000
+
+pe-httpd (2.2.25-1puppet3) lucid squeeze precise wheezy; urgency=low
+
+  * Activate mod_rewrite properly on upgrades
+
+ -- Branan Purvine-Riley <branan@puppetlabs.com>  Sun, 15 Sep 2013 01:44:37 +0000
+
+pe-httpd (2.2.25-1puppet2) lucid squeeze precise wheezy; urgency=low
+
+  * Enable mod_rewrite
+
+ -- Melissa Stone <melissa@puppetlabs.com>  Fri, 13 Sep 2013 15:14:49 +0000
+
+pe-httpd (2.2.25-1puppet1) lucid squeeze precise wheezy; urgency=low
+
+  * Update to upstream 2.2.25
+
+ -- Moses Mendoza <moses@puppetlabs.com>  Thu, 25 Jul 2013 16:16:49 +0000
+
+pe-httpd (2.2.16-1puppet29) lucid squeeze precise wheezy; urgency=low
+
+  * (#15383) Update pe-httpd to use pe-apache group and user
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 22:15:29 +0000
+
+pe-httpd (2.2.16-1puppet28) lucid squeeze precise wheezy; urgency=low
+
+  * (maint) move license and version checks to start
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 20:27:56 +0000
+
+pe-httpd (2.2.16-1puppet27) lucid squeeze precise wheezy; urgency=low
+
+  * Remove rmdir calls that are suddenly failing.
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 20:24:49 +0000
+
+pe-httpd (2.2.16-1puppet26) wheezy; urgency=low
+
+  * (#18159) Add answer to override update check
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Mon, 17 Dec 2012 23:33:00 +0000
+
+pe-httpd (2.2.16-1puppet25) wheezy; urgency=low
+
+  * Rebuild for wheezy
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Wed, 31 Oct 2012 13:44:19 -0700
+
+pe-httpd (2.2.16-1puppet24) precise; urgency=low
+
+  * Have pe-httpd report version to updates.puppetlabs.com
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Fri, 26 Oct 2012 14:41:17 -0700
+
+pe-httpd (2.2.16-1puppet23) precise; urgency=low
+
+  * Patching mod_ssl to disable SSLv2
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Tue, 17 Apr 2012 00:13:40 +0000
+
+pe-httpd (2.2.16-1puppet21) precise; urgency=low
+
+  * Adding SSL2 patch, updating control to depend on the right things.
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Wed, 11 Apr 2012 23:07:49 +0000
+
+pe-httpd (2.2.16-1puppet20) precise; urgency=low
+
+  * Update Apache CVE for lucid
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Fri, 16 Mar 2012 17:18:55 +0000
+
+pe-httpd (2.2.16-1puppet19) precise; urgency=low
+
+  * (#11699, #9626) Fix css, js file permissions in dashboard
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Sat, 07 Jan 2012 00:16:30 +0000
+
+pe-httpd (2.2.16-1puppet18) precise; urgency=low
+
+  * (#11341) Make pe-httpd-{bin,util} depend on pe-per
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Wed, 04 Jan 2012 22:06:04 +0000
+
+pe-httpd (2.2.16-1puppet17) precise; urgency=low
+
+  * Adding precise branch
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 27 Dec 2011 16:15:45 +0000
+
+pe-httpd (2.2.16-1puppet16) precise; urgency=low
+
+  * Patching for latest round of Apache httpd CVEs
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 13 Dec 2011 19:27:15 +0000
+
+pe-httpd (2.2.16-1puppet15) precise; urgency=low
+
+  * (#10732) Tweak apache configuration for passenger
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 10 Nov 2011 21:44:14 -0800
+
+pe-httpd (2.2.16-1puppet14) precise; urgency=low
+
+  * (#10407) Ubuntu/debian gets a better init script
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Wed, 09 Nov 2011 11:16:29 -0800
+
+pe-httpd (2.2.16-1puppet13) precise; urgency=low
+
+  * (#10612) Bump maxclients to 300 to improve performance.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Mon, 07 Nov 2011 17:57:52 -0800
+
+pe-httpd (2.2.16-1puppet12) precise; urgency=low
+
+  * Remove autostart in posts
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 06 Oct 2011 19:04:27 -0700
+
+pe-httpd (2.2.16-1puppet11) precise; urgency=low
+
+  * Add Depend on pe-puppet-enteprise-release
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 19 Jul 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet10) precise; urgency=low
+
+  * (#7159) Making logrotate identical to RHEL version.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 19 Jul 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet9) precise; urgency=low
+
+  * [3675493] (#7159) Fix logrotate for apache2 package.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 28 Jun 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet8) precise; urgency=low
+
+  * [f61b7f4] Fixing lintian errors for httpd/apache.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 16 Jun 2011 16:41:35 -0700
+
+pe-httpd (2.2.16-1puppet7) precise; urgency=low
+
+  * [9ff6e08] Remove pe-httpd-dbg
+  * [64f85ad] Remove debian/NEWS
+  * [99f91df] Update required package versions for building on Debian
+
+  * [ee6b58d] Update maintainer information in debian/control to reflect
+    Puppet Labs
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 13 Jan 2011 14:43:56 -0800
+
+pe-httpd (2.2.16-1puppet6) precise; urgency=low
+
+  * [9a03cfe] Fixup whitespace in pe-httpd-common.postinst
+  * [643cd26] Enable headers module in pe-httpd-common.postinst
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 06 Jan 2011 11:45:05 -0800
+
+pe-httpd (2.2.16-1puppet5) precise; urgency=low
+
+  * [0368813] Disable listening on ports 80, and 443 by default
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Wed, 29 Dec 2010 23:03:21 -0500
+
+pe-httpd (2.2.16-1puppet4) precise; urgency=low
+
+  * Update to gbp.conf
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Fri, 17 Dec 2010 09:50:43 -0800
+
+pe-httpd (2.2.16-1puppet3) precise; urgency=low
+
+  * [adee939] Use name of config files, instead of the .so for mod_ssl
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Tue, 14 Dec 2010 10:35:41 -0800
+
+pe-httpd (2.2.16-1puppet2) precise; urgency=low
+
+  * [05f31c8] Enable mod_ssl by default
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Mon, 13 Dec 2010 18:05:01 -0800
+
+pe-httpd (2.2.16-1puppet1) precise; urgency=low
+
+  * [d69bba7] Start packaging Apache for Puppet Enterprise
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 09 Dec 2010 15:46:30 -0800
--- pe-httpd-2.2.29.orig/debian/pe-httpd-prefork-dev.lintian-overrides
+++ pe-httpd-2.2.29/debian/pe-httpd-prefork-dev.lintian-overrides
@@ -0,0 +1,8 @@
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/bin/
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/bin/apxs2
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/include/
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/include/httpd/*
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/share/
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/share/httpd/*
+pe-httpd-prefork-dev binary: dir-or-file-in-opt opt/puppet/share/man/*
--- pe-httpd-2.2.29.orig/debian/mpms.prerm
+++ pe-httpd-2.2.29/debian/mpms.prerm
@@ -0,0 +1,27 @@
+#!/bin/sh -e
+
+# Apache2 prerm
+# Thom May <thom@debian.org>
+
+case "$1" in
+        upgrade|remove)
+		if [ -x "/etc/init.d/pe-httpd" ]; then
+			if [ -x /usr/sbin/invoke-rc.d ]; then
+				invoke-rc.d pe-httpd stop || true
+			else
+				/etc/init.d/pe-httpd stop || true
+			fi
+		fi
+		sleep 2
+        ;;
+        deconfigure|failed-upgrade)
+        ;;
+        *)
+                echo "prerm called with unknown argument \`$1'" >&2
+                exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- pe-httpd-2.2.29.orig/debian/checkgid.8
+++ pe-httpd-2.2.29/debian/checkgid.8
@@ -0,0 +1,36 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH CHECKGID 8 "November 3rd, 2001"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+checkgid \- checks the gid 
+.SH SYNOPSIS
+.B checkgid group 
+.SH DESCRIPTION
+This manual page documents briefly the
+.B checkgid 
+command.
+.PP
+.\" TeX users may be more comfortable with the \fB<whatever>\fP and
+.\" \fI<whatever>\fP escape sequences to invode bold face and italics, 
+.\" respectively.
+\fBcheckgid\fP is a program that checks whether it can setgid to the group
+specified. This is to see if it is a valid group for apache2 to use at runtime.
+If the user (should be run as superuser) is in that group, or can setgid to it,
+it will return 0.
+.SH AUTHOR
+This manual page was written by Daniel Stone <daniel@sfarc.net> for the Debian
+GNU/Linux distribution, as the original did not have a manpage.
--- pe-httpd-2.2.29.orig/debian/pe-httpd.preinst
+++ pe-httpd-2.2.29/debian/pe-httpd.preinst
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+set -e
+
+pe_docroot='/opt/puppet/var/www'
+usergroup='pe-apache'
+
+# Add the pe-apache group and user
+getent group "${usergroup}" > /dev/null 2>&1 || groupadd -r "${usergroup}"
+getent passwd "${usergroup}" > /dev/null 2>&1 || \
+  useradd \
+    -r \
+    -g "${usergroup}" \
+    -d "${pe_docroot}" \
+    -s /usr/sbin/nologin \
+    -c "Puppet Enterprise Apache" \
+    "${usergroup}"
+
+#DEBHELPER#
--- pe-httpd-2.2.29.orig/debian/pe-httpd-threaded-dev.install
+++ pe-httpd-2.2.29/debian/pe-httpd-threaded-dev.install
@@ -0,0 +1 @@
+opt/puppet/share/man/man8/apxs2.8.gz
--- pe-httpd-2.2.29.orig/debian/pe-httpd.conf
+++ pe-httpd-2.2.29/debian/pe-httpd.conf
@@ -0,0 +1,10 @@
+Alias /manual /usr/share/doc/apache2-doc/manual/
+
+<Directory "/usr/share/doc/apache2-doc/manual/">
+    Options Indexes FollowSymlinks
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+    AddDefaultCharset off
+</Directory>
+
--- pe-httpd-2.2.29.orig/debian/httxt2dbm.8
+++ pe-httpd-2.2.29/debian/httxt2dbm.8
@@ -0,0 +1,41 @@
+.TH "HTTXT2DBM" 8 "2007-06-26" "Apache HTTP Server" "httxt2dbm"
+
+.SH NAME
+httxt2dbm - Generate dbm files for use with RewriteMap
+
+.SH "SYNOPSIS"
+ 
+.PP
+\fBhttxt2dbm\fR [ \fB\-v\fR ] [ \fB\-f\fR \fIDBM_TYPE\fR ] \fB\-i\fR \fISOURCE_TXT\fR \fB\-o\fR \fIOUTPUT_DBM\fR 
+
+.SH "SUMMARY"
+ 
+.PP
+\fBhttxt2dbm\fR is used to generate dbm files from text input, for use in RewriteMap with the dbm map type.
+
+.SH "OPTIONS"
+ 
+.TP
+\-v
+More verbose output
+.TP
+\-f \fIDBM_TYPE\fR
+Specify the DBM type to be used for the output. If not specified, will use the APR Default. Available types are:
+ GDBM for GDBM files
+ SDBM for SDBM files
+ DB for berkeley DB files
+ NDBM for NDBM files
+ default for the default DBM type 
+.TP
+\-i \fISOURCE_TXT\fR
+Input file from which the dbm is to be created. The file should be formated with one record per line, of the form:
+ key value
+See the documentation for RewriteMap for further details of this file's format and meaning. 
+.TP
+\-o \fIOUTPUT_DBM\fR
+Name of the output dbm files.
+
+.SH "EXAMPLES"
+httxt2dbm \-i rewritemap.txt \-o rewritemap.dbm
+
+httxt2dbm \-f SDBM \-i rewritemap.txt \-o rewritemap.dbm
--- pe-httpd-2.2.29.orig/debian/README.backtrace
+++ pe-httpd-2.2.29/debian/README.backtrace
@@ -0,0 +1,51 @@
+If apache crashes or freezes, it is helpful if you include a backtrace in the
+bug report.
+
+
+
+In case of a crash, do the following:
+
+1) Install the packages apache2-dbg libapr1-dbg libaprutil1-dbg gdb. 
+
+2) Add "CoreDumpDirectory /var/cache/apache2" to your apache configuration.
+
+3) Execute as root:
+	/etc/init.d/apache2 stop
+	ulimit -c unlimited
+	/etc/init.d/apache2 start
+
+4) Do whatever it takes to reproduce the crash. There should now be the file
+/var/cache/apache2/core .
+
+5) If you use apache2-mpm-prefork, execute:
+	
+	gdb /usr/sbin/apache2 /var/cache/apache2/core
+	(gdb) bt full
+	...
+	(gdb) quit
+
+If you use a threaded mpm, execute:
+
+	gdb /usr/sbin/apache2 /var/cache/apache2/core
+        (gdb) thread apply all bt full
+	...
+	(gdb) quit
+
+Include the backtrace in the bug report.
+
+6) Undo the change to your configuration, uninstall the debug packages, remove
+/var/cache/apache2/core
+
+
+
+In case of a hanging process, you don't need a core dump and you can skip steps 2 and 3.
+
+4) Reproduce the problem. Get the pid of a hanging process.
+
+5) Start gdb with
+
+	gdb -p pid
+
+and continue as described above. It may also be helpful to include the output of
+
+	strace -p pid
--- pe-httpd-2.2.29.orig/debian/pe-httpd.links
+++ pe-httpd-2.2.29/debian/pe-httpd.links
@@ -0,0 +1,3 @@
+opt/puppet/sbin/a2enmod opt/puppet/sbin/a2dismod
+opt/puppet/sbin/a2enmod opt/puppet/sbin/a2dissite
+opt/puppet/sbin/a2enmod opt/puppet/sbin/a2ensite
--- pe-httpd-2.2.29.orig/debian/watch
+++ pe-httpd-2.2.29/debian/watch
@@ -0,0 +1,2 @@
+version=3
+http://www.apache.org/dist/httpd/httpd-(2\.2.*)\.tar\.gz
--- pe-httpd-2.2.29.orig/debian/apache2ctl
+++ pe-httpd-2.2.29/debian/apache2ctl
@@ -0,0 +1,154 @@
+#!/bin/sh
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+#
+# Apache control script designed to allow an easy command line interface
+# to controlling Apache.  Written by Marc Slemko, 1997/08/23
+#
+# Heavily modified for Debian by Stefan Fritsch 2007-2010
+# 
+# The exit codes returned are:
+#   XXX this doc is no longer correct now that the interesting
+#   XXX functions are handled by httpd
+#	0 - operation completed successfully
+#	1 - 
+#	2 - usage error
+#	3 - httpd could not be started
+#	4 - httpd could not be stopped
+#	5 - httpd could not be started during a restart
+#	6 - httpd could not be restarted during a restart
+#	7 - httpd could not be restarted during a graceful restart
+#	8 - configuration syntax error
+#
+# When multiple arguments are given, only the error from the _last_
+# one is reported.  Run "apachectl help" for usage info
+#
+ARGV="$@"
+#
+# |||||||||||||||||||| START CONFIGURATION SECTION  ||||||||||||||||||||
+# --------------------                              --------------------
+#
+# main configuration directory
+if test -z "$APACHE_CONFDIR" ; then
+	if test "${0##*apache2ctl-}" != "$0" ; then
+		APACHE_CONFDIR="/etc/puppetlabs/httpd-${0##*apache2ctl-}"
+	else
+		APACHE_CONFDIR=/etc/puppetlabs/httpd
+	fi
+fi
+# the path to the environment variable file
+test -z "$APACHE_ENVVARS" && APACHE_ENVVARS="$APACHE_CONFDIR/envvars"
+# pick up any necessary environment variables
+if test -f $APACHE_ENVVARS; then
+  . $APACHE_ENVVARS
+fi
+
+if test "$APACHE_CONFDIR" != /etc/puppetlabs/httpd ; then
+	APACHE_ARGUMENTS="-d $APACHE_CONFDIR $APACHE_ARGUMENTS"
+fi
+# the following APACHE_* variables should be set in /etc/puppetlabs/httpd/envvars
+#
+# the path to your httpd binary, including options if necessary
+HTTPD=${APACHE_HTTPD:-/opt/puppet/sbin/pe-httpd}
+#
+# a command that outputs a formatted text version of the HTML at the
+# url given on the command line.  Designed for lynx, however other
+# programs may work.  
+LYNX="${APACHE_LYNX:-www-browser -dump}"
+#
+# the URL to your server's mod_status status page.  If you do not
+# have one, then status and fullstatus will not work.
+STATUSURL="${APACHE_STATUSURL:-http://localhost:80/server-status}"
+#
+# Set this variable to a command that increases the maximum
+# number of file descriptors allowed per child process. This is
+# critical for configurations that use many file descriptors,
+# such as mass vhosting, or a multithreaded server.
+ULIMIT_MAX_FILES="${APACHE_ULIMIT_MAX_FILES:-ulimit -S -n `ulimit -H -n`}"
+# --------------------                              --------------------
+# ||||||||||||||||||||   END CONFIGURATION SECTION  ||||||||||||||||||||
+
+# Set the maximum number of file descriptors allowed per child process.
+if [ "x$ULIMIT_MAX_FILES" != "x" ] ; then
+    $ULIMIT_MAX_FILES
+fi
+
+ERROR=0
+if [ "x$ARGV" = "x" ] || [ "x$ARGV" = "xusage" ] || [ "x$ARGV" = "xhelp" ] || [ "x$ARGV" = "x--help" ]; then 
+    echo "Usage: $0 start|stop|restart|graceful|graceful-stop|configtest|status|fullstatus|help" >&2
+    echo "       $0 <pe-httpd args>" >&2
+    echo "       $0 -h            (for help on <pe-httpd args>)" >&2
+    exit 1
+fi
+
+get_status () {
+    if ! $LYNX $STATUSURL ; then
+        echo "'$LYNX $STATUSURL'" failed. >&2
+        echo Maybe you need to install a package providing www-browser or you >&2
+        echo need to adjust the APACHE_LYNX variable in /etc/puppetlabs/httpd/envvars >&2
+        exit 1
+    fi
+}
+
+case $ARGV in
+start)
+    mkdir -p ${APACHE_RUN_DIR:-/var/run/pe-httpd}
+    install -d -o ${APACHE_RUN_USER:-pe-apache} ${APACHE_LOCK_DIR:-/var/lock/pe-httpd}
+    # ssl_scache shouldn't be here if we're just starting up.
+    # (this is bad if there are several pe-httpd instances running)
+    rm -f ${APACHE_RUN_DIR:-/var/run/pe-httpd}/*ssl_scache*
+    $HTTPD ${APACHE_ARGUMENTS} -k $ARGV
+    ERROR=$?
+    ;;
+stop|graceful-stop)
+    $HTTPD ${APACHE_ARGUMENTS} -k $ARGV
+    ERROR=$?
+    ;;
+restart|graceful)
+    if $HTTPD ${APACHE_ARGUMENTS} -t 2> /dev/null ; then
+        $HTTPD ${APACHE_ARGUMENTS} -k $ARGV
+    else
+        $HTTPD ${APACHE_ARGUMENTS} -t
+    fi
+    ERROR=$?
+    ;;
+startssl|sslstart|start-SSL)
+    echo The startssl option is no longer supported.
+    echo Please edit httpd.conf to include the SSL configuration settings
+    echo and then use "apachectl start".
+    ERROR=2
+    ;;
+configtest)
+    $HTTPD ${APACHE_ARGUMENTS} -t
+    ERROR=$?
+    ;;
+status)
+    get_status | awk ' /process$/ { print; exit } { print } '
+    ;;
+fullstatus)
+    get_status
+    ;;
+*)
+    $HTTPD ${APACHE_ARGUMENTS} $ARGV
+    ERROR=$?
+esac
+
+if [ "$ERROR" != 0 ] ; then
+	echo Action \'"$@"\' failed.
+	echo The Apache error log may have more information.
+fi
+exit $ERROR
--- pe-httpd-2.2.29.orig/debian/mpms.install
+++ pe-httpd-2.2.29/debian/mpms.install
@@ -0,0 +1,5 @@
+opt/puppet/bin
+opt/puppet/include/httpd
+opt/puppet/lib/httpd/mpm-MPMXXX
+opt/puppet/share/httpd/build
+usr/share/bug/pe-httpd-mpm-MPMXXX
--- pe-httpd-2.2.29.orig/debian/mpms.dirs
+++ pe-httpd-2.2.29/debian/mpms.dirs
@@ -0,0 +1,6 @@
+opt/puppet/bin
+opt/puppet/lib/httpd/mpm-MPMXXX
+opt/puppet/sbin
+opt/puppet/share/man/man8
+usr/share/bug/pe-httpd-mpm-MPMXXX
+usr/share/lintian/overrides
--- pe-httpd-2.2.29.orig/debian/suexec-custom.config
+++ pe-httpd-2.2.29/debian/suexec-custom.config
@@ -0,0 +1,5 @@
+/var/www
+public_html/cgi-bin
+# The first two lines contain the suexec document root and the suexec userdir
+# suffix. Both features can be disabled separately by prepending a # character.
+# This config file is only used by the apache2-suexec-custom package.
--- pe-httpd-2.2.29.orig/debian/pe-httpd.install
+++ pe-httpd-2.2.29/debian/pe-httpd.install
@@ -0,0 +1,34 @@
+debian/a2enmod		opt/puppet/sbin
+debian/apache2ctl	opt/puppet/sbin
+debian/build-tree/worker/support/split-logfile  opt/puppet/sbin
+debian/config-dir/*	etc/puppetlabs/httpd
+etc/puppetlabs/httpd		usr/share/doc/pe-httpd/examples
+opt/puppet/lib/cgi-bin/printenv usr/share/doc/pe-httpd/cgi-examples
+opt/puppet/lib/cgi-bin/test-cgi usr/share/doc/pe-httpd/cgi-examples
+opt/puppet/lib/httpd/modules
+opt/puppet/sbin/ab                              opt/puppet/bin/
+opt/puppet/sbin/checkgid
+opt/puppet/sbin/dbmmanage                       opt/puppet/bin/
+opt/puppet/sbin/envvars-std	opt/puppet/share/httpd/build
+opt/puppet/sbin/htcacheclean
+opt/puppet/sbin/htdbm                           opt/puppet/bin/
+opt/puppet/sbin/htdigest                        opt/puppet/bin/
+opt/puppet/sbin/htpasswd                        opt/puppet/bin/
+opt/puppet/sbin/httxt2dbm
+opt/puppet/sbin/logresolve                      opt/puppet/bin/
+opt/puppet/sbin/rotatelogs
+opt/puppet/sbin/suexec opt/puppet/lib/httpd
+opt/puppet/share/httpd/default-site/htdocs/manual usr/share/doc/pe-httpd
+opt/puppet/share/httpd/error
+opt/puppet/share/httpd/icons
+opt/puppet/share/man/man1/ab.1.gz
+opt/puppet/share/man/man1/dbmmanage.1.gz
+opt/puppet/share/man/man1/htdbm.1.gz
+opt/puppet/share/man/man1/htdigest.1.gz
+opt/puppet/share/man/man1/htpasswd.1.gz
+opt/puppet/share/man/man1/logresolve.1.gz
+opt/puppet/share/man/man8/htcacheclean.8.gz
+opt/puppet/share/man/man8/rotatelogs.8.gz
+opt/puppet/share/man/man8/suexec.8.gz
+support/check_forensic                          opt/puppet/sbin
+usr/share/bug/pe-httpd/script
--- pe-httpd-2.2.29.orig/debian/pe-httpd-dbg.dirs
+++ pe-httpd-2.2.29/debian/pe-httpd-dbg.dirs
@@ -0,0 +1,5 @@
+usr/lib/debug/usr/sbin
+usr/lib/debug/usr/lib/httpd/mpm-worker
+usr/lib/debug/usr/lib/httpd/mpm-prefork
+usr/lib/debug/usr/lib/httpd/mpm-event
+usr/lib/debug/usr/lib/httpd/mpm-itk
--- pe-httpd-2.2.29.orig/debian/a2enmod
+++ pe-httpd-2.2.29/debian/a2enmod
@@ -0,0 +1,341 @@
+#!/usr/bin/perl -w
+#
+# a2enmod by Stefan Fritsch <sf@debian.org>
+# Licensed under Apache License 2.0
+
+use strict;
+use Cwd 'realpath';
+use File::Spec;
+use File::Basename;
+use Getopt::Long;
+
+my $quiet;
+my $force;
+Getopt::Long::Configure('bundling');
+GetOptions(
+    'quiet|q' => \$quiet,
+    'force|f' => \$force
+) or exit 2;
+
+my $basename = basename($0);
+$basename =~ /^a2(en|dis)(mod|site)((?:-.+)?)$/
+    or die "$basename call name unknown\n";
+my $act        = $1;
+my $obj        = $2;
+my $dir_suffix = $3;
+
+my $env_file = $ENV{APACHE_ENVVARS}
+    || (
+    $ENV{APACHE_CONFDIR}
+    ? "$ENV{APACHE_CONFDIR}/envvars"
+    : "/etc/puppetlabs/httpd$dir_suffix/envvars"
+    );
+$ENV{LANG}='C';
+read_env_file($env_file);
+
+$act .= 'able';
+my ( $name, $dir, $sffx, $reload );
+if ( $obj eq 'mod' ) {
+    $obj    = 'module';
+    $dir    = 'mods';
+    $sffx   = '.load';
+    $reload = 'restart';
+}
+else {
+    $dir    = 'sites';
+    $sffx   = '';
+    $reload = 'reload';
+}
+$name = ucfirst($obj);
+
+my $confdir  = $ENV{APACHE_CONFDIR}                  || "/etc/puppetlabs/httpd$dir_suffix";
+my $availdir = $ENV{ uc("APACHE_${dir}_AVAILABLE") } || "$confdir/$dir-available";
+my $enabldir = $ENV{ uc("APACHE_${dir}_ENABLED") }   || "$confdir/$dir-enabled";
+
+my $choicedir = $act eq 'enable' ? $availdir : $enabldir;
+my $linkdir = File::Spec->abs2rel( $availdir, $enabldir );
+
+my $request_reload = 0;
+
+my $rc = 0;
+
+if ( !scalar @ARGV ) {
+    my @choices = myglob('*');
+    print "Your choices are: @choices\n";
+    print "Which ${obj}(s) do you want to $act (wildcards ok)?\n";
+    my $input = <>;
+    @ARGV = split /\s+/, $input;
+
+}
+
+my @objs;
+foreach my $arg (@ARGV) {
+    my @glob = myglob($arg);
+    if ( !@glob ) {
+        error("No $obj found matching $arg!\n");
+        $rc = 1;
+    }
+    else {
+        push @objs, @glob;
+    }
+}
+
+foreach my $acton (@objs) {
+    doit($acton) or $rc = 1;
+}
+
+info("Run '/etc/init.d/pe-httpd $reload' to activate new configuration!\n")
+    if $request_reload;
+
+exit($rc);
+
+##############################################################################
+
+sub myglob {
+    my $arg = shift;
+
+    my @glob = map {
+        s{^$choicedir/}{};
+        s{$sffx$}{};
+        s{^000-default$}{default};
+        $_
+    } glob("$choicedir/$arg$sffx");
+
+    # use same rules as apache's Include directive
+    @glob = grep( /^[[:alnum:]][-._[:alnum:]]*$/, @glob );
+    @glob = grep( !/\.dpkg/, @glob );
+
+    return @glob;
+}
+
+sub doit {
+    my $acton = shift;
+
+    my $prio = "";
+    if ( $obj eq 'site' && $acton eq 'default' ) {
+        $prio = '000-';
+    }
+
+    my ( $conftgt, $conflink );
+    if ( $obj eq 'module' ) {
+        if ( $acton eq 'cgi' && threaded() ) {
+            print "Your MPM seems to be threaded. Selecting cgid instead of cgi.\n";
+            $acton = 'cgid';
+        }
+
+        $conftgt = "$availdir/$acton.conf";
+        if ( -e $conftgt ) {
+            $conflink = "$enabldir/$acton.conf";
+        }
+    }
+
+    my $tgt  = "$availdir/$acton$sffx";
+    my $link = "$enabldir/$prio$acton$sffx";
+
+    if ( !-e $tgt ) {
+        if ( -l $link && !-e $link ) {
+		if ( $act eq 'disable' ) {
+			info("removing dangling symlink $link\n");
+			unlink($link);
+			return 1;
+		}
+		else {
+			error("$link is a dangling symlink!\n");
+		}
+	}
+
+        error("$name $acton does not exist!\n");
+        return 0;
+    }
+
+    # handle module dependencies
+    if ( $obj eq 'module' ) {
+        if ( $act eq 'enable' ) {
+            my $depends = qx{grep "# Depends:" "$availdir/$acton.load"|cut -f2 -d:};
+            $depends =~ s,^[\s\n]+,,;
+            $depends =~ s,[\s\n]+$,,;
+            do_deps( $acton, split( /[\n\s]+/, $depends ) ) or return 0;
+        }
+        else {
+            my @depends = qx{egrep "# Depends:.*${acton}( |\$)" $enabldir/*.load};
+            @depends = grep {s{^.*?/([^/]*?)\.load:.*}{$1}s} @depends;
+            if ( scalar @depends ) {
+                if ($force) {
+                    do_deps( $acton, @depends ) or return 0;
+                }
+                else {
+                    error(
+                        "The following modules depend on $acton ",
+                        "and need to be disabled first: @depends\n"
+                    );
+                    return 0;
+                }
+            }
+        }
+    }
+
+    if ( $act eq 'enable' ) {
+        my $check = check_link( $tgt, $link );
+        if ( $check eq 'ok' ) {
+            if ($conflink) {
+
+                # handle .conf file
+                my $confcheck = check_link( $conftgt, $conflink );
+                if ( $confcheck eq 'ok' ) {
+                    info("$name $acton already enabled\n");
+                    return 1;
+                }
+                elsif ( $confcheck eq 'missing' ) {
+                    print "Enabling config file $acton.conf.\n";
+                    add_link( $conftgt, $conflink ) or return 0;
+                }
+                else {
+                    error("Config file $acton.conf not properly enabled: $confcheck\n");
+                    return 0;
+                }
+            }
+            else {
+                info("$name $acton already enabled\n");
+                return 1;
+            }
+        }
+        elsif ( $check eq 'missing' ) {
+            if ($conflink) {
+
+                # handle .conf file
+                my $confcheck = check_link( $conftgt, $conflink );
+                if ( $confcheck eq 'missing' ) {
+                    add_link( $conftgt, $conflink ) or return 0;
+                }
+                elsif ( $confcheck ne 'ok' ) {
+                    error("Config file $acton.conf not properly enabled: $confcheck\n");
+                    return 0;
+                }
+            }
+
+            print "Enabling $obj $acton.\n";
+            if ( $acton eq 'ssl' ) {
+                info("See /usr/share/doc/pe-httpd-common/README.Debian.gz on " .
+                     "how to configure SSL and create self-signed certificates.\n");
+        }
+            return add_link( $tgt, $link );
+        }
+        else {
+            error("$name $acton not properly enabled: $check\n");
+            return 0;
+        }
+    }
+    else {
+        if ( -e $link || -l $link ) {
+            remove_link($link);
+            if ( $conflink && -e $conflink ) {
+                remove_link($conflink);
+            }
+            print "$name $acton disabled.\n";
+        }
+        elsif ( $conflink && -e $conflink ) {
+            print "Disabling stale config file $acton.conf.\n";
+            remove_link($conflink);
+        }
+        else {
+            info("$name $acton already disabled\n");
+            return 1;
+        }
+    }
+
+    return 1;
+}
+
+sub do_deps {
+    my $acton = shift;
+    foreach my $d (@_) {
+        info("Considering dependency $d for $acton:\n");
+        if ( !doit($d) ) {
+            error("Could not $act dependency $d for $acton, aborting\n");
+            return 0;
+        }
+    }
+    return 1;
+}
+
+sub add_link {
+    my ( $tgt, $link ) = @_;
+
+    # create relative link
+    if ( !symlink( File::Spec->abs2rel( $tgt, dirname($link) ), $link ) ) {
+        die("Could not create $link: $!\n");
+    }
+    $request_reload = 1;
+    return 1;
+}
+
+sub check_link {
+    my ( $tgt, $link ) = @_;
+
+    if ( !-e $link ) {
+        if ( -l $link ) {
+
+            # points to nowhere
+            info("Removing dangling link $link");
+            unlink($link) or die "Could not remove $link\n";
+        }
+        return 'missing';
+    }
+
+    if ( -e $link && !-l $link ) {
+        return "$link is a real file, not touching it";
+    }
+    if ( realpath($link) ne realpath($tgt) ) {
+        return "$link exists but does not point to $tgt, not touching it";
+    }
+    return 'ok';
+}
+
+sub remove_link {
+    my ($link) = @_;
+
+    if ( -l $link ) {
+        unlink($link) or die "Could not remove $link: $!\n";
+    }
+    elsif ( -e $link ) {
+        error("$link is not a symbolic link, not deleting\n");
+        return 0;
+    }
+    $request_reload = 1;
+    return 1;
+}
+
+sub threaded {
+    my $result = "";
+    $result = qx{/opt/puppet/sbin/pe-httpd -V | grep 'threaded'} if -x '/opt/puppet/sbin/pe-httpd';
+    if ( $result =~ / no/ ) {
+        return 0;
+    }
+    else {
+        return 1;
+    }
+}
+
+sub info {
+    print @_ if !$quiet;
+}
+
+sub error {
+    print STDERR 'ERROR: ', @_;
+}
+
+sub read_env_file {
+    my $file = shift;
+
+    -r $file or return;
+    my @lines = qx{env - sh -c '. $file && env'};
+    if ($?) {
+        die "Could not read $file\n";
+    }
+
+    foreach my $l (@lines) {
+        chomp $l;
+        $l =~ /^(.*)?=(.*)$/ or die "Could not parse $file\n";
+        $ENV{$1} = $2;
+    }
+}
--- pe-httpd-2.2.29.orig/debian/suexec.8
+++ pe-httpd-2.2.29/debian/suexec.8
@@ -0,0 +1,67 @@
+.TH suexec 8 "April 2008"
+.\" Copyright 1999-2004 The Apache Software Foundation
+.\" Copyright 2008 Stefan Fritsch
+.\"
+.\" Licensed under the Apache License, Version 2.0 (the "License");
+.\" you may not use this file except in compliance with the License.
+.\" You may obtain a copy of the License at
+.\"
+.\"     http://www.apache.org/licenses/LICENSE-2.0
+.\"
+.\" Unless required by applicable law or agreed to in writing, software
+.\" distributed under the License is distributed on an "AS IS" BASIS,
+.\" WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+.\" See the License for the specific language governing permissions and
+.\" limitations under the License.
+.\"
+.SH NAME
+suexec \- Switch User For Exec
+.SH SYNOPSIS
+.B suexec -V
+.PP
+This is a customized version that can be configured with
+config files in /etc/apache2/suexec.
+.PP
+No other synopsis for usage, because this program
+is otherwise only used internally by the Apache HTTP server.
+.PP
+.SH DESCRIPTION
+.B suexec
+is the "wrapper" support program for the suexec behaviour for the
+Apache HTTP server.  It is run from within the server automatically
+to switch the user when an external program has to be run under a
+different user. For more information about suexec in general, see the online
+document `Apache suexec Support' on the HTTP server project's
+Web site at  http://httpd.apache.org/docs/suexec.html .
+.PP
+This version of suexec reads a config file on every execution. Therefore
+it is a bit slower than the standard suexec version from the apache2-suexec
+package.
+.SH CONFIGURATION
+If suexec is called by a user with name 'username', it will look into
+/etc/apache2/suexec/username for configuration. If the file does not exist,
+suexec will abort. By creating several config files, you can allow several
+different apache run users to use suexec.
+.PP
+The first line in the file is used as the document root (/var/www in the
+standard suexec) and the second line in the file is used as the suffix that is
+appended to users' home directories (public_html in standard suexec).
+.PP
+If any of the lines is commented out (with #), suexec will refuse the
+corresponding type of request. It is recommended to comment out the 
+userdir suffix if you don't need it.
+.SH SECURITY
+Do not set the document root to a path that includes users' home directories
+(like /home or /var) or directories where users can mount removable media.
+Doing so would create local security issues. Suexec does not allow to set the
+document root to the root directory / .
+.SH OPTIONS
+.IP -V
+Display the list of compile-time settings used when \fBsuexec\fP
+was built.  No other action is taken.
+.PD
+.SH FILES
+.BR /etc/apache2/suexec/pe-apache
+.SH SEE ALSO
+.BR pe-httpd(8) ,
+.BR /usr/share/doc/apache2.2-common/README.Debian.gz
--- pe-httpd-2.2.29.orig/debian/clean
+++ pe-httpd-2.2.29/debian/clean
@@ -0,0 +1,28 @@
+debian/pe-httpd-mpm-worker.postinst
+debian/pe-httpd-mpm-worker.preinst
+debian/pe-httpd-mpm-worker.prerm
+debian/pe-httpd-mpm-worker.lintian-overrides
+debian/pe-httpd-mpm-worker.dirs
+debian/pe-httpd-mpm-worker.links
+debian/pe-httpd-mpm-event.postinst
+debian/pe-httpd-mpm-event.preinst
+debian/pe-httpd-mpm-event.prerm
+debian/pe-httpd-mpm-event.lintian-overrides
+debian/pe-httpd-mpm-event.dirs
+debian/pe-httpd-mpm-event.links
+debian/pe-httpd-mpm-prefork.postinst
+debian/pe-httpd-mpm-prefork.preinst
+debian/pe-httpd-mpm-prefork.prerm
+debian/pe-httpd-mpm-prefork.lintian-overrides
+debian/pe-httpd-mpm-prefork.dirs
+debian/pe-httpd-mpm-prefork.links
+debian/pe-httpd-mpm-itk.postinst
+debian/pe-httpd-mpm-itk.preinst
+debian/pe-httpd-mpm-itk.prerm
+debian/pe-httpd-mpm-itk.lintian-overrides
+debian/pe-httpd-mpm-itk.dirs
+debian/pe-httpd-mpm-itk.links
+debian/pe-httpd-prefork-dev.postinst
+debian/pe-httpd-threaded-dev.postinst
+debian/tmp-worker
+debian/tmp-prefork
--- pe-httpd-2.2.29.orig/debian/README.Debian
+++ pe-httpd-2.2.29/debian/README.Debian
@@ -0,0 +1,372 @@
+Contents
+========
+
+	Apache2 Configuration under Debian GNU/Linux
+		Files and Directories in /etc/puppetlabs/httpd
+		Tools
+
+	Using mod_disk_cache
+
+	SSL
+		Enabling SSL
+		Creating self-signed certificates
+		SSL workaround for MSIE
+
+	Suexec
+	
+	Documentation
+
+	Upgrades
+
+	Common Problems
+
+
+Apache2 Configuration under Debian GNU/Linux
+============================================
+
+Debian's default Apache2 installation attempts to make adding and
+removing modules, virtual hosts, and extra configuration directives as
+flexible as possible, in order to make automating the changes and
+administering the server as easy as possible.
+
+Please be aware that this layout is quite different from the standard
+Apache configuration. Due to the use of environment variables, pe-httpd
+needs to be started/stopped with /etc/init.d/pe-httpd or apache2ctl. 
+Calling /opt/puppet/bin/pe-httpd directly will not work with the default
+configuration. To call pe-httpd with specific command line arguments,
+just call apache2ctl with the same arguments.
+
+Files and Directories in /etc/puppet/httpd:
+-------------------------------------
+
+pe-httpd.conf
+
+	This is the main configuration file.
+
+envvars
+
+	This contains environment variables that may be used in the
+	configuration. Some settings, like user and pid file, need to
+	go in here so that other scripts can use them. It can also
+	be used to change some default settings used by apache2ctl.
+	Here is also the default LANG=C setting that can be changed
+	to a different language.
+
+conf.d/
+
+	Files in this directory are included by this line in
+	pe-httpd.conf:
+
+	# Include generic snippets of statements
+	Include /etc/puppetlabs/httpd/conf.d
+
+	This is a good place to add additional configuration
+	directives. Packages should not use configuration
+	files that start with 'local-' or end with '.local'.
+	The local administrator can use these filenames to make
+	sure that there are no conflicts with files provided by
+	packages.
+
+	If the local administrator is not comfortable with packages
+	activating their config files by default, it is possible
+	to change the 'Include /etc/puppetlabs/httpd/conf.d/' in pe-httpd.conf
+	into 'Include /etc/puppetlabs/httpd/conf.d.enabled/' and create that
+	directory. He can then put symlinks to the files in conf.d
+	which he wants to enable into conf.d.enabled.
+
+httpd.conf
+
+	Empty file.
+
+magic
+
+	Empty file.
+
+mods-available/
+
+	This directory contains a series of .load and .conf files.
+	The .load files contain the Apache configuration directive
+	necessary to load the module in question.  The respective
+	.conf files contain configuration directives necessary to
+	utilize the module in question.
+
+mods-enabled/
+
+	To actually enable a module for Apache2, it is necessary to
+	create a symlink in this directory to the .load (and .conf, if
+	it exists) files associated with the module in
+	mods-available/.  For example:
+
+	cgi.load -> /etc/puppetlabs/httpd/mods-available/cgi.load
+
+ports.conf
+
+	Configuration directives for which ports and IP addresses to
+	listen to.
+
+sites-available/
+
+	Like mods-available/, except it contains configuration
+	directives for different virtual hosts that might be used with
+	pe-httpd.  Note that the hostname doesn't have to correspond
+	exactly with the filename.  'default' is the default host.
+
+sites-enabled/
+
+	Similar in functionality to mods-enabled/, sites-enabled
+	contains symlinks to sites in sites-available/ that the
+	admnistrator wishes to enable.
+
+	Apache uses the first VirtualHost that matches the IP/Port
+	as default for named virtual hosts. Therefore the 'default'
+	site is linked to '000-default' so that it will be read first.
+
+	Example:
+	dedasys -> /etc/puppetlabs/httpd/sites-available/dedasys
+
+The Include directive ignores files with names that
+
+- do not begin with a letter or number
+- contain a character that is neither letter nor number nor _-.
+- contain .dpkg
+
+Other files
+-----------
+
+For historical reasons, the pid file is in /var/run/pe-httpd.pid and not in
+/var/run/pe-httpd/pe-httpd.pid.
+
+Tools
+-----
+
+a2enmod and a2dismod are available for enabling and disabling modules utilizing
+the above configuration system.
+
+a2ensite and a2dissite do essentially the same thing as the above tools, but
+for sites rather than modules.
+
+apxs2 -a/-A is modified to use a2enmod to activate newly installed modules.
+
+
+Using mod_disk_cache
+====================
+
+To ensure that the disk cache does not grow indefinitely, htcacheclean is
+started when mod_disk_cache is enabled. Both daemon and cron (daily) mode
+are supported. The configuration (run mode, cache size, ...) is in
+/etc/default/pe-httpd .
+
+Normally, htcacheclean is automatically started and stopped by
+/etc/init.d/pe-httpd. However, if you change the state of mod_disk_cache or the
+configuration of htcacheclean while pe-httpd is running, you may need to
+manually start/stop htcacheclean with "/etc/init.d/pe-httpd start-htcacheclean"
+or "/etc/init.d/pe-httpd stop-htcacheclean".
+
+
+SSL
+===
+
+Enabling SSL
+------------
+
+To enable SSL, type (as user root):
+
+	a2ensite default-ssl
+	a2enmod ssl
+
+If you want to use self-signed certificates, you should install the ssl-cert
+package (see below). Otherwise, just adjust the SSLCertificateFile and
+SSLCertificateKeyFile directives in /etc/puppetlabs/httpd/sites-available/default-ssl to
+point to your SSL certificate. Then restart apache:
+
+	/etc/init.d/pe-httpd restart
+
+The SSL key file should only be readable by root, the certificate file may be
+globally readable. These files are read by the Apache parent process which runs
+as root. Therefore it is not necessary to make the files readable by the
+pe-apache user.
+
+Creating self-signed certificates
+---------------------------------
+
+If you install the ssl-cert package, a self-signed certificate will be
+automatically created using the hostname currently configured on your computer.
+You can recreate that certificate (e.g. after you have changed /etc/hosts or
+DNS to give the correct hostname) as user root with:
+
+	make-ssl-cert generate-default-snakeoil --force-overwrite
+
+To create more certificates with different host names, you can use
+
+	make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /path/to/cert-file.crt
+
+This will ask you for the hostname and place both SSL key and certificate in
+the file /path/to/cert-file.crt . Use this file with the SSLCertificateFile
+directive in the Apache config (you don't need the SSLCertificateKeyFile in
+this case as it also contains the key). The file /path/to/cert-file.crt should
+only be readable by root. A good directory to use for the additional
+certificates/keys is /etc/ssl/private .
+
+SSL workaround for MSIE
+-----------------------
+
+The SSL workaround for MS Internet Explorer needs to be added to your SSL
+VirtualHost section (it was previously in ssl.conf but caused keepalive to be
+disabled even for non-SSL connections):
+
+	BrowserMatch "MSIE [2-6]" \
+		nokeepalive ssl-unclean-shutdown \
+		downgrade-1.0 force-response-1.0
+	BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+
+The default SSL virtual host in /etc/puppetlabs/httpd/sites-available/default-ssl
+already contains this workaround.
+
+
+Suexec
+======
+
+Debian ships two version of the suexec helper program required by mod_suexec.
+It is not installed by default, to avoid possible security issues. The package
+pe-httpd-suexec contains the standard version that works only with document root
+/var/www, userdir suffix public_html, and Apache run user pe-apache. The package
+pe-httpd-suexec-custom contains a customizable version, that can be configured
+with a config file to use different settings (like /srv/www as document root).
+For more information see the suexec(8) man page in the pe-httpd-suexec-custom
+package.
+
+Since pe-httpd-suexec-custom has received less testing and might be slightly
+slower, pe-httpd-suexec is the recommended version unless you need the features
+from pe-httpd-suexec-custom.
+
+
+Documentation
+=============
+
+The full Apache 2 documentation can be found on the web at
+
+http://httpd.apache.org/docs/2.2/
+
+or, if you have installed the pe-httpd-doc package, in
+
+/usr/share/doc/pe-httpd-doc/manual/
+
+or at
+
+http://localhost/manual/
+
+There is also a wiki that contains useful information:
+
+http://wiki.apache.org/httpd/
+
+Some hints about securing Apache 2 on Debian are available at
+
+http://wiki.debian.org/Apache/Hardening
+
+
+Upgrades
+========
+
+Changes in the Apache packages that require manual configuration adjustments
+are announced in NEWS.Debian. Installing the apt-listchanges package is
+recommended. It will display the relevant NEWS.Debian sections before
+upgrades.
+
+
+Multiple instances
+==================
+
+There is some support for running multiple instances of Apache2 on the same
+machine. See /usr/share/doc/pe-httpd-common/README.multiple-instances for more
+information.
+
+
+Common Problems
+===============
+
+1) Error message "Could not determine the server's fully qualified domain name,
+using 127.0.0.1 for ServerName" during start
+
+This can usually be ignored but it means that Apache httpd was unable to obtain
+a fully-qualified hostname by doing a reverse lookup on your server's IP
+address. You may want to add the fully-qualified hostname to /etc/hosts .
+
+
+2) Error message "mod_rewrite: could not create rewrite_log_lock"
+
+This probably means that there are some stale SYSV semaphores around. This
+usually happens after pe-httpd has been killed with kill -9 (SIGKILL). You can
+clean up the semaphores with:
+
+	ipcs -s | grep pe-apache | awk ' { print $2 } ' | xargs ipcrm sem
+
+3) Message "NameVirtualHost *:80 has no VirtualHosts" in error log
+
+Probably the VirtualHost definitions have not been adjusted after the 
+NameVirtualHost directive was changed in ports.conf. 
+See /usr/share/doc/pe-httpd-common/NEWS.Debian.gz
+
+4) Message "File does not exist: /etc/puppetlabs/httpd/htdocs" in error log
+
+In most cases this means that no matching VirtualHost definition could be
+found for an incoming request. Check that the target IP address/port and the
+name in the Host: header of the request actually match one of the virtual
+hosts.
+
+5) Message "Couldn't create pollset in child; check user or system limits" in
+  error log
+
+On Linux kernels since 2.6.27.8, the value in
+
+    /proc/sys/fs/epoll/max_user_instances
+
+needs to be larger than
+
+    for prefork/itk  MPM: 2 * MaxClients
+    for worker/event MPM: MaxClients + MaxClients/ThreadsPerChild
+
+It can be set on boot by adding a line like
+
+        fs.epoll.max_user_instances=1024
+
+to /etc/sysctl.conf.
+
+There are several other error messages related to creating a pollset that can
+appear for the same reason.
+
+On the other hand, errors about to adding to a pollset are related to the
+setting fs.epoll.max_user_watches. On most systems, max_user_watches should be
+high enough by default.
+
+6) Message "Server should be SSL-aware but has no certificate configured" in
+   error log
+
+Since 2.2.12, Apache is stricter about certain misconfigurations concerning
+name based SSL virtual hosts. See NEWS.Debian.gz for more details.
+
+7) Apache does not pass Authorization header to CGI scripts
+
+This is intentional to avoid security holes. If you really want to change it,
+you can use mod_rewrite:
+
+	RewriteCond %{HTTP:Authorization} (.*)
+	RewriteRule . - [env=HTTP_AUTHORIZATION:%1]
+
+8) mod_dav is behaving strangely
+
+In general, if you use mod_dav_fs, you need to disable multiviews and script
+execution for that directory. For example:
+
+    <Directory /var/www/dav>
+        Dav on
+        Options -MultiViews -ExecCGI
+        SetHandler none
+        <IfModule mod_php5.c>
+            php_admin_value engine Off
+        </IfModule>
+    </Directory>
+
+9) Message "pe-httpd: bad user name ${APACHE_RUN_USER}" when starting pe-httpd
+   directly
+
+Use apache2ctl (it accepts all options of pe-httpd).
--- pe-httpd-2.2.29.orig/debian/pe-httpd.init
+++ pe-httpd-2.2.29/debian/pe-httpd.init
@@ -0,0 +1,337 @@
+#!/bin/bash
+### BEGIN INIT INFO
+# Provides:          pe-httpd
+# Required-Start:    $local_fs $remote_fs $network $syslog
+# Required-Stop:     $local_fs $remote_fs $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# X-Interactive:     true
+# Short-Description: Start/stop pe-httpd web server
+### END INIT INFO
+
+set -e
+umask 0022
+
+facter=/opt/puppet/bin/facter
+logger=$(command -v logger)
+OSFAMILY=$($facter osfamily | tr '[:upper:]' '[:lower:]')
+OS=$($facter operatingsystem | tr '[:upper:]' '[:lower:]')
+REL=$($facter operatingsystemrelease)
+ARCH=$($facter architecture)
+HOSTNAME=$($facter hostname)
+PLATFORM_TAG=${OS}-${REL}-${ARCH}
+
+if [ -n "$APACHE_CONFDIR" ] ; then
+  if [ "${APACHE_CONFDIR##/etc/puppetlabs/httpd-}" != "$APACHE_CONFDIR}" ] ; then
+    DIR_SUFFIX="${APACHE_CONFDIR##/etc/puppetlabs/httpd-}"
+  else
+    DIR_SUFFIX=
+  fi
+elif [ "${0##*/pe-httpd-}" != "$0" ] ; then
+  DIR_SUFFIX="-${0##*/pe-httpd-}"
+  APACHE_CONFDIR=/etc/puppetlabs/httpd$DIR_SUFFIX
+else
+  DIR_SUFFIX=
+  APACHE_CONFDIR=/etc/puppetlabs/httpd
+fi
+if [ -z "$APACHE_ENVVARS" ] ; then
+  APACHE_ENVVARS=$APACHE_CONFDIR/envvars
+fi
+export APACHE_CONFDIR APACHE_ENVVARS
+
+ENV="env -i LANG=C PATH=/opt/puppet/bin:/usr/local/bin:/usr/bin:/bin"
+if [ "$APACHE_CONFDIR" != /etc/puppetlabs/httpd ] ; then
+  ENV="$ENV APACHE_CONFDIR=$APACHE_CONFDIR"
+fi
+if [ "$APACHE_ENVVARS" != "$APACHE_CONFDIR/envvars" ] ; then
+  ENV="$ENV APACHE_ENVVARS=$APACHE_ENVVARS"
+fi
+
+
+#edit /etc/default/pe-httpd to change this.
+HTCACHECLEAN_RUN=auto
+HTCACHECLEAN_MODE=daemon
+HTCACHECLEAN_SIZE=300M
+HTCACHECLEAN_DAEMON_INTERVAL=120
+HTCACHECLEAN_PATH=/var/cache/pe-httpd$DIR_SUFFIX/mod_disk_cache
+HTCACHECLEAN_OPTIONS=""
+
+APACHE_HTTPD=$(. $APACHE_ENVVARS && echo $APACHE_HTTPD)
+if [ -z "$APACHE_HTTPD" ] ; then
+  APACHE_HTTPD=/opt/puppet/sbin/pe-httpd
+fi
+if [ ! -x $APACHE_HTTPD ] ; then
+  echo "No apache MPM package installed"
+  exit 0
+fi
+
+. /lib/lsb/init-functions
+
+test -f /etc/default/rcS && . /etc/default/rcS
+
+if [ -f /etc/default/pe-httpd$DIR_SUFFIX ] ; then
+  . /etc/default/pe-httpd$DIR_SUFFIX
+elif [ -f /etc/default/pe-httpd ] ; then
+  . /etc/default/pe-httpd
+fi
+
+APACHE2CTL="$ENV /opt/puppet/sbin/apache2ctl"
+HTCACHECLEAN="$ENV /opt/puppet/sbin/htcacheclean"
+
+PIDFILE=$(. $APACHE_ENVVARS && echo $APACHE_PID_FILE)
+if [ -z "$PIDFILE" ] ; then
+  echo ERROR: APACHE_PID_FILE needs to be defined in $APACHE_ENVVARS >&2
+  exit 2
+fi
+
+
+check_htcacheclean() {
+  [ "$HTCACHECLEAN_MODE" = "daemon" ] || return 1
+
+  [ "$HTCACHECLEAN_RUN"  = "yes"    ] && return 0
+
+  MODSDIR=$(. $APACHE_ENVVARS && echo $APACHE_MODS_ENABLED)
+  [ "$HTCACHECLEAN_RUN"  = "auto" \
+    -a -e ${MODSDIR:-$APACHE_CONFDIR/mods-enabled}/disk_cache.load ] && \
+    return 0
+
+  return 1
+}
+
+apache_start() {
+  print_deprecation_warning
+  $APACHE2CTL start
+  RETVAL=$?
+  return $RETVAL
+}
+
+start_htcacheclean() {
+  if [ ! -d "$HTCACHECLEAN_PATH" ] ; then
+    echo "... directory $HTCACHECLEAN_PATH does not exist!" >&2
+    return 1
+  fi  
+  $HTCACHECLEAN $HTCACHECLEAN_OPTIONS -d$HTCACHECLEAN_DAEMON_INTERVAL \
+      -i -p$HTCACHECLEAN_PATH -l$HTCACHECLEAN_SIZE
+}
+
+stop_htcacheclean() {
+  pkill -P 1 -f "htcacheclean.* -p$HTCACHECLEAN_PATH " 2> /dev/null || echo ...not running
+}
+
+pidof_apache() {
+  # if there is actually an pe-httpd process whose pid is in PIDFILE,
+  # print it and return 0.
+  if [ -e "$PIDFILE" ]; then
+    if pidof pe-httpd | tr ' ' '\n' | grep -w $(cat $PIDFILE); then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+apache_stop() {
+  if $APACHE2CTL configtest > /dev/null 2>&1; then
+    # if the config is ok than we just stop normaly
+    $APACHE2CTL stop 2>&1 | grep -v 'not running' >&2 || true
+  else
+    # if we are here something is broken and we need to try
+    # to exit as nice and clean as possible
+    PID=$(pidof_apache) || true
+
+    if [ "${PID}" ]; then
+      # in this case it is everything nice and dandy and we kill pe-httpd
+      echo
+      log_warning_msg "The pe-httpd$DIR_SUFFIX configtest failed, so we are trying to kill it manually. This is almost certainly suboptimal, so please make sure your system is working as you'd expect now!"
+      kill $PID
+    elif [ "$(pidof pe-httpd)" ]; then
+      kill $(pidof pe-httpd)
+    fi
+  fi
+}
+
+apache_wait_stop() {
+  # running ?
+  PIDTMP=$(pidof_apache) || true
+  if kill -0 "${PIDTMP:-}" 2> /dev/null; then
+      PID=$PIDTMP
+  fi
+
+  apache_stop
+
+  # wait until really stopped
+  if [ -n "${PID:-}" ]; then
+    i=0
+    while kill -0 ${PID:-} 2> /dev/null;  do
+      if [ $i = '60' ]; then
+        break;
+      else
+        if [ $i = '0' ]; then
+          echo -n " ... waiting "
+        else
+          echo -n "."
+        fi
+        i=$(($i+1))
+        sleep 1
+      fi
+    done
+  fi
+}
+
+deprecated() {
+    if [ "$HOSTNAME" == "learning" ] || [ "$HOSTNAME" == "training" ] || [ "$HOSTNAME" == "student" ]; then
+        return 1
+    elif [ "$ARCH" != "x86_64" ] && [ "$ARCH" != "amd64" ] ; then
+        return 0
+    fi
+
+    deprecated=1
+
+    case "$OSFAMILY" in
+        debian)
+        case "$OS" in
+            debian)
+            deprecated=0
+            ;;
+            ubuntu)
+            if [ "$REL" == "10.04" ]; then
+                deprecated=0
+            fi
+            ;;
+        esac
+        ;;
+        redhat)
+        if [ "$REL" -lt 6 ]; then
+            deprecated=0
+        fi
+        ;;
+    esac
+    return "$deprecated"
+}
+
+print_deprecation_warning() {
+    deprecation_notice="NOTICE: Your puppet master is running on a platform (${PLATFORM_TAG}) that is due to be discontinued in the next major release. See the release notes (http://docs.puppetlabs.com/pe/3.8/release_notes.html#some-master-platforms-are-deprecated) for more information about deprecated platforms."
+    if deprecated ; then
+        if [ -n "$logger" ]; then
+            $logger "$deprecation_notice"
+        fi
+        >&2 echo "$deprecation_notice"
+    fi
+}
+
+case $1 in
+  start)
+    log_daemon_msg "Starting web server" "pe-httpd"
+    if apache_start; then
+      if check_htcacheclean ; then
+        log_progress_msg htcacheclean
+        start_htcacheclean || log_end_msg 1
+      fi
+      log_end_msg 0
+    else
+      log_end_msg 1
+    fi
+    ;;
+  stop)
+    if check_htcacheclean ; then
+      log_daemon_msg "Stopping web server" "htcacheclean"
+      stop_htcacheclean
+      log_progress_msg "pe-httpd"
+    else
+      log_daemon_msg "Stopping web server" "pe-httpd"
+    fi
+    if apache_wait_stop; then
+      log_end_msg 0
+    else
+      log_end_msg 1
+    fi
+    ;;
+  graceful-stop)
+    if check_htcacheclean ; then
+      log_daemon_msg "Stopping web server" "htcacheclean"
+      stop_htcacheclean
+      log_progress_msg "pe-httpd"
+    else
+      log_daemon_msg "Stopping web server" "pe-httpd"
+    fi
+    if $APACHE2CTL graceful-stop; then
+      log_end_msg 0
+    else
+      log_end_msg 1
+    fi
+    ;;
+  graceful | reload | force-reload)
+    if ! $APACHE2CTL configtest > /dev/null 2>&1; then
+      $APACHE2CTL configtest || true
+      log_end_msg 1
+      exit 1
+    fi
+    log_daemon_msg "Reloading web server config" "pe-httpd"
+    if pidof_apache > /dev/null ; then
+      if $APACHE2CTL graceful $2 ; then
+        log_end_msg 0
+      else
+        log_end_msg 1
+      fi
+    fi
+    ;;
+  restart)
+    if ! $APACHE2CTL configtest > /dev/null 2>&1; then
+      $APACHE2CTL configtest || true
+      log_end_msg 1
+      exit 1
+    fi
+    if check_htcacheclean ; then
+      log_daemon_msg "Restarting web server" "htcacheclean"
+      stop_htcacheclean
+      log_progress_msg pe-httpd
+    else
+      log_daemon_msg "Restarting web server" "pe-httpd"
+    fi
+    PID=$(pidof_apache) || true
+    if ! apache_wait_stop; then
+      log_end_msg 1 || true
+    fi
+    if apache_start; then
+      if check_htcacheclean ; then
+        start_htcacheclean || log_end_msg 1
+      fi
+      log_end_msg 0
+    else
+      log_end_msg 1
+    fi
+    ;;
+  start-htcacheclean)
+    log_daemon_msg "Starting htcacheclean"
+    start_htcacheclean || log_end_msg 1
+    log_end_msg 0
+    ;;
+  stop-htcacheclean)
+    log_daemon_msg "Stopping htcacheclean"
+    stop_htcacheclean
+    log_end_msg 0
+    ;;
+  status)
+    PID=$(pidof_apache) || true
+    if [ -n "$PID" ]; then
+      if [ -s ${PIDFILE} ]; then
+        echo "Apache2$DIR_SUFFIX is running (pid $PID)."
+        exit 0
+      else
+        echo "Apache2$DIR_SUFFIX is in an unknown state."
+        exit 4
+      fi
+    else
+      if ! [ -s ${PIDFILE} ]; then
+        echo "Apache2$DIR_SUFFIX is NOT running."
+        exit 3
+      else
+        echo "Apache2$DIR_SUFFIX is NOT running, but its pidfile still exists."
+        exit 1
+      fi
+    fi
+    ;;
+  *)
+    log_success_msg "Usage: /etc/init.d/pe-httpd$DIR_SUFFIX {start|stop|graceful-stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean|status}"
+    exit 1
+    ;;
+esac
--- pe-httpd-2.2.29.orig/debian/pe-httpd-doc.conf
+++ pe-httpd-2.2.29/debian/pe-httpd-doc.conf
@@ -0,0 +1,10 @@
+Alias /manual /usr/share/doc/apache2-doc/manual/
+
+<Directory "/usr/share/doc/apache2-doc/manual/">
+    Options Indexes FollowSymlinks
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+    AddDefaultCharset off
+</Directory>
+
--- pe-httpd-2.2.29.orig/debian/README.multiple-instances
+++ pe-httpd-2.2.29/debian/README.multiple-instances
@@ -0,0 +1,99 @@
+Setup
+=====
+
+The scripts apache2ctl, a2enmod, a2ensite, ... and the init script have some
+support for handling multiple instances of pe-httpd running on the same machine.
+
+The basic idea is to copy /etc/puppetlabs/httpd to /etc/puppetlabs/httpd-xxx. An example script
+that demonstrates what else needs to be done can be found in
+/usr/share/doc/apache2.2-common/examples/setup-instance. Use with:
+
+	sh /usr/share/doc/apache2.2-common/examples/setup-instance xxx
+
+Adjust the configuration in /etc/puppetlabs/httpd-xxx, especially the listen ports in
+ports.conf and in the virtual host directives in
+/etc/puppetlabs/httpd-xxx/sites-enabled/*.
+
+You can then use a2enmod-xxx, /etc/init.d/pe-httpd-xxx, ... as usual, and they
+will affect the new instance of pe-httpd.
+
+To start the new pe-httpd instance on boot, use
+- if you use dependency based boot sequence (the default):
+  If you don't have ssl keys with passphrases, you may want to set
+  'X-Interactive: false' in /etc/init.d/pe-httpd-xxx to reduce boot time.
+  Then execute:
+	insserv pe-httpd-xxx
+- otherwise:
+	ln -s ../init.d/pe-httpd-xxx /etc/rc2.d/S80pe-httpd-xxx
+
+To make 'apache2ctl-xxx status' work, you need to set APACHE_STATUSURL in
+/etc/puppetlabs/httpd-xxx/envvars.
+
+
+Upgrades
+========
+
+Since onle the configuration files in /etc/puppetlabs/httpd are in the package, the
+configuration of other instances won't change if the default configuration
+changes.  Possibly ways to deal with this are:
+
+- Use symlinks to the files in /etc/puppetlabs/httpd where possible instead of copying
+  the files.
+- Don't modify /etc/puppetlabs/httpd at all but use it to track the default
+  configuration. You can then merge the changes into the /etc/puppetlabs/httpd-xxx dirs.
+  It may be a good idea to use a version control system for /etc/puppetlabs/httpd to
+  keep track of the changes. See the package etckeeper for keeping the whole
+  /etc dir under version control.
+  An advanced scheme may be for every /etc/puppetlabs/httpd* dir to be a separate git
+  repository so that you can easily pull/push changes from one dir to another.
+ 
+
+Package removal
+===============
+
+The Apache 2 package will only remove the default configuration files and
+directories.
+
+
+Configuration
+=============
+
+The init script will try to read /etc/defaults/pe-httpd-xxx. If that does not
+exist, it will use /etc/defaults/pe-httpd instead.
+
+The following environment variables can be used to influence the scripts.  The
+default pe-httpd configuration will make use of them, too. Most can be set in
+/etc/puppetlabs/httpd-xxx/envvars. Variables set in /etc/puppetlabs/httpd-xxx/envvars must be
+exported.
+
+variable		default value
+--------		-------------
+APACHE_CONFDIR		/etc/puppetlabs/httpd         or /etc/puppetlabs/httpd-xxx
+APACHE_ENVVARS		$APACHE_CONFDIR/envvars
+APACHE_HTTPD		/opt/puppet/sbin/pe-httpd
+APACHE_ARGUMENTS	empty if $APACHE_CONFDIR = /etc/puppetlabs/httpd
+			"-d $APACHE_CONFDIR" otherwise
+
+APACHE_RUN_USER		pe-apache
+APACHE_RUN_GROUP	pe-apache
+
+APACHE_PID_FILE         /var/run/pe-httpd.pid or /var/run/pe-httpd-xxx.pid
+APACHE_RUN_DIR		/var/run/pe-httpd     or /var/run/pe-httpd-xxx
+APACHE_LOCK_DIR		/var/lock/pe-httpd    or /var/lock/pe-httpd-xxx
+APACHE_LOG_DIR		/var/log/pe-httpd     or /var/log/pe-httpd-xxx
+
+APACHE_MODS_AVAILABLE	$APACHE_CONFDIR/mods-available
+APACHE_MODS_ENABLED	$APACHE_CONFDIR/mods-enabled
+APACHE_SITES_AVAILABLE	$APACHE_CONFDIR/sites-available
+APACHE_SITES_ENABLED	$APACHE_CONFDIR/sites-enabled
+
+APACHE_LYNX		www-browser -dump
+APACHE_STATUSURL	http://localhost:80/server-status
+
+
+MPMs
+====
+
+You can use different MPMs for different instances by setting APACHE_HTTPD to
+one of /opt/puppet/lib/httpd/mpm-*/pe-httpd. Note that some modules like mod_php only
+work with the non-threaded MPMs (prefork, itk).
--- pe-httpd-2.2.29.orig/debian/mpms.links
+++ pe-httpd-2.2.29/debian/mpms.links
@@ -0,0 +1,2 @@
+opt/puppet/lib/httpd/mpm-MPMXXX/pe-httpd			opt/puppet/sbin/pe-httpd
+usr/share/bug/pe-httpd/script			usr/share/bug/pe-httpd-mpm-MPMXXX/script
--- pe-httpd-2.2.29.orig/debian/gbp.conf
+++ pe-httpd-2.2.29/debian/gbp.conf
@@ -0,0 +1,29 @@
+[DEFAULT]
+snapshot-number = os.popen("git-log --pretty=oneline | wc -l").readlines()[0]
+postbuild = lintian --suppress-tags bad-distribution-in-changes-file,multiple-distributions-in-changes-file $GBP_CHANGES_FILE
+# tell git-buildpackage howto clean the source tree
+cleaner = fakeroot debian/rules clean
+# this is how we invoke pbuilder, arguments passed to git-buildpackage will be
+# passed to dpkg-buildpackge in the chroot
+pbuilder = true
+# Sign tags by default:
+sign-tags = True
+#keyid = 0x3f3e6426
+# use pristine tar by defaul
+pristine-tar = True
+
+
+[git-dch]
+git-log=--no-merges
+# Parse meta tags like Closes: from commit messages
+meta = True
+# Add seven digits of the commits sha1 to the commit message
+id-length = 7
+# Regex for matching bugs to close
+meta-closes = Closes|LP|BZ
+# Ignore these in commit messages
+ignore-regex = (Signed-off|Acked)-by:
+
+[git-import-orig]
+# Automatically forward the changelog after importing a new upstream version
+postimport = git-dch -N%(version)s -S -a --debian-branch=$GBP_BRANCH
--- pe-httpd-2.2.29.orig/debian/pe-httpd-prefork-dev.install
+++ pe-httpd-2.2.29/debian/pe-httpd-prefork-dev.install
@@ -0,0 +1 @@
+opt/puppet/share/man/man8/apxs2.8.gz
--- pe-httpd-2.2.29.orig/debian/changelog.erb
+++ pe-httpd-2.2.29/debian/changelog.erb
@@ -0,0 +1,288 @@
+pe-httpd (<%= version %>-1puppet<%= release %>) lucid squeeze precise wheezy trusty; urgency=low
+
+  * Update to <%= version %> with release <%= release %>
+
+ -- Puppet Labs Release <info@puppetlabs.com>  <%= Time.now.strftime ("%a, %d %b %Y %H:%M:%S %z") %>
+
+pe-httpd (2.2.29-1puppet5) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-4749) Add patch to help mitigate Logjam SSL vulnerability.
+
+-- Ryan McKern <mckern@puppetlabs.com>  Wed, 13 Aug 2014 09:24:43 -0700
+
+pe-httpd (2.2.27-1puppet11) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-2559) Add patches to Debs for August 2014 HTTPD CVEs
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Wed, 13 Aug 2014 09:24:43 -0700
+
+pe-httpd (2.2.27-1puppet10) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (PE-2098) Unify pe-httpd-bin, pe-httpd-common, pe-httpd-utilities
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Fri, 08 Aug 2014 09:22:51 -0700
+
+pe-httpd (2.2.27-1puppet9) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (PE-4519) Dpkg pe-httpd init script uses bad logic to get pid
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Wed, 11 Jun 2014 16:37:22 -0700
+
+pe-httpd (2.2.27-1puppet8) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Activate mod_rewrite properly on upgrades
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 27 May 2014 15:00:17 -0700
+
+pe-httpd (2.2.27-1puppet7) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Move the version check function similarly to rpm
+
+ -- AJ Roetker <andrew.roetker@puppetlabs.com>  Wed, 21 May 2014 10:32:17 -0700
+
+pe-httpd (2.2.27-1puppet6) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Bump release to 2.2.27-1puppet6 to avoid version conflict with PE 3.2.x
+
+ -- Ryan McKern <mckern@puppetlabs.com>  Mon, 19 May 2014 10:32:17 -0700
+
+pe-httpd (2.2.27-1puppet4) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Rebuild against latest pe-openssl release
+
+ -- Ryan McKern <ryan.mckern@puppetlabs.com>  Tue, 29 Apr 2014 11:44:23 -0700
+
+pe-httpd (2.2.27-1puppet3) squeeze wheezy lucid precise trusty; urgency=low
+
+  * Update debian/changelog
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Fri, 28 Mar 2014 09:17:10 -0700
+
+pe-httpd (2.2.27-1puppet2) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-1427) Bump release for PE 3.2.2
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Thu, 27 Mar 2014 13:25:29 -0700
+
+pe-httpd (2.2.27-1puppet1) squeeze lucid precise; urgency=low
+
+  * (RE-1425) Update to 2.2.27 for CVE-2014-0098 and CVE-2013-6438
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Thu, 27 Mar 2014 18:12:59 +0000
+
+pe-httpd (2.2.25-1puppet8) squeeze wheezy lucid precise trusty; urgency=low
+
+  * (RE-1189) Update pe-apache to link against pe-openssl
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Fri, 21 Mar 2014 10:55:45 -0700
+
+pe-httpd (2.2.25-1puppet7) lucid squeeze precise wheezy; urgency=low
+
+  * (QA-554) Specify the version check host:port in answer file
+
+ -- Andrew Roetker <andrew.roetker@puppetlabs.com>  Fri, 03 Jan 2014 14:00:00 +0000
+
+pe-httpd (2.2.25-1puppet6) lucid squeeze precise wheezy; urgency=low
+
+  * (pe-2195) Puppetdb.conf exist? before update check
+
+ -- Andrew Roetker <andrew.roetker@puppetlabs.com>  Mon, 25 Nov 2013 14:00:00 +0000
+
+pe-httpd (2.2.25-1puppet5) lucid squeeze precise wheezy; urgency=low
+
+  * (PE-1940) gzip JSON output
+  * (PE-1569) Remove license check from init script
+
+ -- Lindsey Smith <lindsey@puppetlabs.com>  Tue, 19 Nov 2013 17:00:00 +0000
+
+pe-httpd (2.2.25-1puppet3) lucid squeeze precise wheezy; urgency=low
+
+  * Activate mod_rewrite properly on upgrades
+
+ -- Branan Purvine-Riley <branan@puppetlabs.com>  Sun, 15 Sep 2013 01:44:37 +0000
+
+pe-httpd (2.2.25-1puppet2) lucid squeeze precise wheezy; urgency=low
+
+  * Enable mod_rewrite
+
+ -- Melissa Stone <melissa@puppetlabs.com>  Fri, 13 Sep 2013 15:14:49 +0000
+
+pe-httpd (2.2.25-1puppet1) lucid squeeze precise wheezy; urgency=low
+
+  * Update to upstream 2.2.25
+
+ -- Moses Mendoza <moses@puppetlabs.com>  Thu, 25 Jul 2013 16:16:49 +0000
+
+pe-httpd (2.2.16-1puppet29) lucid squeeze precise wheezy; urgency=low
+
+  * (#15383) Update pe-httpd to use pe-apache group and user
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 22:15:29 +0000
+
+pe-httpd (2.2.16-1puppet28) lucid squeeze precise wheezy; urgency=low
+
+  * (maint) move license and version checks to start
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 20:27:56 +0000
+
+pe-httpd (2.2.16-1puppet27) lucid squeeze precise wheezy; urgency=low
+
+  * Remove rmdir calls that are suddenly failing.
+
+ -- Matthaus Owens <matthaus@puppetlabs.com>  Tue, 21 May 2013 20:24:49 +0000
+
+pe-httpd (2.2.16-1puppet26) wheezy; urgency=low
+
+  * (#18159) Add answer to override update check
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Mon, 17 Dec 2012 23:33:00 +0000
+
+pe-httpd (2.2.16-1puppet25) wheezy; urgency=low
+
+  * Rebuild for wheezy
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Wed, 31 Oct 2012 13:44:19 -0700
+
+pe-httpd (2.2.16-1puppet24) precise; urgency=low
+
+  * Have pe-httpd report version to updates.puppetlabs.com
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Fri, 26 Oct 2012 14:41:17 -0700
+
+pe-httpd (2.2.16-1puppet23) precise; urgency=low
+
+  * Patching mod_ssl to disable SSLv2
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Tue, 17 Apr 2012 00:13:40 +0000
+
+pe-httpd (2.2.16-1puppet21) precise; urgency=low
+
+  * Adding SSL2 patch, updating control to depend on the right things.
+
+ -- Matthaus Litteken <matthaus@puppetlabs.com>  Wed, 11 Apr 2012 23:07:49 +0000
+
+pe-httpd (2.2.16-1puppet20) precise; urgency=low
+
+  * Update Apache CVE for lucid
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Fri, 16 Mar 2012 17:18:55 +0000
+
+pe-httpd (2.2.16-1puppet19) precise; urgency=low
+
+  * (#11699, #9626) Fix css, js file permissions in dashboard
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Sat, 07 Jan 2012 00:16:30 +0000
+
+pe-httpd (2.2.16-1puppet18) precise; urgency=low
+
+  * (#11341) Make pe-httpd-{bin,util} depend on pe-per
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Wed, 04 Jan 2012 22:06:04 +0000
+
+pe-httpd (2.2.16-1puppet17) precise; urgency=low
+
+  * Adding precise branch
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 27 Dec 2011 16:15:45 +0000
+
+pe-httpd (2.2.16-1puppet16) precise; urgency=low
+
+  * Patching for latest round of Apache httpd CVEs
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 13 Dec 2011 19:27:15 +0000
+
+pe-httpd (2.2.16-1puppet15) precise; urgency=low
+
+  * (#10732) Tweak apache configuration for passenger
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 10 Nov 2011 21:44:14 -0800
+
+pe-httpd (2.2.16-1puppet14) precise; urgency=low
+
+  * (#10407) Ubuntu/debian gets a better init script
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Wed, 09 Nov 2011 11:16:29 -0800
+
+pe-httpd (2.2.16-1puppet13) precise; urgency=low
+
+  * (#10612) Bump maxclients to 300 to improve performance.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Mon, 07 Nov 2011 17:57:52 -0800
+
+pe-httpd (2.2.16-1puppet12) precise; urgency=low
+
+  * Remove autostart in posts
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 06 Oct 2011 19:04:27 -0700
+
+pe-httpd (2.2.16-1puppet11) precise; urgency=low
+
+  * Add Depend on pe-puppet-enteprise-release
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 19 Jul 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet10) precise; urgency=low
+
+  * (#7159) Making logrotate identical to RHEL version.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 19 Jul 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet9) precise; urgency=low
+
+  * [3675493] (#7159) Fix logrotate for apache2 package.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Tue, 28 Jun 2011 17:43:21 -0700
+
+pe-httpd (2.2.16-1puppet8) precise; urgency=low
+
+  * [f61b7f4] Fixing lintian errors for httpd/apache.
+
+ -- Michael Stahnke <stahnma@puppetlabs.com>  Thu, 16 Jun 2011 16:41:35 -0700
+
+pe-httpd (2.2.16-1puppet7) precise; urgency=low
+
+  * [9ff6e08] Remove pe-httpd-dbg
+  * [64f85ad] Remove debian/NEWS
+  * [99f91df] Update required package versions for building on Debian
+
+  * [ee6b58d] Update maintainer information in debian/control to reflect
+    Puppet Labs
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 13 Jan 2011 14:43:56 -0800
+
+pe-httpd (2.2.16-1puppet6) precise; urgency=low
+
+  * [9a03cfe] Fixup whitespace in pe-httpd-common.postinst
+  * [643cd26] Enable headers module in pe-httpd-common.postinst
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 06 Jan 2011 11:45:05 -0800
+
+pe-httpd (2.2.16-1puppet5) precise; urgency=low
+
+  * [0368813] Disable listening on ports 80, and 443 by default
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Wed, 29 Dec 2010 23:03:21 -0500
+
+pe-httpd (2.2.16-1puppet4) precise; urgency=low
+
+  * Update to gbp.conf
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Fri, 17 Dec 2010 09:50:43 -0800
+
+pe-httpd (2.2.16-1puppet3) precise; urgency=low
+
+  * [adee939] Use name of config files, instead of the .so for mod_ssl
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Tue, 14 Dec 2010 10:35:41 -0800
+
+pe-httpd (2.2.16-1puppet2) precise; urgency=low
+
+  * [05f31c8] Enable mod_ssl by default
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Mon, 13 Dec 2010 18:05:01 -0800
+
+pe-httpd (2.2.16-1puppet1) precise; urgency=low
+
+  * [d69bba7] Start packaging Apache for Puppet Enterprise
+
+ -- Jacob Helwig <jacob@puppetlabs.com>  Thu, 09 Dec 2010 15:46:30 -0800
--- pe-httpd-2.2.29.orig/debian/copyright
+++ pe-httpd-2.2.29/debian/copyright
@@ -0,0 +1,546 @@
+This package was debianized by Thom May <thom@ubuntu.com> on
+Tues, 8 Feb 2005 16:00:00 +0000.
+
+It was downloaded from http://httpd.apache.org/download.cgi
+
+Upstream Authors:
+	The Apache Software Foundation - http://httpd.apache.org
+	For apache2-mpm-itk:
+	Steinar H. Gunderson <sgunderson@bigfoot.com>
+	Knut Auvor Grythe <knut@auvor.no>
+
+Copyright:
+
+Licensed to the Apache Software Foundation (ASF) under one or more contributor
+license agreements. The ASF licenses this work to You under the Apache License,
+Version 2.0 (the "License"); you may not use this work except in compliance
+with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+On a Debian system, the license can be found at
+/usr/share/common-licenses/Apache-2.0 .
+
+APACHE2-MPM-ITK:
+
+apache2-mpm-itk is copyright Steinar H. Gunderson <sgunderson@bigfoot.com>
+and Knut Auvor Grythe <knut@auvor.no>, and is provided under the same license
+as the Apache web server.
+
+Get the latest version at http://mpm-itk.sesse.net/ .
+
+APACHE HTTP SERVER SUBCOMPONENTS: 
+
+The Apache HTTP Server includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for the these subcomponents is subject to the terms and
+conditions of the following licenses. 
+
+For the mod_mime_magic component:
+
+/*
+ * mod_mime_magic: MIME type lookup via file magic numbers
+ * Copyright (c) 1996-1997 Cisco Systems, Inc.
+ *
+ * This software was submitted by Cisco Systems to the Apache Group in July
+ * 1997.  Future revisions and derivatives of this source code must
+ * acknowledge Cisco Systems as the original contributor of this module.
+ * All other licensing and usage conditions are those of the Apache Group.
+ *
+ * Some of this code is derived from the free version of the file command
+ * originally posted to comp.sources.unix.  Copyright info for that program
+ * is included below as required.
+ * ---------------------------------------------------------------------------
+ * - Copyright (c) Ian F. Darwin, 1987. Written by Ian F. Darwin.
+ *
+ * This software is not subject to any license of the American Telephone and
+ * Telegraph Company or of the Regents of the University of California.
+ *
+ * Permission is granted to anyone to use this software for any purpose on any
+ * computer system, and to alter it and redistribute it freely, subject to
+ * the following restrictions:
+ *
+ * 1. The author is not responsible for the consequences of use of this
+ * software, no matter how awful, even if they arise from flaws in it.
+ *
+ * 2. The origin of this software must not be misrepresented, either by
+ * explicit claim or by omission.  Since few users ever read sources, credits
+ * must appear in the documentation.
+ *
+ * 3. Altered versions must be plainly marked as such, and must not be
+ * misrepresented as being the original software.  Since few users ever read
+ * sources, credits must appear in the documentation.
+ *
+ * 4. This notice may not be removed or altered.
+ * -------------------------------------------------------------------------
+ *
+ */
+
+For the file /etc/apache2/magic (taken from the package file 4.17-5etch3):
+
+Copyright (c) Ian F. Darwin 1986, 1987, 1989, 1990, 1991, 1992, 1994, 1995.
+Software written by Ian F. Darwin and others;
+maintained 1994-2004 Christos Zoulas.
+
+This software is not subject to any export provision of the United States
+Department of Commerce, and may be exported to any country or planet.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice immediately at the beginning of the file, without modification,
+   this list of conditions, and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+
+For the  modules\mappers\mod_imap.c component:
+
+  "macmartinized" polygon code copyright 1992 by Eric Haines, erich@eye.com
+
+For the  server\util_md5.c component:
+
+/************************************************************************
+ * NCSA HTTPd Server
+ * Software Development Group
+ * National Center for Supercomputing Applications
+ * University of Illinois at Urbana-Champaign
+ * 605 E. Springfield, Champaign, IL 61820
+ * httpd@ncsa.uiuc.edu
+ *
+ * Copyright  (C)  1995, Board of Trustees of the University of Illinois
+ *
+ ************************************************************************
+ *
+ * md5.c: NCSA HTTPd code which uses the md5c.c RSA Code
+ *
+ *  Original Code Copyright (C) 1994, Jeff Hostetler, Spyglass, Inc.
+ *  Portions of Content-MD5 code Copyright (C) 1993, 1994 by Carnegie Mellon
+ *     University (see Copyright below).
+ *  Portions of Content-MD5 code Copyright (C) 1991 Bell Communications 
+ *     Research, Inc. (Bellcore) (see Copyright below).
+ *  Portions extracted from mpack, John G. Myers - jgm+@cmu.edu
+ *  Content-MD5 Code contributed by Martin Hamilton (martin@net.lut.ac.uk)
+ *
+ */
+
+
+/* these portions extracted from mpack, John G. Myers - jgm+@cmu.edu */
+/* (C) Copyright 1993,1994 by Carnegie Mellon University
+ * All Rights Reserved.
+ *
+ * Permission to use, copy, modify, distribute, and sell this software
+ * and its documentation for any purpose is hereby granted without
+ * fee, provided that the above copyright notice appear in all copies
+ * and that both that copyright notice and this permission notice
+ * appear in supporting documentation, and that the name of Carnegie
+ * Mellon University not be used in advertising or publicity
+ * pertaining to distribution of the software without specific,
+ * written prior permission.  Carnegie Mellon University makes no
+ * representations about the suitability of this software for any
+ * purpose.  It is provided "as is" without express or implied
+ * warranty.
+ *
+ * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
+ * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1991 Bell Communications Research, Inc. (Bellcore)
+ *
+ * Permission to use, copy, modify, and distribute this material
+ * for any purpose and without fee is hereby granted, provided
+ * that the above copyright notice and this permission notice
+ * appear in all copies, and that the name of Bellcore not be
+ * used in advertising or publicity pertaining to this
+ * material without the specific, prior written permission
+ * of an authorized representative of Bellcore.  BELLCORE
+ * MAKES NO REPRESENTATIONS ABOUT THE ACCURACY OR SUITABILITY
+ * OF THIS MATERIAL FOR ANY PURPOSE.  IT IS PROVIDED "AS IS",
+ * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES.  
+ */
+
+For the  srclib\apr\include\apr_md5.h component: 
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+
+For the  srclib\apr\passwd\apr_md5.c component:
+
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+/*
+ * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
+ * MD5 crypt() function, which is licenced as follows:
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.  Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ */
+
+For the srclib\apr-util\crypto\apr_md4.c component:
+
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the srclib\apr-util\include\apr_md4.h component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+
+For the srclib\apr-util\test\testdbm.c component:
+
+/* ====================================================================
+ * The Apache Software License, Version 1.1
+ *
+ * Copyright (c) 2000-2002 The Apache Software Foundation.  All rights
+ * reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. The end-user documentation included with the redistribution,
+ *    if any, must include the following acknowledgment:
+ *       "This product includes software developed by the
+ *        Apache Software Foundation (http://www.apache.org/)."
+ *    Alternately, this acknowledgment may appear in the software itself,
+ *    if and wherever such third-party acknowledgments normally appear.
+ *
+ * 4. The names "Apache" and "Apache Software Foundation" must
+ *    not be used to endorse or promote products derived from this
+ *    software without prior written permission. For written
+ *    permission, please contact apache@apache.org.
+ *
+ * 5. Products derived from this software may not be called "Apache",
+ *    nor may "Apache" appear in their name, without prior written
+ *    permission of the Apache Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ * This file came from the SDBM package (written by oz@nexus.yorku.ca).
+ * That package was under public domain. This file has been ported to
+ * APR, updated to ANSI C and other, newer idioms, and added to the Apache
+ * codebase under the above copyright and license.
+ */
+
+
+For the srclib\apr-util\test\testmd4.c component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
+ * rights reserved.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the srclib\apr-util\xml\expat\conftools\install-sh component:
+
+#
+# install - install a program, script, or datafile
+# This comes from X11R5 (mit/util/scripts/install.sh).
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+#
+
+For the srclib\pcre\install-sh component:
+
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+
+For the pcre component:
+
+PCRE LICENCE
+------------
+
+PCRE is a library of functions to support regular expressions whose syntax
+and semantics are as close as possible to those of the Perl 5 language.
+
+Written by: Philip Hazel <ph10@cam.ac.uk>
+
+University of Cambridge Computing Service,
+Cambridge, England. Phone: +44 1223 334714.
+
+Copyright (c) 1997-2001 University of Cambridge
+
+Permission is granted to anyone to use this software for any purpose on any
+computer system, and to redistribute it freely, subject to the following
+restrictions:
+
+1. This software is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+2. The origin of this software must not be misrepresented, either by
+   explicit claim or by omission. In practice, this means that if you use
+   PCRE in software which you distribute to others, commercially or
+   otherwise, you must put a sentence like this
+
+     Regular expression support is provided by the PCRE library package,
+     which is open source software, written by Philip Hazel, and copyright
+     by the University of Cambridge, England.
+
+   somewhere reasonably visible in your documentation and in any relevant
+   files or online help data or similar. A reference to the ftp site for
+   the source, that is, to
+
+     ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/
+
+   should also be given in the documentation.
+
+3. Altered versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+
+4. If PCRE is embedded in any software that is released under the GNU
+   General Purpose Licence (GPL), or Lesser General Purpose Licence (LGPL),
+   then the terms of that licence shall supersede any condition above with
+   which it is incompatible.
+
+The documentation for PCRE, supplied in the "doc" directory, is distributed
+under the same terms as the software itself.
+
+End PCRE LICENCE
+
+Note: The various versions of the GPL and the LGPL can be found in
+/usr/share/common-licenses/.
+
+For the test\zb.c component:
+
+/*                          ZeusBench V1.01
+			    ===============
+
+This program is Copyright (C) Zeus Technology Limited 1996.
+
+This program may be used and copied freely providing this copyright notice
+is not removed.
+
+This software is provided "as is" and any express or implied waranties, 
+including but not limited to, the implied warranties of merchantability and
+fitness for a particular purpose are disclaimed.  In no event shall 
+Zeus Technology Ltd. be liable for any direct, indirect, incidental, special, 
+exemplary, or consequential damaged (including, but not limited to, 
+procurement of substitute good or services; loss of use, data, or profits;
+or business interruption) however caused and on theory of liability.  Whether
+in contract, strict liability or tort (including negligence or otherwise) 
+arising in any way out of the use of this software, even if advised of the
+possibility of such damage.
+
+     Written by Adam Twiss (adam@zeus.co.uk).  March 1996
+
+Thanks to the following people for their input:
+  Mike Belshe (mbelshe@netscape.com) 
+  Michael Campanella (campanella@stevms.enet.dec.com)
+
+*/
+
+For the expat xml parser component:
+
+Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd
+                               and Clark Cooper
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+	
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+	
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====================================================================
+
+OpenDocument icons:
+-------------------
+
+These icons are copyright of Pete Harlow and licensed under the Apache
+license. See 
+https://bugs.edge.launchpad.net/ubuntu/+source/apache2/+bug/130836 
+http://www.catnip.co.uk/opendocument/icons/#apache
--- pe-httpd-2.2.29.orig/debian/setup-instance
+++ pe-httpd-2.2.29/debian/setup-instance
@@ -0,0 +1,39 @@
+#!/bin/sh
+
+set -eu
+
+if [ $# != 1 ] ; then
+	echo usage: $0 '<suffix>'
+	exit 1
+fi
+
+# the SUFFIX must not contain spaces or shell meta characters
+SUFFIX=$1
+
+if [ -e /etc/apache2-$SUFFIX ] ; then
+	echo ERROR: /etc/apache2-$SUFFIX already exists
+	exit 2
+fi
+
+echo Setting up /etc/apache2-$SUFFIX ...
+cp -a /etc/apache2 /etc/apache2-$SUFFIX
+
+echo Setting up /etc/init.d/apache2-$SUFFIX ...
+cp /usr/share/doc/apache2.2-common/examples/secondary-init-script /etc/init.d/apache2-$SUFFIX
+# adjust service name (this prevents us from using a simple symlink)
+perl -p -i -e s,XXX,$SUFFIX, /etc/init.d/apache2-$SUFFIX
+chmod 755 /etc/init.d/apache2-$SUFFIX
+
+echo -n Setting up symlinks: 
+for a in a2enmod a2dismod a2ensite a2dissite apache2ctl ; do
+	echo -n " $a-$SUFFIX"
+	ln -s /usr/sbin/$a /usr/local/sbin/$a-$SUFFIX
+done
+echo
+
+echo Setting up /etc/logrotate.d/apache2-$SUFFIX and /var/log/apache2-$SUFFIX ...
+cp -a /etc/logrotate.d/apache2 /etc/logrotate.d/apache2-$SUFFIX
+perl -p -i -e s,apache2,apache2-$SUFFIX,g /etc/logrotate.d/apache2-$SUFFIX
+mkdir /var/log/apache2-$SUFFIX
+chmod 750 /var/log/apache2-$SUFFIX
+chown root:adm /var/log/apache2-$SUFFIX
--- pe-httpd-2.2.29.orig/debian/pe-httpd-prefork-dev.dirs
+++ pe-httpd-2.2.29/debian/pe-httpd-prefork-dev.dirs
@@ -0,0 +1,4 @@
+opt/puppet/include/httpd
+opt/puppet/bin
+opt/puppet/share/httpd/build
+opt/puppet/share/man/man8
--- pe-httpd-2.2.29.orig/debian/mpms.preinst
+++ pe-httpd-2.2.29/debian/mpms.preinst
@@ -0,0 +1,18 @@
+#!/bin/bash
+# Debian preinstall handling for pe-httpd
+# - Thom May <thom@debian.org>
+
+set -e
+
+case "${1}" in
+  install)
+    rm -f /var/cache/pe-httpd/reload
+  ;;
+  upgrade)
+    if [ -d /var/cache/pe-httpd ]; then
+      touch /var/cache/pe-httpd/reload
+    fi
+  ;;
+esac
+
+#DEBHELPER#
--- pe-httpd-2.2.29.orig/debian/pe-httpd.bug-script
+++ pe-httpd-2.2.29/debian/pe-httpd.bug-script
@@ -0,0 +1,60 @@
+#!/usr/bin/perl -w
+
+use strict;
+use Text::Wrap;
+$Text::Wrap::columns = 70;
+
+open (my $out, ">&=3") or die "could not open FD 3\n";
+
+my $apache = ". /etc/puppetlabs/httpd/envvars && /opt/puppet/sbin/pe-httpd";
+my $res = `$apache -t 2>&1`;
+my @modules;
+my $php;
+if ($res !~ "Syntax OK") {
+	# if we are not root, syntax check will fail because ssl private keys
+	# are not readable
+	print $out "Config file syntax check failed.\n" if $> == 0;
+	@modules = sort glob("/etc/puppetlabs/httpd/mods-enabled/*.load");
+	map { s{^/etc/puppetlabs/httpd/mods-enabled/(.*)\.load$}{$1} } @modules;
+	print $out "List of /etc/puppetlabs/httpd/mods-enabled/*.load:\n";
+}
+else {
+	@modules = sort `$apache -M 2>&1`;
+	@modules = map { /^ (.*)_module \(shared\)/ ? ($1) : () } @modules;
+	print $out "List of enabled modules from 'pe-httpd -M':\n";
+}
+if (! scalar @modules) {
+	print $out "Could not determine module list\n";
+}
+else {
+	my $missing;
+	foreach my $m (@modules) {
+		if (-e "/etc/puppetlabs/httpd/mods-available/$m.conf" and
+		    ! -e "/etc/puppetlabs/httpd/mods-enabled/$m.conf") {
+			$m .= "*";
+			$missing = 1;
+		}
+		if ($m =~ /^(php\d)/) {
+			$php = $1;
+		}
+	}
+
+	print $out wrap("  ", "  ", "@modules\n");
+
+	print $out
+	    wrap("  ", "   ", 
+		"(A * means that the .conf file for that module is not " .
+		"enabled in /etc/puppetlabs/httpd/mods-enabled/)\n") 
+	    if $missing;
+}
+if (defined $php) {
+	my @exts = qx{egrep ^extension= /etc/$php/pe-httpd/php.ini /etc/$php/pe-httpd/conf.d/* 2>/dev/null};
+	if (scalar @exts) {
+		chomp @exts;
+		@exts = grep { ! m{\.dpkg-(?:bak|dist):} } @exts;
+		@exts = sort grep { s{^.*:extension=(\S+)\.\S+}{$1} } @exts;
+		print $out "List of enabled $php extensions:\n";
+		print $out wrap("  ", "  ", "@exts\n");
+	}
+}
+
--- pe-httpd-2.2.29.orig/debian/pe-httpd.monit
+++ pe-httpd-2.2.29/debian/pe-httpd.monit
@@ -0,0 +1,7 @@
+check process pe-httpd with pidfile /var/run/pe-httpd.pid
+   group www
+   start program = "/etc/init.d/pe-httpd start"
+   stop  program = "/etc/init.d/pe-httpd stop"
+   if failed host localhost port 80 
+        protocol HTTP request "/" then restart
+   if 5 restarts within 5 cycles then timeout
--- pe-httpd-2.2.29.orig/debian/logrotate
+++ pe-httpd-2.2.29/debian/logrotate
@@ -0,0 +1,8 @@
+/var/log/pe-httpd/*log {
+    missingok
+    notifempty
+    sharedscripts
+    postrotate
+        /sbin/service pe-httpd reload > /dev/null 2>/dev/null || true
+    endscript
+}
--- pe-httpd-2.2.29.orig/debian/a2ensite.8
+++ pe-httpd-2.2.29/debian/a2ensite.8
@@ -0,0 +1,70 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH A2ENSITE 8 "8 June 2007"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+a2ensite, a2dissite \- enable or disable an apache2 site / virtual host
+.SH SYNOPSIS
+.B a2ensite
+.RI [ site ]
+.PP
+.B a2dissite
+.RI [ site ]
+.SH DESCRIPTION
+This manual page documents briefly the
+.B a2ensite
+and
+.B a2dissite
+commands.
+.PP
+.B a2ensite
+is a script that enables the specified site (which contains a <VirtualHost> block) within the
+.B apache2
+configuration.  It does this by creating symlinks within
+.BR /etc/apache2/sites-enabled .
+Likewise,
+.B a2dissite
+disables a site by removing those symlinks.  It is not an error to
+enable a site which is already enabled, or to disable one which is
+already disabled.
+.PP
+The
+.B default
+site is handled specially: The resulting symlink will be called
+.B 000-default
+in order to be loaded first.
+.SH EXAMPLES
+.RS
+.B "a2dissite default"
+.RE
+.PP
+Disables the
+.B default
+site.
+.SH FILES
+.TP
+.B /etc/apache2/sites-available
+Directory with files giving information on available sites.
+.TP
+.B /etc/apache2/sites-enabled
+Directory with links to the files in
+.B sites-available
+for enabled sites.
+.SH "SEE ALSO"
+.BR apache2ctl (8).
+.SH AUTHOR
+This manual page was written by Stefan Fritsch <sf@debian.org> (based on the a2enmod manual
+page by Daniel Stone <daniel@sfarc.net>) for the Debian GNU/Linux distribution.
--- pe-httpd-2.2.29.orig/debian/pe-httpd-threaded-dev.dirs
+++ pe-httpd-2.2.29/debian/pe-httpd-threaded-dev.dirs
@@ -0,0 +1,4 @@
+opt/puppet/include/httpd
+opt/puppet/bin
+opt/puppet/share/httpd/build
+opt/puppet/share/man/man8
--- pe-httpd-2.2.29.orig/debian/secondary-init-script
+++ pe-httpd-2.2.29/debian/secondary-init-script
@@ -0,0 +1,19 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          pe-httpd-XXX
+# Required-Start:    $local_fs $remote_fs $network $syslog
+# Required-Stop:     $local_fs $remote_fs $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# X-Interactive:     true
+# Short-Description: Start/stop pe-httpd web server (config /etc/puppetlabs/httpd-XXX)
+### END INIT INFO
+
+set -e
+
+#
+# this init script can be installed as /etc/init.d/pe-httpd-XXX
+#
+
+# source original init script to keep $0 and other arguments
+. /etc/init.d/pe-httpd
--- pe-httpd-2.2.29.orig/debian/pe-httpd.doc-base
+++ pe-httpd-2.2.29/debian/pe-httpd.doc-base
@@ -0,0 +1,10 @@
+Document: pe-httpd-manual
+Title: Apache HTTP Server Version 2.2 Documentation
+Abstract: This documentation describes the configuration of the Apache Web
+ server and the included modules.
+Section: web
+
+Format: HTML
+Index: /usr/share/doc/pe-httpd/manual/en/index.html
+Files: /usr/share/doc/pe-httpd/manual/*/*.html
+ /usr/share/doc/pe-httpd/manual/*/*/*.html
--- pe-httpd-2.2.29.orig/debian/mpms.lintian-overrides
+++ pe-httpd-2.2.29/debian/mpms.lintian-overrides
@@ -0,0 +1,7 @@
+binary-without-manpage opt/puppet/sbin/pe-httpd
+debug-package-should-be-named-dbg usr/lib/debug/usr/
+dir-or-file-in-opt opt/puppet/
+dir-or-file-in-opt opt/puppet/lib/
+dir-or-file-in-opt opt/puppet/lib/httpd/*
+dir-or-file-in-opt opt/puppet/sbin/
+dir-or-file-in-opt opt/puppet/sbin/pe-httpd
--- pe-httpd-2.2.29.orig/debian/mpms.postinst
+++ pe-httpd-2.2.29/debian/mpms.postinst
@@ -0,0 +1,26 @@
+#!/bin/sh
+set -e
+
+if [ "$1" != "configure" ]; then
+        exit 0
+fi
+
+P=pe-httpd-mpm-MPMXXX
+
+# Migrate our kill symlinks, including ones the user may have done an s/S/K/ to:
+for i in `seq 0 6`; do
+  if [ -L /etc/rc"$i".d/K91pe-httpd ]; then
+    mv /etc/rc"$i".d/K91pe-httpd /etc/rc"$i".d/K09pe-httpd
+  fi
+done
+
+if dpkg --compare-versions "$2" lt 2.2.11-5~ ; then
+  DOCDIR=/usr/share/doc/$P
+  if [ ! -h $DOCDIR -a -d $DOCDIR ] ; then
+    rmdir $DOCDIR 2> /dev/null && ln -s pe-httpd-common $DOCDIR
+  fi
+fi
+
+#DEBHELPER#
+
+exit 0
--- pe-httpd-2.2.29.orig/debian/pe-httpd.postinst
+++ pe-httpd-2.2.29/debian/pe-httpd.postinst
@@ -0,0 +1,126 @@
+#!/bin/bash
+# postinst for pe-httpd
+
+set -e
+
+if [ "$1" != "configure" ]; then
+  exit 0
+fi
+
+PE_USER=pe-apache
+P=pe-httpd
+PE_DIR=/opt/puppet
+CACHEDIR="/var/cache/${P}"
+BINDIR=/opt/puppet/bin
+
+mod_is_enabled() {
+  test -L "/etc/puppetlabs/httpd/mods-enabled/${1}.load"
+}
+
+for file in ab dbmanage htdbm htdigest htpasswd logresolve ; do
+  if [ -f "${BINDIR}/${file}" ] ; then
+    chmod 700 "${BINDIR}/${file}" >/dev/null 2>&1 || :
+    chown root:root "${BINDIR}/${file}" >/dev/null 2>&1 || :
+  fi
+done
+
+# set up dummy error and access logs
+if [ -z "${2}" ]; then
+touch /var/log/pe-httpd/error.log /var/log/pe-httpd/access.log
+chown root:adm /var/log/pe-httpd/error.log /var/log/pe-httpd/access.log
+chmod 0640 /var/log/pe-httpd/error.log /var/log/pe-httpd/access.log
+fi
+
+if ( dpkg --compare-versions "$2" lt 2.2.3-3.1 ); then
+  /opt/puppet/sbin/a2enmod -q alias
+  /opt/puppet/sbin/a2enmod -q autoindex
+  /opt/puppet/sbin/a2enmod -q dir
+  /opt/puppet/sbin/a2enmod -q env
+  /opt/puppet/sbin/a2enmod -q mime
+  /opt/puppet/sbin/a2enmod -q negotiation
+  /opt/puppet/sbin/a2enmod -q setenvif
+  /opt/puppet/sbin/a2enmod -q status
+  /opt/puppet/sbin/a2enmod -q auth_basic
+  /opt/puppet/sbin/a2enmod -q deflate
+  /opt/puppet/sbin/a2enmod -q ssl
+  /opt/puppet/sbin/a2enmod -q headers
+
+  /opt/puppet/sbin/a2enmod -q proxy
+  /opt/puppet/sbin/a2enmod -q proxy_http
+  /opt/puppet/sbin/a2enmod -q proxy_connect
+
+  # Those come from mod_auth:
+  /opt/puppet/sbin/a2enmod -q authz_default
+  /opt/puppet/sbin/a2enmod -q authz_user
+  /opt/puppet/sbin/a2enmod -q authz_groupfile
+  /opt/puppet/sbin/a2enmod -q authn_file
+
+  # This comes from mod_access:
+  /opt/puppet/sbin/a2enmod -q authz_host
+fi
+
+if [ -n "$2" ] && ( dpkg --compare-versions "$2" lt 2.2.15-4~ ) ; then
+  echo activating new config files ...
+  for a in ldap proxy_balancer proxy_ftp ; do
+    if mod_is_enabled "${a}" && [ ! -e "/etc/puppetlabs/httpd/mods-enabled/${a}.conf" ] ; then
+      /opt/puppet/sbin/a2enmod -q $a
+    fi
+  done
+  echo " done."
+fi
+
+if ( dpkg --compare-versions "$2" lt 2.2.15-1~0 ); then
+  /opt/puppet/sbin/a2enmod -q reqtimeout
+fi
+
+# Enable these mods for PE 3.4+. We do these unconditionally because we always want these enabled
+# and it returns 0 on repeated attempts. Just in case we ||:
+/opt/puppet/sbin/a2enmod -q rewrite || :
+/opt/puppet/sbin/a2enmod -q proxy || :
+/opt/puppet/sbin/a2enmod -q proxy_http || :
+/opt/puppet/sbin/a2enmod -q proxy_connect || :
+
+# Note, this line catches new installs as well as upgrades
+if ( dpkg --compare-versions "$2" lt 2.2.7-1~0 ); then
+  if [ ! -e /var/www/index.html  -a \
+       ! -h /var/www/index.html  -a \
+       ! -e /var/www/index.cgi   -a \
+       ! -e /var/www/index.pl    -a \
+       ! -e /var/www/index.php   -a \
+       ! -e /var/www/index.xhtml -a \
+       ! -e /var/www/index.htm ]; then
+    cp /opt/puppet/share/httpd/default-site/index.html /opt/puppet/var/www/index.html
+  fi
+fi
+
+# Set ownership on the cache directory
+if [ -d "${CACHEDIR}" ] ; then
+  chown -R "${PE_USER}":"${PE_USER}" "${CACHEDIR}"
+fi
+
+# Set ownership on suexec
+if [ -d "${PE_DIR}/lib/httpd/suexec" ] ; then
+  chgrp "${PE_USER}" "${PE_DIR}/lib/httpd/suexec"
+fi
+
+# DavLockDB format change
+if ( dpkg --compare-versions "$2" lt 2.2.14-3~ ); then
+  rm -f /var/lock/pe-httpd/DAVLock.dir /var/lock/pe-httpd/DAVLock.pag
+fi
+
+# The definition of other_vhost_access.log has been moved.
+# Disable the new definition if the admin has changed the old
+# one (as determined by preinst).
+if [ -e /etc/puppetlabs/httpd/disable-other-vhost-access-log.dpkg-pe-httpd-common ] ; then
+  echo "Disabling /etc/puppetlabs/httpd/conf.d/other-vhosts-access-log"
+  perl -p -i -e 's/^(CustomLog.*)$/#$1/' /etc/puppetlabs/httpd/conf.d/other-vhosts-access-log
+  rm /etc/puppetlabs/httpd/disable-other-vhost-access-log.dpkg-pe-httpd-common
+fi
+
+rm -f /etc/puppetlabs/httpd/ports.conf.dpkg-pe-httpd-common.old
+rm -f /etc/default/pe-httpd.dpkg-pe-httpd-common.old
+rm -f /etc/puppetlabs/httpd/conf.d/charset.dpkg-pe-httpd-common.old
+
+[ -f /etc/puppetlabs/httpd/httpd.conf ] || touch /etc/puppetlabs/httpd/httpd.conf
+
+#DEBHELPER#
--- pe-httpd-2.2.29.orig/debian/a2enmod.8
+++ pe-httpd-2.2.29/debian/a2enmod.8
@@ -0,0 +1,68 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH A2ENMOD 8 "12 October 2006"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+a2enmod, a2dismod \- enable or disable an pe-httpd module
+.SH SYNOPSIS
+.B a2enmod
+.RI [ module ]
+.PP
+.B a2dismod
+.RI [ module ]
+.SH DESCRIPTION
+This manual page documents briefly the
+.B a2enmod
+and
+.B a2dismod
+commands.
+.PP
+.B a2enmod
+is a script that enables the specified module within the
+.B pe-httpd
+configuration.  It does this by creating symlinks within
+.BR /etc/puppetlabs/httpd/mods-enabled .
+Likewise,
+.B a2dismod
+disables a module by removing those symlinks.  It is not an error to
+enable a module which is already enabled, or to disable one which is
+already disabled.
+.SH EXAMPLES
+.RS
+.B "a2enmod imagemap"
+.br
+.B "a2dismod mime_magic"
+.RE
+.PP
+Enables the
+.B mod_imagemap
+module, and disables the
+.B mod_mime_magic
+module.
+.SH FILES
+.TP
+.B /etc/puppetlabs/httpd/mods-available
+Directory with files giving information on available modules.
+.TP
+.B /etc/puppetlabs/httpd/mods-enabled
+Directory with links to the files in
+.B mods-available
+for enabled modules.
+.SH "SEE ALSO"
+.BR apache2ctl (8).
+.SH AUTHOR
+This manual page was written by Daniel Stone <daniel@sfarc.net> for the Debian
+GNU/Linux distribution, as it is a Debian-specific script with the package.
--- pe-httpd-2.2.29.orig/debian/a2dismod.8
+++ pe-httpd-2.2.29/debian/a2dismod.8
@@ -0,0 +1 @@
+.so man8/a2enmod.8
--- pe-httpd-2.2.29.orig/debian/pe-httpd.dirs
+++ pe-httpd-2.2.29/debian/pe-httpd.dirs
@@ -0,0 +1,24 @@
+etc/logrotate.d
+etc/puppetlabs/httpd/conf.d
+etc/puppetlabs/httpd/mods-enabled
+etc/puppetlabs/httpd/sites-enabled
+etc/puppetlabs/httpd/suexec
+etc/ufw/applications.d
+opt/puppet/bin
+opt/puppet/lib/cgi-bin
+opt/puppet/lib/httpd
+opt/puppet/lib/httpd/mpm-event
+opt/puppet/lib/httpd/mpm-itk
+opt/puppet/lib/httpd/mpm-prefork
+opt/puppet/lib/httpd/mpm-worker
+opt/puppet/sbin
+opt/puppet/share/httpd/build
+opt/puppet/share/httpd/default-site
+opt/puppet/share/man/man1
+opt/puppet/share/man/man8
+opt/puppet/var/www
+usr/share/doc/pe-httpd
+usr/share/lintian/overrides
+var/cache/pe-httpd
+var/cache/pe-httpd/mod_disk_cache
+var/log/pe-httpd
--- pe-httpd-2.2.29.orig/debian/apache2ctl.8
+++ pe-httpd-2.2.29/debian/apache2ctl.8
@@ -0,0 +1,182 @@
+.TH apache2ctl 8 "April 2008"
+.\" The Apache Software License, Version 1.1
+.\"
+.\" Copyright (c) 2000-2002 The Apache Software Foundation.  All rights
+.\" reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in
+.\"    the documentation and/or other materials provided with the
+.\"    distribution.
+.\"
+.\" 3. The end-user documentation included with the redistribution,
+.\"    if any, must include the following acknowledgment:
+.\"       "This product includes software developed by the
+.\"        Apache Software Foundation (http://www.apache.org/)."
+.\"    Alternately, this acknowledgment may appear in the software itself,
+.\"    if and wherever such third-party acknowledgments normally appear.
+.\"
+.\" 4. The names "Apache" and "Apache Software Foundation" must
+.\"    not be used to endorse or promote products derived from this
+.\"    software without prior written permission. For written
+.\"    permission, please contact apache@apache.org.
+.\"
+.\" 5. Products derived from this software may not be called "Apache",
+.\"    nor may "Apache" appear in their name, without prior written
+.\"    permission of the Apache Software Foundation.
+.\"
+.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+.\" WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+.\" DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
+.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+.\" LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+.\" USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+.\" ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+.\" OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+.\" OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\" This software consists of voluntary contributions made by many
+.\" individuals on behalf of the Apache Software Foundation.  For more
+.\" information on the Apache Software Foundation, please see
+.\" <http://www.apache.org/>.
+.\"
+.SH NAME
+apache2ctl \- Apache HTTP server control interface
+.SH SYNOPSIS
+When acting in SysV init mode, apache2ctl takes simple, one-word commands,
+defined below.
+.PP
+.B apachectl 
+.I command
+.PP
+.B apache2ctl 
+.I command
+.PP
+When acting in pass-through mode, apache2ctl can take all the arguments available
+for the httpd binary.
+.PP
+.B apachectl 
+.RI [ httpd-argument ]
+.PP
+.B apache2ctl 
+.RI [ httpd-argument ]
+.PP
+.SH DESCRIPTION
+.B apache2ctl
+is a front end to the Apache HyperText Transfer Protocol (HTTP) 
+server.  It is designed to help the administrator control the 
+functioning of the Apache 
+.B apache2
+daemon.  
+.PP
+.B NOTE: 
+The default Debian configuration requires the environment variables
+.BR APACHE_RUN_USER ,
+.BR APACHE_RUN_GROUP ,
+and
+.B APACHE_PID_FILE
+to be set in 
+.BR /etc/apache2/envvars .
+.PP
+The 
+.B apache2ctl
+script returns a 0 exit value on success, and >0 if an error 
+occurs.  For more details, view the comments in the script.
+.PP
+.SH OPTIONS
+The \fIcommand\fP can be any one or more of the following options:
+.TP 14
+.BI start
+Start the Apache daemon.  Gives an error if it is already running.
+.TP
+.BI stop
+Stops the Apache daemon.
+.TP
+.BI restart
+Restarts the Apache daemon by sending it a SIGHUP.  If the daemon
+is not running, it is started.
+This command automatically checks the configuration files via 
+.BI configtest
+before initiating the restart to to catch  the  most obvious  errors.
+However, it is still possible for the daemon to die because of problems
+with the configuration.
+.TP
+.BI fullstatus
+Displays a full status report from 
+.B mod_status. 
+For this to work, you need to have mod_status enabled on your server 
+and a text-based browser such as \fIlynx\fP available on your system.  The
+URL used to access the status report can be set by setting the
+.B APACHE_STATUSURL
+variable in 
+.BR /etc/apache2/envvars .
+.TP
+.BI status
+Displays a brief status report. Similar to the fullstatus option,
+except that the list of requests currently being served is omitted.
+.TP
+.BI graceful
+Gracefully restarts the Apache daemon by sending it a SIGUSR1.  If
+the daemon is not running, it is started.  This differs from a
+normal restart in that currently open connections are not aborted.
+A side effect is that old log files will not be closed immediately.
+This means that if used in a log rotation script, a substantial delay may be
+necessary to ensure that the old log files are closed before processing them.
+This command automatically checks the configuration files via apache2ctl
+configtest before initiating the restart to to catch the most obvious errors.
+However, it is still possible for the daemon to die because of problems with
+the configuration.
+.TP
+.BI graceful-stop
+Gracefully stops the Apache httpd daemon.
+This differs from a normal stop in that currently open connections are not
+aborted.
+A side effect is that old log files will not be closed immediately.
+.TP
+.BI configtest
+Run a configuration file syntax test. It parses the configuration
+files and either reports 
+.B "Syntax Ok"
+or information about the particular syntax error. This test does not catch
+all errors.
+.TP
+.BI help
+Displays a short help message.
+.TP
+The following option was available in earlier versions but has been removed.
+.TP
+.BI startssl
+To start httpd with SSL support, you should edit your configuration file to
+include the relevant directives and then use the normal apache2ctl start.
+.SH ENVIRONMENT
+The behaviour of
+.B apache2ctl
+can be influenced with these environment variables:
+.BR APACHE_HTTPD ,
+.BR APACHE_LYNX ,
+.BR APACHE_STATUSURL ,
+.BR APACHE_ULIMIT_MAX_FILES ,
+.BR APACHE_RUN_DIR ,
+.BR APACHE_LOCK_DIR ,
+.BR APACHE_RUN_USER ,
+.BR APACHE_ARGUMENTS ,
+.BR APACHE_ENVVARS .
+See the comments in the script for details.
+These variables (except 
+.BR APACHE_ENVVARS )
+can be set in
+.BR /etc/apache2/envvars .
+.SH SEE ALSO
+.BR pe-httpd(8) ,
+.BR /usr/share/doc/apache2.2-common/README.Debian.gz
+.
--- pe-httpd-2.2.29.orig/debian/check_forensic.8
+++ pe-httpd-2.2.29/debian/check_forensic.8
@@ -0,0 +1,16 @@
+.TH check_forensic 8
+.SH NAME
+check_forensic \- tool to extract mod_log_forensic output from apache log files
+.SH SYNOPSIS
+.B check_forensic
+<log_file>
+.SH "DESCRIPTION"
+chech_forensic is a simple shell script designed to help apache administrators
+to extract mod_log_forensic output from apache2 log files.
+It checks the forensic log for requests that did not complete
+and outputs the request log for each one.
+.PP
+.SH AUTHOR
+This manual page was written by Fabio M. Di Nitto
+<fabbione@fabbione.net>, for the Debian GNU/Linux system
+(but may be used by others).
--- pe-httpd-2.2.29.orig/debian/source/format
+++ pe-httpd-2.2.29/debian/source/format
@@ -0,0 +1 @@
+1.0
--- pe-httpd-2.2.29.orig/debian/config-dir/ports.conf
+++ pe-httpd-2.2.29/debian/config-dir/ports.conf
@@ -0,0 +1,24 @@
+# If you just change the port or add more ports here, you will likely also
+# have to change the VirtualHost statement in
+# /etc/apache2/sites-enabled/000-default
+# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
+# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
+# README.Debian.gz
+
+## Default ports disabled, since Puppet, and Dashboard use custom ports.
+# NameVirtualHost *:80
+# Listen 80
+#
+# <IfModule mod_ssl.c>
+#     # If you add NameVirtualHost *:443 here, you will also have to change
+#     # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
+#     # to <VirtualHost *:443>
+#     # Server Name Indication for SSL named virtual hosts is currently not
+#     # supported by MSIE on Windows XP.
+#     Listen 443
+# </IfModule>
+#
+# <IfModule mod_gnutls.c>
+#     Listen 443
+# </IfModule>
+
--- pe-httpd-2.2.29.orig/debian/config-dir/pe-httpd.conf
+++ pe-httpd-2.2.29/debian/config-dir/pe-httpd.conf
@@ -0,0 +1,231 @@
+#
+# Based upon the NCSA server configuration files originally by Rob McCool.
+#
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.2/ for detailed information about
+# the directives.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# The configuration directives are grouped into three basic sections:
+#  1. Directives that control the operation of the Apache server process as a
+#     whole (the 'global environment').
+#  2. Directives that define the parameters of the 'main' or 'default' server,
+#     which responds to requests that aren't handled by a virtual host.
+#     These directives also provide default values for the settings
+#     of all virtual hosts.
+#  3. Settings for virtual hosts, which allow Web requests to be sent to
+#     different IP addresses or hostnames and have them handled by the
+#     same Apache server process.
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "foo.log"
+# with ServerRoot set to "/etc/apache2" will be interpreted by the
+# server as "/etc/apache2/foo.log".
+#
+
+### Section 1: Global Environment
+#
+# The directives in this section affect the overall operation of Apache,
+# such as the number of concurrent requests it can handle or where it
+# can find its configuration files.
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the LockFile documentation (available
+# at <URL:http://httpd.apache.org/docs/2.2/mod/mpm_common.html#lockfile>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/puppetlabs/httpd"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+LockFile ${APACHE_LOCK_DIR}/accept.lock
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 15
+
+##
+## Server-Pool Size Regulation (MPM specific)
+## 
+
+# prefork MPM
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxClients: maximum number of server processes allowed to start
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_prefork_module>
+    StartServers          5
+    MinSpareServers       5
+    MaxSpareServers      10
+    MaxClients          300
+    MaxRequestsPerChild   0
+</IfModule>
+
+# worker MPM
+# StartServers: initial number of server processes to start
+# MaxClients: maximum number of simultaneous client connections
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#              graceful restart. ThreadLimit can only be changed by stopping
+#              and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_worker_module>
+    StartServers          2
+    MinSpareThreads      25
+    MaxSpareThreads      75
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxClients          400
+    MaxRequestsPerChild   0
+    ServerLimit          16
+</IfModule>
+
+# event MPM
+# StartServers: initial number of server processes to start
+# MaxClients: maximum number of simultaneous client connections
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_event_module>
+    StartServers          2
+    MaxClients          300
+    MinSpareThreads      25
+    MaxSpareThreads      75 
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxRequestsPerChild   0
+</IfModule>
+
+# These need to be set in /etc/puppetlabs/httpd/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+    Satisfy all
+</Files>
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+DefaultType text/plain
+
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+# Include module configuration:
+Include /etc/puppetlabs/httpd/mods-enabled/*.load
+Include /etc/puppetlabs/httpd/mods-enabled/*.conf
+
+# Include all the user configurations:
+Include /etc/puppetlabs/httpd/httpd.conf
+
+# Include ports listing
+Include /etc/puppetlabs/httpd/ports.conf
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see README.Debian for details.
+
+# Include generic snippets of statements
+Include /etc/puppetlabs/httpd/conf.d/
+
+# Include the virtual host configurations:
+Include /etc/puppetlabs/httpd/sites-enabled/
--- pe-httpd-2.2.29.orig/debian/config-dir/magic
+++ pe-httpd-2.2.29/debian/config-dir/magic
@@ -0,0 +1,935 @@
+# Magic data for mod_mime_magic (originally for file(1) command)
+#
+# The format is 4-5 columns:
+#    Column #1: byte number to begin checking from, ">" indicates continuation
+#    Column #2: type of data to match
+#    Column #3: contents of data to match
+#    Column #4: MIME type of result
+#    Column #5: MIME encoding of result (optional)
+
+#------------------------------------------------------------------------------
+# Localstuff:  file(1) magic for locally observed files
+# Add any locally observed files here.
+
+# Real Audio (Magic .ra\0375)
+0	belong		0x2e7261fd	audio/x-pn-realaudio
+0	string		.RMF		application/vnd.rn-realmedia
+
+#video/x-pn-realvideo
+#video/vnd.rn-realvideo
+#application/vnd.rn-realmedia
+#	sigh, there are many mimes for that but the above are the most common.
+
+# Taken from magic, converted to magic.mime
+# mime types according to http://www.geocities.com/nevilo/mod.htm:
+#	audio/it	.it
+#	audio/x-zipped-it	.itz
+#	audio/xm	fasttracker modules
+#	audio/x-s3m	screamtracker modules
+#	audio/s3m	screamtracker modules
+#	audio/x-zipped-mod	mdz
+#	audio/mod	mod
+#	audio/x-mod	All modules (mod, s3m, 669, mtm, med, xm, it, mdz, stm, itz, xmz, s3z)
+
+# Taken from loader code from mikmod version 2.14
+# by Steve McIntyre (stevem@chiark.greenend.org.uk)
+# <doj@cubic.org> added title printing on 2003-06-24
+0	string	MAS_UTrack_V00
+>14	string	>/0		audio/x-mod
+#audio/x-tracker-module
+
+#0	string	UN05		MikMod UNI format module sound data
+
+0	string	Extended\ Module: audio/x-mod
+#audio/x-tracker-module
+##>17	string	>\0		Title: "%s"
+
+21	string/c	\!SCREAM!	audio/x-mod
+#audio/x-screamtracker-module
+21	string	BMOD2STM	audio/x-mod
+#audio/x-screamtracker-module
+1080	string	M.K.		audio/x-mod
+#audio/x-protracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	M!K!		audio/x-mod
+#audio/x-protracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	FLT4		audio/x-mod
+#audio/x-startracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	FLT8		audio/x-mod
+#audio/x-startracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	4CHN		audio/x-mod
+#audio/x-fasttracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	6CHN		audio/x-mod
+#audio/x-fasttracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	8CHN		audio/x-mod
+#audio/x-fasttracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	CD81		audio/x-mod
+#audio/x-oktalyzer-tracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	OKTA		audio/x-mod
+#audio/x-oktalyzer-tracker-module
+#>0	string	>\0		Title: "%s"
+# Not good enough.
+#1082	string	CH
+#>1080	string	>/0		%.2s-channel Fasttracker "oktalyzer" module sound data
+1080	string	16CN		audio/x-mod
+#audio/x-taketracker-module
+#>0	string	>\0		Title: "%s"
+1080	string	32CN		audio/x-mod
+#audio/x-taketracker-module
+#>0	string	>\0		Title: "%s"
+
+# Impuse tracker module (it)
+0	string		IMPM		audio/x-mod
+#>4	string		>\0		"%s"
+#>40	leshort		!0		compatible w/ITv%x
+#>42	leshort		!0		created w/ITv%x
+
+#------------------------------------------------------------------------------
+# end local stuff
+#------------------------------------------------------------------------------
+
+# xml based formats!
+
+# svg
+
+0	string		\<?xml
+#			text/xml
+>38	string		\<\!DOCTYPE\040svg	image/svg+xml
+
+
+# xml
+0	string		\<?xml			text/xml
+
+
+#------------------------------------------------------------------------------
+# Java
+
+0	short		0xcafe
+>2	short		0xbabe		application/java
+
+#------------------------------------------------------------------------------
+# audio:  file(1) magic for sound formats
+#
+# from Jan Nicolai Langfeldt <janl@ifi.uio.no>,
+#
+
+# Sun/NeXT audio data
+0	string		.snd
+>12	belong		1		audio/basic
+>12	belong		2		audio/basic
+>12	belong		3		audio/basic
+>12	belong		4		audio/basic
+>12	belong		5		audio/basic
+>12	belong		6		audio/basic
+>12	belong		7		audio/basic
+
+>12	belong		23		audio/x-adpcm
+
+# DEC systems (e.g. DECstation 5000) use a variant of the Sun/NeXT format
+# that uses little-endian encoding and has a different magic number
+# (0x0064732E in little-endian encoding).
+0	lelong		0x0064732E	
+>12	lelong		1		audio/x-dec-basic
+>12	lelong		2		audio/x-dec-basic
+>12	lelong		3		audio/x-dec-basic
+>12	lelong		4		audio/x-dec-basic
+>12	lelong		5		audio/x-dec-basic
+>12	lelong		6		audio/x-dec-basic
+>12	lelong		7		audio/x-dec-basic
+#                                       compressed (G.721 ADPCM)
+>12	lelong		23		audio/x-dec-adpcm
+
+# Bytes 0-3 of AIFF, AIFF-C, & 8SVX audio files are "FORM"
+#					AIFF audio data
+8	string		AIFF		audio/x-aiff	
+#					AIFF-C audio data
+8	string		AIFC		audio/x-aiff	
+#					IFF/8SVX audio data
+8	string		8SVX		audio/x-aiff	
+
+
+
+# Creative Labs AUDIO stuff
+#					Standard MIDI data
+0	string	MThd			audio/unknown	
+#>9 	byte	>0			(format %d)
+#>11	byte	>1			using %d channels
+#					Creative Music (CMF) data
+0	string	CTMF			audio/unknown	
+#					SoundBlaster instrument data
+0	string	SBI			audio/unknown	
+#					Creative Labs voice data
+0	string	Creative\ Voice\ File	audio/unknown	
+## is this next line right?  it came this way...
+#>19	byte	0x1A
+#>23	byte	>0			- version %d
+#>22	byte	>0			\b.%d
+
+# [GRR 950115:  is this also Creative Labs?  Guessing that first line
+#  should be string instead of unknown-endian long...]
+#0	long		0x4e54524b	MultiTrack sound data
+#0	string		NTRK		MultiTrack sound data
+#>4	long		x		- version %ld
+
+# Microsoft WAVE format (*.wav)
+# [GRR 950115:  probably all of the shorts and longs should be leshort/lelong]
+#					Microsoft RIFF
+0	string		RIFF
+#					- WAVE format
+>8	string		WAVE		audio/x-wav
+>8	string/B	AVI		video/x-msvideo
+#
+>8 	string		CDRA		image/x-coreldraw
+
+# AAC (aka MPEG-2 NBC)
+0       beshort&0xfff6    0xfff0          audio/X-HX-AAC-ADTS
+0       string          ADIF            audio/X-HX-AAC-ADIF
+0       beshort&0xffe0  0x56e0          audio/MP4A-LATM
+0       beshort         0x4De1          audio/MP4A-LATM
+
+# MPEG Layer 3 sound files
+0       beshort&0xfffe  =0xfffa         audio/mpeg
+#MP3 with ID3 tag
+0	string		ID3		audio/mpeg
+# Ogg/Vorbis
+0	string		OggS		application/ogg
+
+#------------------------------------------------------------------------------
+# c-lang:  file(1) magic for C programs or various scripts
+#
+
+# XPM icons (Greg Roelofs, newt@uchicago.edu)
+# ideally should go into "images", but entries below would tag XPM as C source
+0	string		/*\ XPM		image/x-xpmi 7bit
+
+# 3DS (3d Studio files)
+#16	beshort		0x3d3d		image/x-3ds
+
+# this first will upset you if you're a PL/1 shop... (are there any left?)
+# in which case rm it; ascmagic will catch real C programs
+#					C or REXX program text
+#0	string		/*		text/x-c
+#					C++ program text
+#0	string		//		text/x-c++
+
+#------------------------------------------------------------------------------
+# commands:  file(1) magic for various shells and interpreters
+#
+#0       string          :\ shell archive or commands for antique kernel text
+0       string          #!/bin/sh               application/x-shellscript
+0       string          #!\ /bin/sh             application/x-shellscript
+0       string          #!/bin/csh              application/x-shellscript
+0       string          #!\ /bin/csh            application/x-shellscript
+# korn shell magic, sent by George Wu, gwu@clyde.att.com
+0       string          #!/bin/ksh              application/x-shellscript
+0       string          #!\ /bin/ksh            application/x-shellscript
+0       string          #!/bin/tcsh             application/x-shellscript
+0       string          #!\ /bin/tcsh           application/x-shellscript
+0       string          #!/usr/local/tcsh       application/x-shellscript
+0       string          #!\ /usr/local/tcsh     application/x-shellscript
+0       string          #!/usr/local/bin/tcsh   application/x-shellscript
+0       string          #!\ /usr/local/bin/tcsh application/x-shellscript
+# bash shell magic, from Peter Tobias (tobias@server.et-inf.fho-emden.de)
+0       string          #!/bin/bash     		application/x-shellscript
+0       string          #!\ /bin/bash           application/x-shellscript
+0       string          #!/usr/local/bin/bash   application/x-shellscript
+0       string          #!\ /usr/local/bin/bash application/x-shellscript
+
+#
+# zsh/ash/ae/nawk/gawk magic from cameron@cs.unsw.oz.au (Cameron Simpson)
+0       string          #!/bin/zsh	        application/x-shellscript
+0       string          #!/usr/bin/zsh	        application/x-shellscript
+0       string          #!/usr/local/bin/zsh    application/x-shellscript
+0       string          #!\ /usr/local/bin/zsh  application/x-shellscript
+0       string          #!/usr/local/bin/ash    application/x-shellscript
+0       string          #!\ /usr/local/bin/ash  application/x-shellscript
+#0       string          #!/usr/local/bin/ae     Neil Brown's ae
+#0       string          #!\ /usr/local/bin/ae   Neil Brown's ae
+0       string          #!/bin/nawk             application/x-nawk
+0       string          #!\ /bin/nawk           application/x-nawk
+0       string          #!/usr/bin/nawk         application/x-nawk
+0       string          #!\ /usr/bin/nawk       application/x-nawk
+0       string          #!/usr/local/bin/nawk   application/x-nawk
+0       string          #!\ /usr/local/bin/nawk application/x-nawk
+0       string          #!/bin/gawk             application/x-gawk
+0       string          #!\ /bin/gawk           application/x-gawk
+0       string          #!/usr/bin/gawk         application/x-gawk
+0       string          #!\ /usr/bin/gawk       application/x-gawk
+0       string          #!/usr/local/bin/gawk   application/x-gawk
+0       string          #!\ /usr/local/bin/gawk application/x-gawk
+#
+0       string          #!/bin/awk              application/x-awk
+0       string          #!\ /bin/awk            application/x-awk
+0       string          #!/usr/bin/awk          application/x-awk
+0       string          #!\ /usr/bin/awk        application/x-awk
+# update to distinguish from *.vcf files by Joerg Jenderek: joerg dot jenderek at web dot de
+#0	regex		BEGIN[[:space:]]*[{]	application/x-awk
+
+# For Larry Wall's perl language.  The ``eval'' line recognizes an
+# outrageously clever hack for USG systems.
+#                               Keith Waclena <keith@cerberus.uchicago.edu>
+0       string          #!/bin/perl                     application/x-perl
+0       string          #!\ /bin/perl                   application/x-perl
+0       string          eval\ "exec\ /bin/perl          application/x-perl
+0       string          #!/usr/bin/perl                 application/x-perl
+0       string          #!\ /usr/bin/perl               application/x-perl
+0       string          eval\ "exec\ /usr/bin/perl      application/x-perl
+0       string          #!/usr/local/bin/perl           application/x-perl
+0       string          #!\ /usr/local/bin/perl         application/x-perl
+0       string          eval\ "exec\ /usr/local/bin/perl application/x-perl
+
+#------------------------------------------------------------------------------
+# compress:  file(1) magic for pure-compression formats (no archives)
+#
+# compress, gzip, pack, compact, huf, squeeze, crunch, freeze, yabba, whap, etc.
+#
+# Formats for various forms of compressed data
+# Formats for "compress" proper have been moved into "compress.c",
+# because it tries to uncompress it to figure out what's inside.
+
+# standard unix compress
+#0	string		\037\235	application/x-compress
+
+# gzip (GNU zip, not to be confused with [Info-ZIP/PKWARE] zip archiver)
+#0       string          \037\213        application/x-gzip
+
+0		string			PK\003\004		application/x-zip
+
+# RAR archiver (Greg Roelofs, newt@uchicago.edu)
+0	string		Rar!		application/x-rar
+
+# According to gzip.h, this is the correct byte order for packed data.
+0	string		\037\036	application/octet-stream
+#
+# This magic number is byte-order-independent.
+#
+0	short		017437		application/octet-stream
+
+# XXX - why *two* entries for "compacted data", one of which is
+# byte-order independent, and one of which is byte-order dependent?
+#
+# compacted data
+0	short		0x1fff		application/octet-stream
+0	string		\377\037	application/octet-stream
+# huf output
+0	short		0145405		application/octet-stream
+
+# Squeeze and Crunch...
+# These numbers were gleaned from the Unix versions of the programs to
+# handle these formats.  Note that I can only uncrunch, not crunch, and
+# I didn't have a crunched file handy, so the crunch number is untested.
+#				Keith Waclena <keith@cerberus.uchicago.edu>
+#0	leshort		0x76FF		squeezed data (CP/M, DOS)
+#0	leshort		0x76FE		crunched data (CP/M, DOS)
+
+# Freeze
+#0	string		\037\237	Frozen file 2.1
+#0	string		\037\236	Frozen file 1.0 (or gzip 0.5)
+
+# lzh?
+#0	string		\037\240	LZH compressed data
+
+257	string		ustar\0		application/x-tar	posix
+257	string		ustar\040\040\0		application/x-tar	gnu
+
+0	short		070707		application/x-cpio
+0	short		0143561		application/x-cpio	swapped
+
+0	string		=<ar>		application/x-archive
+0	string		\!<arch>	application/x-archive
+>8	string		debian		application/x-debian-package
+
+#------------------------------------------------------------------------------
+#
+# RPM: file(1) magic for Red Hat Packages   Erik Troan (ewt@redhat.com)
+#
+0       beshort         0xedab
+>2      beshort         0xeedb          application/x-rpm
+
+0	lelong&0x8080ffff	0x0000081a	application/x-arc	lzw
+0	lelong&0x8080ffff	0x0000091a	application/x-arc	squashed
+0	lelong&0x8080ffff	0x0000021a	application/x-arc	uncompressed
+0	lelong&0x8080ffff	0x0000031a	application/x-arc	packed
+0	lelong&0x8080ffff	0x0000041a	application/x-arc	squeezed
+0	lelong&0x8080ffff	0x0000061a	application/x-arc	crunched
+
+0	leshort	0xea60	application/x-arj
+
+# LHARC/LHA archiver (Greg Roelofs, newt@uchicago.edu)
+2	string	-lh0-	application/x-lharc	lh0
+2	string	-lh1-	application/x-lharc	lh1
+2	string	-lz4-	application/x-lharc	lz4
+2	string	-lz5-	application/x-lharc	lz5
+#	[never seen any but the last; -lh4- reported in comp.compression:]
+2	string	-lzs-	application/x-lha	lzs
+2	string	-lh\ -	application/x-lha	lh
+2	string	-lhd-	application/x-lha	lhd
+2	string	-lh2-	application/x-lha	lh2
+2	string	-lh3-	application/x-lha	lh3
+2	string	-lh4-	application/x-lha	lh4
+2	string	-lh5-	application/x-lha	lh5
+2	string	-lh6-	application/x-lha	lh6
+2	string	-lh7-	application/x-lha	lh7
+# Shell archives
+10	string	#\ This\ is\ a\ shell\ archive	application/octet-stream	x-shell
+
+#------------------------------------------------------------------------------
+# frame:  file(1) magic for FrameMaker files
+#
+# This stuff came on a FrameMaker demo tape, most of which is
+# copyright, but this file is "published" as witness the following:
+#
+0	string		\<MakerFile	application/x-frame
+0	string		\<MIFFile	application/x-frame
+0	string		\<MakerDictionary	application/x-frame
+0	string		\<MakerScreenFon	application/x-frame
+0	string		\<MML		application/x-frame
+0	string		\<Book		application/x-frame
+0	string		\<Maker		application/x-frame
+
+#------------------------------------------------------------------------------
+# html:  file(1) magic for HTML (HyperText Markup Language) docs
+#
+# from Daniel Quinlan <quinlan@yggdrasil.com>
+#
+0	string/cB	\<!DOCTYPE\ html	text/html
+0	string/cb	\<head	text/html
+0	string/cb	\<title	text/html
+0       string/bc	\<html	text/html
+0	string		\<!--	text/html
+0	string/c	\<h1	text/html
+
+0	string		\<?xml			text/xml
+
+#------------------------------------------------------------------------------
+# images:  file(1) magic for image formats (see also "c-lang" for XPM bitmaps)
+#
+# originally from jef@helios.ee.lbl.gov (Jef Poskanzer),
+# additions by janl@ifi.uio.no as well as others. Jan also suggested
+# merging several one- and two-line files into here.
+#
+# XXX - byte order for GIF and TIFF fields?
+# [GRR:  TIFF allows both byte orders; GIF is probably little-endian]
+#
+
+# [GRR:  what the hell is this doing in here?]
+#0	string		xbtoa		btoa'd file
+
+# PBMPLUS
+#					PBM file
+0	string		P1		image/x-portable-bitmap	7bit
+#					PGM file
+0	string		P2		image/x-portable-greymap	7bit
+#					PPM file
+0	string		P3		image/x-portable-pixmap	7bit
+#					PBM "rawbits" file
+0	string		P4		image/x-portable-bitmap
+#					PGM "rawbits" file
+0	string		P5		image/x-portable-greymap
+#					PPM "rawbits" file
+0	string		P6		image/x-portable-pixmap
+
+# NIFF (Navy Interchange File Format, a modification of TIFF)
+# [GRR:  this *must* go before TIFF]
+0	string		IIN1		image/x-niff
+
+# TIFF and friends
+#					TIFF file, big-endian
+0	string		MM		image/tiff
+#					TIFF file, little-endian
+0	string		II		image/tiff
+
+# possible GIF replacements; none yet released!
+# (Greg Roelofs, newt@uchicago.edu)
+#
+# GRR 950115:  this was mine ("Zip GIF"):
+#					ZIF image (GIF+deflate alpha)
+0	string		GIF94z		image/unknown
+#
+# GRR 950115:  this is Jeremy Wohl's Free Graphics Format (better):
+#					FGF image (GIF+deflate beta)
+0	string		FGF95a		image/unknown
+#
+# GRR 950115:  this is Thomas Boutell's Portable Bitmap Format proposal
+# (best; not yet implemented):
+#					PBF image (deflate compression)
+0	string		PBF		image/unknown
+
+# GIF
+0	string		GIF		image/gif
+
+# JPEG images
+0	beshort		0xffd8		image/jpeg
+
+# PC bitmaps (OS/2, Windoze BMP files)  (Greg Roelofs, newt@uchicago.edu)
+0	string		BM		image/x-ms-bmp
+#>14	byte		12		(OS/2 1.x format)
+#>14	byte		64		(OS/2 2.x format)
+#>14	byte		40		(Windows 3.x format)
+#0	string		IC		icon
+#0	string		PI		pointer
+#0	string		CI		color icon
+#0	string		CP		color pointer
+#0	string		BA		bitmap array
+
+# CDROM Filesystems
+32769    string    CD001     application/x-iso9660
+
+# Newer StuffIt archives (grant@netbsd.org)
+0	string		StuffIt			application/x-stuffit
+#>162	string		>0			: %s
+
+# BinHex is the Macintosh ASCII-encoded file format (see also "apple")
+# Daniel Quinlan, quinlan@yggdrasil.com
+11	string	must\ be\ converted\ with\ BinHex\ 4	application/mac-binhex40
+##>41	string	x					\b, version %.3s
+
+
+#------------------------------------------------------------------------------
+# lisp:  file(1) magic for lisp programs
+#
+# various lisp types, from Daniel Quinlan (quinlan@yggdrasil.com)
+0	string	;;			text/plain	8bit
+# Emacs 18 - this is always correct, but not very magical.
+0	string	\012(			application/x-elc
+# Emacs 19
+0	string	;ELC\023\000\000\000	application/x-elc
+
+#------------------------------------------------------------------------------
+# mail.news:  file(1) magic for mail and news
+#
+# There are tests to ascmagic.c to cope with mail and news.
+0	string		Relay-Version: 	message/rfc822	7bit
+0	string		#!\ rnews	message/rfc822	7bit
+0	string		N#!\ rnews	message/rfc822	7bit
+0	string		Forward\ to 	message/rfc822	7bit
+0	string		Pipe\ to 	message/rfc822	7bit
+0	string		Return-Path:	message/rfc822	7bit
+0	string		Received:	message/rfc822
+0	string		Path:		message/news	8bit
+0	string		Xref:		message/news	8bit
+0	string		From:		message/rfc822	7bit
+0	string		Article 	message/news	8bit
+#------------------------------------------------------------------------------
+# msword: file(1) magic for MS Word files
+#
+# Contributor claims:
+# Reversed-engineered MS Word magic numbers
+#
+
+0	string		\376\067\0\043			application/msword
+0	string		\320\317\021\340\241\261	application/msword
+0	string		\333\245-\0\0\0			application/msword
+
+
+
+#------------------------------------------------------------------------------
+# printer:  file(1) magic for printer-formatted files
+#
+
+# PostScript
+0	string		%!		application/postscript
+0	string		\004%!		application/postscript
+
+# Acrobat
+# (due to clamen@cs.cmu.edu)
+0	string		%PDF-		application/pdf
+
+#------------------------------------------------------------------------------
+# sc:  file(1) magic for "sc" spreadsheet
+#
+38	string		Spreadsheet	application/x-sc
+
+#------------------------------------------------------------------------------
+# tex:  file(1) magic for TeX files
+#
+# XXX - needs byte-endian stuff (big-endian and little-endian DVI?)
+#
+# From <conklin@talisman.kaleida.com>
+
+# Although we may know the offset of certain text fields in TeX DVI
+# and font files, we can't use them reliably because they are not
+# zero terminated. [but we do anyway, christos]
+0	string		\367\002	application/x-dvi
+#0	string		\367\203	TeX generic font data
+#0	string		\367\131	TeX packed font data
+#0	string		\367\312	TeX virtual font data
+#0	string		This\ is\ TeX,	TeX transcript text	
+#0	string		This\ is\ METAFONT,	METAFONT transcript text
+
+# There is no way to detect TeX Font Metric (*.tfm) files without
+# breaking them apart and reading the data.  The following patterns
+# match most *.tfm files generated by METAFONT or afm2tfm.
+2	string		\000\021	application/x-tex-tfm
+2	string		\000\022	application/x-tex-tfm
+#>34	string		>\0		(%s)
+
+# Texinfo and GNU Info, from Daniel Quinlan (quinlan@yggdrasil.com)
+0	string		\\input\ texinfo		text/x-texinfo
+0	string		This\ is\ Info\ file	text/x-info
+
+# correct TeX magic for Linux (and maybe more)
+# from Peter Tobias (tobias@server.et-inf.fho-emden.de)
+#
+0	leshort		0x02f7		application/x-dvi
+
+# RTF - Rich Text Format
+0	string		{\\rtf		text/rtf
+
+#------------------------------------------------------------------------------
+# animation:  file(1) magic for animation/movie formats
+#
+# animation formats, originally from vax@ccwf.cc.utexas.edu (VaX#n8)
+#						MPEG file
+# MPEG sequences
+0       belong             0x000001BA
+>4      byte               &0x40          video/mp2p
+>4      byte               ^0x40          video/mpeg
+0       belong             0x000001BB     video/mpeg
+0       belong             0x000001B0     video/mp4v-es
+0       belong             0x000001B5     video/mp4v-es
+0       belong             0x000001B3     video/mpv
+0       belong&0xFF5FFF1F  0x47400010     video/mp2t
+0       belong             0x00000001
+>4      byte&0x1F          0x07           video/h264
+
+# FLI animation format
+0	leshort		0xAF11				video/fli
+# FLC animation format
+0	leshort		0xAF12				video/flc
+#
+# SGI and Apple formats
+# Added ISO mimes
+0	string		MOVI	      video/sgi
+4	string		moov	      video/quicktime
+4	string		mdat	      video/quicktime
+4	string		wide	      video/quicktime
+4	string		skip	      video/quicktime
+4	string		free	      video/quicktime
+4	string		idsc	      image/x-quicktime
+4	string		idat	      image/x-quicktime
+4	string		pckg	      application/x-quicktime
+4	string/B	jP	      image/jp2
+4	string		ftyp
+>8	string		isom	      video/mp4
+>8	string		mp41	      video/mp4
+>8	string		mp42	      video/mp4
+>8	string/B	jp2	      image/jp2
+>8	string		3gp	      video/3gpp
+>8      string          avc1          video/3gpp
+>8	string		mmp4	      video/mp4
+>8	string/B	M4A	      audio/mp4
+>8	string/B	qt	      video/quicktime
+# The contributor claims:
+#   I couldn't find a real magic number for these, however, this
+#   -appears- to work.  Note that it might catch other files, too,
+#   so BE CAREFUL!
+#
+# Note that title and author appear in the two 20-byte chunks
+# at decimal offsets 2 and 22, respectively, but they are XOR'ed with
+# 255 (hex FF)! DL format SUCKS BIG ROCKS.
+#
+#						DL file version 1 , medium format (160x100, 4 images/screen)
+0	byte		1			video/unknown
+0	byte		2			video/unknown
+#
+# Databases
+#
+# GDBM magic numbers
+#  Will be maintained as part of the GDBM distribution in the future.
+#  <downsj@teeny.org>
+0       belong  0x13579ace      application/x-gdbm
+0       lelong  0x13579ace      application/x-gdbm
+0       string  GDBM            application/x-gdbm
+#
+0       belong  0x061561        application/x-dbm
+#
+# Executables
+#
+0	string		\177ELF 
+>16	leshort		0		application/octet-stream
+>16	leshort		1		application/x-object
+>16	leshort		2		application/x-executable
+>16	leshort		3		application/x-sharedlib
+>16	leshort		4		application/x-coredump
+>16	beshort		0		application/octet-stream
+>16	beshort		1		application/x-object
+>16	beshort		2		application/x-executable
+>16	beshort		3		application/x-sharedlib
+>16	beshort		4		application/x-coredump
+#
+# DOS
+0		string			MZ				application/x-dosexec
+#
+# KDE
+0		string	[KDE\ Desktop\ Entry]	application/x-kdelnk
+0		string	\#\ KDE\ Config\ File	application/x-kdelnk
+# xmcd database file for kscd
+0		string	\#\ xmcd                text/xmcd
+
+#------------------------------------------------------------------------------
+# pkgadd:  file(1) magic for SysV R4 PKG Datastreams
+#
+0       string          #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package
+
+#PNG Image Format
+0	string		\x89PNG			image/png
+
+# MNG Video Format, <URL:http://www.libpng.org/pub/mng/spec/>
+0	string		\x8aMNG			video/x-mng
+0	string		\x8aJNG			video/x-jng
+
+#------------------------------------------------------------------------------
+# Hierarchical Data Format, used to facilitate scientific data exchange
+# specifications at http://hdf.ncsa.uiuc.edu/
+#Hierarchical Data Format (version 4) data
+0	belong		0x0e031301		application/x-hdf
+#Hierarchical Data Format (version 5) data
+0	string		\211HDF\r\n\032		application/x-hdf
+
+# Adobe Photoshop
+0	string		8BPS			image/x-photoshop
+
+# Felix von Leitner <felix-file@fefe.de>
+0	string		d8:announce		application/x-bittorrent
+
+
+# lotus 1-2-3 document
+0	belong	0x00001a00	application/x-123
+0	belong	0x00000200 	application/x-123
+
+# MS Access database
+4	string	Standard\ Jet\ DB	application/msaccess
+
+## magic for XBase files
+#0      byte       0x02	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x03	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x04	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x05	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x30
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x43
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x7b
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x83	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x8b
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0x8e	
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0xb3
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0      byte       0xf5
+#>8     leshort	  >0
+#>>12   leshort    0	application/x-dbf
+#
+#0	leshort		0x0006		application/x-dbt
+
+# Debian has entries for the old PGP formats:
+# pgp:  file(1) magic for Pretty Good Privacy
+# see http://lists.gnupg.org/pipermail/gnupg-devel/1999-September/016052.html
+#text/PGP key public ring
+0	beshort		0x9900			application/pgp
+#text/PGP key security ring
+0	beshort		0x9501			application/pgp
+#text/PGP key security ring
+0	beshort		0x9500			application/pgp
+#text/PGP encrypted data
+0	beshort		0xa600			application/pgp-encrypted
+#text/PGP armored data
+##public key block
+2	string	---BEGIN\ PGP\ PUBLIC\ KEY\ BLOCK-	application/pgp-keys
+0	string	-----BEGIN\040PGP\40MESSAGE-			application/pgp
+0	string	-----BEGIN\040PGP\40SIGNATURE-			application/pgp-signature
+#
+# GnuPG Magic:
+# 
+#
+#text/GnuPG key public ring
+0	beshort		0x9901			application/pgp
+#text/OpenPGP data
+0	beshort		0x8501			application/pgp-encrypted	
+
+# flash:        file(1) magic for Macromedia Flash file format
+#
+# See
+#
+#       http://www.macromedia.com/software/flash/open/
+#
+0	string		FWS             
+>3	byte		x			application/x-shockwave-flash
+
+# The following paramaters are created for Namazu.
+# <http://www.namazu.org/>
+#
+# 1999/08/13
+#0	string		\<!--\ MHonArc		text/html; x-type=mhonarc
+0	string		BZh			application/x-bzip2
+
+# 1999/09/09
+# VRML (suggested by Masao Takaku)
+0	string		#VRML\ V1.0\ ascii	model/vrml
+0	string		#VRML\ V2.0\ utf8	model/vrml
+
+#------------------------------------------------------------------------------
+# ichitaro456: file(1) magic for Just System Word Processor Ichitaro
+#
+# Contributor kenzo-:
+# Reversed-engineered JS Ichitaro magic numbers
+#
+
+0	string		DOC
+>43	byte		0x14		application/ichitaro4
+>144	string	JDASH		application/ichitaro4
+
+0	string		DOC
+>43	byte		0x15		application/ichitaro5
+
+0	string		DOC
+>43	byte		0x16		application/ichitaro6
+
+#------------------------------------------------------------------------------
+# office97: file(1) magic for MicroSoft Office files
+#
+# Contributor kenzo-:
+# Reversed-engineered MS Office magic numbers
+#
+
+#0       string          \320\317\021\340\241\261\032\341
+#>48     byte            0x1B            application/excel
+
+2080	string	Microsoft\ Excel\ 5.0\ Worksheet	application/excel
+2114	string	Biff5					application/excel
+
+0       string	\224\246\056		application/msword
+
+0	belong	0x31be0000		application/msword
+
+0	string	PO^Q`			application/msword
+
+0	string	\320\317\021\340\241\261\032\341
+>546	string	bjbj			application/msword
+>546	string	jbjb			application/msword
+
+512	string	R\0o\0o\0t\0\ \0E\0n\0t\0r\0y	application/msword
+
+2080	string	Microsoft\ Word\ 6.0\ Document	application/msword
+2080	string	Documento\ Microsoft\ Word\ 6	application/msword
+2112	string	MSWordDoc			application/msword
+
+#0	string	\320\317\021\340\241\261\032\341	application/powerpoint
+0	string	\320\317\021\340\241\261\032\341	application/msword
+
+0       string  #\ PaCkAgE\ DaTaStReAm  application/x-svr4-package
+
+
+# WinNT/WinCE PE files (Warner Losh, imp@village.org)
+#
+128		string	PE\000\000	application/octet-stream
+0		string	PE\000\000	application/octet-stream
+
+# miscellaneous formats
+0		string	LZ		application/octet-stream
+
+
+# .EXE formats (Greg Roelofs, newt@uchicago.edu)
+#
+0		string	MZ
+>24		string	@		application/octet-stream
+
+0		string	MZ
+>30		string	Copyright\ 1989-1990\ PKWARE\ Inc.	application/x-zip
+
+0		string	MZ
+>30		string	PKLITE\ Copr.	application/x-zip
+
+0		string	MZ
+>36		string	LHa's\ SFX	application/x-lha
+
+0		string	MZ		application/octet-stream
+
+# LHA archiver
+2		string	-lh
+>6		string	-		application/x-lha
+
+
+# Zoo archiver
+20		lelong	0xfdc4a7dc	application/x-zoo
+
+# ARC archiver
+0       	lelong&0x8080ffff	0x0000081a	application/x-arc
+0		lelong&0x8080ffff	0x0000091a	application/x-arc
+0		lelong&0x8080ffff	0x0000021a	application/x-arc
+0		lelong&0x8080ffff	0x0000031a	application/x-arc
+0		lelong&0x8080ffff	0x0000041a	application/x-arc
+0		lelong&0x8080ffff	0x0000061a	application/x-arc
+
+# Microsoft Outlook's Transport Neutral Encapsulation Format (TNEF)
+0		lelong	0x223e9f78	application/ms-tnef
+
+# From: stephane.loeuillet@tiscali.f
+# http://www.djvuzone.org/
+0	string		AT&TFORM	image/x.djvu
+
+# Danny Milosavljevic <danny.milo@gmx.net>
+# this are adrift (adventure game standard) game files, extension .taf
+# depending on version magic continues with 0x93453E6139FA (V 4.0)
+# 0x9445376139FA (V 3.90)
+# 0x9445366139FA (V 3.80)
+# this is from source (http://www.adrift.org.uk/) and I have some taf
+# files, and checked them.
+#0	belong	0x3C423FC9
+#>4	belong	0x6A87C2CF	application/x-adrift
+#0	string	\000\000\001\000	image/x-ico
+
+# Quark Xpress 3 Files:
+# (made the mimetype up) 
+0	string	\0\0MMXPR3\0	application/x-quark-xpress-3
+
+# EET archive
+# From: Tilman Sauerbeck <tilman@code-monkey.de>
+0	belong	0x1ee7ff00	application/x-eet
+
+# From: Denis Knauf, via gentoo.
+0	string	fLaC		audio/x-flac
+0	string	CWS		application/x-shockwave-flash
+
+# Gnumeric spreadsheet
+# This entry is only semi-helpful, as Gnumeric compresses its files, so
+# they will ordinarily reported as "compressed", but at least -z helps
+39      string          =<gmr:Workbook           application/x-gnumeric
+
--- pe-httpd-2.2.29.orig/debian/config-dir/envvars
+++ pe-httpd-2.2.29/debian/config-dir/envvars
@@ -0,0 +1,33 @@
+# envvars - default environment variables for apache2ctl
+
+# this won't be correct after changing uid
+unset HOME
+
+# for supporting multiple apache2 instances
+if [ "${APACHE_CONFDIR##/etc/puppetlabs/httpd-}" != "${APACHE_CONFDIR}" ] ; then
+	SUFFIX="-${APACHE_CONFDIR##/etc/puppetlabs/httpd-}"
+else
+	SUFFIX=
+fi
+
+# Since there is no sane way to get the parsed apache2 config in scripts, some
+# settings are defined via environment variables and then used in apache2ctl,
+# /etc/init.d/pe-httpd, /etc/logrotate.d/pe-httpd, etc.
+export APACHE_RUN_USER=pe-apache
+export APACHE_RUN_GROUP=pe-apache
+export APACHE_PID_FILE=/var/run/pe-httpd$SUFFIX.pid
+export APACHE_RUN_DIR=/var/run/pe-httpd$SUFFIX
+export APACHE_LOCK_DIR=/var/lock/pe-httpd$SUFFIX
+# Only /var/log/pe-httpd is handled by /etc/logrotate.d/pe-httpd.
+export APACHE_LOG_DIR=/var/log/pe-httpd$SUFFIX
+
+## The locale used by some modules like mod_dav
+export LANG=C
+## Uncomment the following line to use the system default locale instead:
+#. /etc/default/locale
+
+export LANG
+
+## The command to get the status for 'pe-httpdctl status'.
+## Some packages providing 'www-browser' need '--dump' instead of '-dump'.
+#export APACHE_LYNX='www-browser -dump'
--- pe-httpd-2.2.29.orig/debian/config-dir/conf.d/localized-error-pages
+++ pe-httpd-2.2.29/debian/config-dir/conf.d/localized-error-pages
@@ -0,0 +1,79 @@
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# Putting this all together, we can internationalize error responses.
+#
+# We use Alias to redirect any /error/HTTP_<error>.html.var response to
+# our collection of by-error message multi-language collections.  We use 
+# includes to substitute the appropriate text.
+#
+# You can modify the messages' appearance without changing any of the
+# default HTTP_<error>.html.var files by adding the line:
+#
+#   Alias /error/include/ "/your/include/path/"
+#
+# which allows you to create your own set of files by starting with the
+# /opt/puppet/share/httpd/error/include/ files and copying them to /your/include/path/, 
+# even on a per-VirtualHost basis.  If you include the Alias in the global server
+# context, is has to come _before_ the 'Alias /error/ ...' line.
+#
+# The default include files will display your Apache version number and your
+# ServerAdmin email address regardless of the setting of ServerSignature.
+#
+# WARNING: The configuration below will NOT work out of the box if you have a
+#          SetHandler directive in a <Location /> context somewhere. Adding
+#          the following three lines AFTER the <Location /> context should
+#          make it work in most cases:
+#          <Location /error/>
+#             SetHandler none
+#          </Location>
+#
+# The internationalized error documents require mod_alias, mod_include
+# and mod_negotiation.  To activate them, uncomment the following 37 lines.
+
+#<IfModule mod_negotiation.c>
+# <IfModule mod_include.c>
+#  <IfModule mod_alias.c>
+#
+#    Alias /error/ "/opt/puppet/share/httpd/error/"
+#
+#    <Directory "/opt/puppet/share/httpd/error">
+#        AllowOverride None
+#        Options IncludesNoExec
+#        AddOutputFilter Includes html
+#        AddHandler type-map var
+#        Order allow,deny
+#        Allow from all
+#        LanguagePriority en cs de es fr it nl sv pt-br ro
+#        ForceLanguagePriority Prefer Fallback
+#    </Directory>
+#
+#    ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
+#    ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
+#    ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
+#    ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
+#    ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
+#    ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
+#    ErrorDocument 410 /error/HTTP_GONE.html.var
+#    ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
+#    ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
+#    ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
+#    ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
+#    ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
+#    ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
+#    ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
+#    ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
+#    ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
+#    ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
+#  </IfModule>
+# </IfModule>
+#</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/conf.d/charset
+++ pe-httpd-2.2.29/debian/config-dir/conf.d/charset
@@ -0,0 +1,6 @@
+# Read the documentation before enabling AddDefaultCharset.
+# In general, it is only a good idea if you know that all your files
+# have this encoding. It will override any encoding given in the files
+# in meta http-equiv or xml encoding tags.
+
+#AddDefaultCharset UTF-8
--- pe-httpd-2.2.29.orig/debian/config-dir/conf.d/other-vhosts-access-log
+++ pe-httpd-2.2.29/debian/config-dir/conf.d/other-vhosts-access-log
@@ -0,0 +1,2 @@
+# Define an access log for VirtualHosts that don't define their own logfile
+CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log vhost_combined
--- pe-httpd-2.2.29.orig/debian/config-dir/conf.d/security
+++ pe-httpd-2.2.29/debian/config-dir/conf.d/security
@@ -0,0 +1,52 @@
+#
+# Disable access to the entire file system except for the directories that
+# are explicitly allowed later.
+#
+# This currently breaks the configurations that come with some web application
+# Debian packages. It will be made the default for the release after lenny.
+#
+#<Directory />
+#	AllowOverride None
+#	Order Deny,Allow
+#	Deny from all
+#</Directory>
+
+
+# Changing the following options will not really affect the security of the
+# server, but might make attacks slightly more difficult in some cases.
+
+#
+# ServerTokens
+# This directive configures what you return as the Server HTTP response
+# Header. The default is 'Full' which sends information about the OS-Type
+# and compiled in modules.
+# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
+# where Full conveys the most information, and Prod the least.
+#
+ServerTokens Prod
+#ServerTokens Minimal
+#ServerTokens OS
+#ServerTokens Full
+
+#
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (internal error documents, FTP directory
+# listings, mod_status and mod_info output etc., but not CGI generated
+# documents or custom error documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+#
+#ServerSignature Off
+ServerSignature On
+
+#
+# Allow TRACE method
+#
+# Set to "extended" to also reflect the request body (only for testing and
+# diagnostic purposes).
+#
+# Set to one of:  On | Off | extended
+#
+TraceEnable Off
+#TraceEnable On
+
--- pe-httpd-2.2.29.orig/debian/config-dir/sites-available/default
+++ pe-httpd-2.2.29/debian/config-dir/sites-available/default
@@ -0,0 +1,41 @@
+<VirtualHost *:80>
+	ServerAdmin webmaster@localhost
+
+	DocumentRoot /opt/puppet/var/www
+	<Directory />
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+	<Directory /opt/puppet/var/www/>
+		Options Indexes FollowSymLinks MultiViews
+		AllowOverride None
+		Order allow,deny
+		allow from all
+	</Directory>
+
+	ScriptAlias /cgi-bin/ /opt/puppet/lib/cgi-bin/
+	<Directory "/opt/puppet/lib/cgi-bin">
+		AllowOverride None
+		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+		Order allow,deny
+		Allow from all
+	</Directory>
+
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+
+	# Possible values include: debug, info, notice, warn, error, crit,
+	# alert, emerg.
+	LogLevel warn
+
+	CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+    Alias /doc/ "/usr/share/doc/"
+    <Directory "/usr/share/doc/">
+        Options Indexes MultiViews FollowSymLinks
+        AllowOverride None
+        Order deny,allow
+        Deny from all
+        Allow from 127.0.0.0/255.0.0.0 ::1/128
+    </Directory>
+
+</VirtualHost>
--- pe-httpd-2.2.29.orig/debian/config-dir/sites-available/default-ssl
+++ pe-httpd-2.2.29/debian/config-dir/sites-available/default-ssl
@@ -0,0 +1,172 @@
+<IfModule mod_ssl.c>
+<VirtualHost _default_:443>
+	ServerAdmin webmaster@localhost
+
+	DocumentRoot /opt/puppet/var/www
+	<Directory />
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+	<Directory /opt/puppet/var/www/>
+		Options Indexes FollowSymLinks MultiViews
+		AllowOverride None
+		Order allow,deny
+		allow from all
+	</Directory>
+
+	ScriptAlias /cgi-bin/ /opt/puppet/lib/cgi-bin/
+	<Directory "/opt/puppet/lib/cgi-bin">
+		AllowOverride None
+		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+		Order allow,deny
+		Allow from all
+	</Directory>
+
+	ErrorLog ${APACHE_LOG_DIR}/error.log
+
+	# Possible values include: debug, info, notice, warn, error, crit,
+	# alert, emerg.
+	LogLevel warn
+
+	CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
+
+	Alias /doc/ "/usr/share/doc/"
+	<Directory "/usr/share/doc/">
+		Options Indexes MultiViews FollowSymLinks
+		AllowOverride None
+		Order deny,allow
+		Deny from all
+		Allow from 127.0.0.0/255.0.0.0 ::1/128
+	</Directory>
+
+	#   SSL Engine Switch:
+	#   Enable/Disable SSL for this virtual host.
+	SSLEngine on
+
+	#   A self-signed (snakeoil) certificate can be created by installing
+	#   the ssl-cert package. See
+	#   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
+	#   If both key and certificate are stored in the same file, only the
+	#   SSLCertificateFile directive is needed.
+	SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
+	SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
+
+	#   Server Certificate Chain:
+	#   Point SSLCertificateChainFile at a file containing the
+	#   concatenation of PEM encoded CA certificates which form the
+	#   certificate chain for the server certificate. Alternatively
+	#   the referenced file can be the same as SSLCertificateFile
+	#   when the CA certificates are directly appended to the server
+	#   certificate for convinience.
+	#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
+
+	#   Certificate Authority (CA):
+	#   Set the CA certificate verification path where to find CA
+	#   certificates for client authentication or alternatively one
+	#   huge file containing all of them (file must be PEM encoded)
+	#   Note: Inside SSLCACertificatePath you need hash symlinks
+	#         to point to the certificate files. Use the provided
+	#         Makefile to update the hash symlinks after changes.
+	#SSLCACertificatePath /etc/ssl/certs/
+	#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
+
+	#   Certificate Revocation Lists (CRL):
+	#   Set the CA revocation path where to find CA CRLs for client
+	#   authentication or alternatively one huge file containing all
+	#   of them (file must be PEM encoded)
+	#   Note: Inside SSLCARevocationPath you need hash symlinks
+	#         to point to the certificate files. Use the provided
+	#         Makefile to update the hash symlinks after changes.
+	#SSLCARevocationPath /etc/apache2/ssl.crl/
+	#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
+
+	#   Client Authentication (Type):
+	#   Client certificate verification type and depth.  Types are
+	#   none, optional, require and optional_no_ca.  Depth is a
+	#   number which specifies how deeply to verify the certificate
+	#   issuer chain before deciding the certificate is not valid.
+	#SSLVerifyClient require
+	#SSLVerifyDepth  10
+
+	#   Access Control:
+	#   With SSLRequire you can do per-directory access control based
+	#   on arbitrary complex boolean expressions containing server
+	#   variable checks and other lookup directives.  The syntax is a
+	#   mixture between C and Perl.  See the mod_ssl documentation
+	#   for more details.
+	#<Location />
+	#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+	#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+	#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+	#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+	#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+	#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+	#</Location>
+
+	#   SSL Engine Options:
+	#   Set various options for the SSL engine.
+	#   o FakeBasicAuth:
+	#     Translate the client X.509 into a Basic Authorisation.  This means that
+	#     the standard Auth/DBMAuth methods can be used for access control.  The
+	#     user name is the `one line' version of the client's X.509 certificate.
+	#     Note that no password is obtained from the user. Every entry in the user
+	#     file needs this password: `xxj31ZMTZzkVA'.
+	#   o ExportCertData:
+	#     This exports two additional environment variables: SSL_CLIENT_CERT and
+	#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+	#     server (always existing) and the client (only existing when client
+	#     authentication is used). This can be used to import the certificates
+	#     into CGI scripts.
+	#   o StdEnvVars:
+	#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+	#     Per default this exportation is switched off for performance reasons,
+	#     because the extraction step is an expensive operation and is usually
+	#     useless for serving static content. So one usually enables the
+	#     exportation for CGI and SSI requests only.
+	#   o StrictRequire:
+	#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+	#     under a "Satisfy any" situation, i.e. when it applies access is denied
+	#     and no other module can change it.
+	#   o OptRenegotiate:
+	#     This enables optimized SSL connection renegotiation handling when SSL
+	#     directives are used in per-directory context.
+	#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+	<FilesMatch "\.(cgi|shtml|phtml|php)$">
+		SSLOptions +StdEnvVars
+	</FilesMatch>
+	<Directory /usr/lib/cgi-bin>
+		SSLOptions +StdEnvVars
+	</Directory>
+
+	#   SSL Protocol Adjustments:
+	#   The safe and default but still SSL/TLS standard compliant shutdown
+	#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+	#   the close notify alert from client. When you need a different shutdown
+	#   approach you can use one of the following variables:
+	#   o ssl-unclean-shutdown:
+	#     This forces an unclean shutdown when the connection is closed, i.e. no
+	#     SSL close notify alert is send or allowed to received.  This violates
+	#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+	#     this when you receive I/O errors because of the standard approach where
+	#     mod_ssl sends the close notify alert.
+	#   o ssl-accurate-shutdown:
+	#     This forces an accurate shutdown when the connection is closed, i.e. a
+	#     SSL close notify alert is send and mod_ssl waits for the close notify
+	#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+	#     practice often causes hanging connections with brain-dead browsers. Use
+	#     this only for browsers where you know that their SSL implementation
+	#     works correctly.
+	#   Notice: Most problems of broken clients are also related to the HTTP
+	#   keep-alive facility, so you usually additionally want to disable
+	#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+	#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+	#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+	#   "force-response-1.0" for this.
+	BrowserMatch "MSIE [2-6]" \
+		nokeepalive ssl-unclean-shutdown \
+		downgrade-1.0 force-response-1.0
+	# MSIE 7 and newer should be able to use keepalive
+	BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
+
+</VirtualHost>
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_http.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_http.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_http_module /opt/puppet/lib/httpd/modules/mod_proxy_http.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_alias.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_alias.load
@@ -0,0 +1 @@
+LoadModule authn_alias_module /opt/puppet/lib/httpd/modules/mod_authn_alias.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/usertrack.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/usertrack.load
@@ -0,0 +1 @@
+LoadModule usertrack_module /opt/puppet/lib/httpd/modules/mod_usertrack.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/substitute.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/substitute.load
@@ -0,0 +1 @@
+LoadModule substitute_module /opt/puppet/lib/httpd/modules/mod_substitute.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_ftp.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_ftp.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_ftp_module /opt/puppet/lib/httpd/modules/mod_proxy_ftp.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/include.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/include.load
@@ -0,0 +1 @@
+LoadModule include_module /opt/puppet/lib/httpd/modules/mod_include.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ldap.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ldap.conf
@@ -0,0 +1,8 @@
+<Location /ldap-status>
+    SetHandler ldap-status
+    Order deny,allow
+    Deny from all
+    Allow from 127.0.0.1 ::1
+#    Allow from 192.0.2.0/24
+    Satisfy all
+</Location>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_dbm.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_dbm.load
@@ -0,0 +1 @@
+LoadModule authn_dbm_module /opt/puppet/lib/httpd/modules/mod_authn_dbm.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_host.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_host.load
@@ -0,0 +1 @@
+LoadModule authz_host_module /opt/puppet/lib/httpd/modules/mod_authz_host.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/userdir.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/userdir.load
@@ -0,0 +1 @@
+LoadModule userdir_module /opt/puppet/lib/httpd/modules/mod_userdir.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/auth_digest.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/auth_digest.load
@@ -0,0 +1 @@
+LoadModule auth_digest_module /opt/puppet/lib/httpd/modules/mod_auth_digest.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/deflate.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/deflate.load
@@ -0,0 +1 @@
+LoadModule deflate_module /opt/puppet/lib/httpd/modules/mod_deflate.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dump_io.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dump_io.load
@@ -0,0 +1 @@
+LoadModule dumpio_module /opt/puppet/lib/httpd/modules/mod_dumpio.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/negotiation.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/negotiation.conf
@@ -0,0 +1,18 @@
+<IfModule mod_negotiation.c>
+#
+# LanguagePriority allows you to give precedence to some languages
+# in case of a tie during content negotiation.
+#
+# Just list the languages in decreasing order of preference. We have
+# more or less alphabetized them here. You probably want to change this.
+#
+LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv tr zh-CN zh-TW
+
+#
+# ForceLanguagePriority allows you to serve a result page rather than
+# MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback)
+# [in case no accepted languages matched the available variants]
+#
+ForceLanguagePriority Prefer Fallback
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_user.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_user.load
@@ -0,0 +1 @@
+LoadModule authz_user_module /opt/puppet/lib/httpd/modules/mod_authz_user.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mem_cache.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mem_cache.conf
@@ -0,0 +1,7 @@
+<IfModule mod_mem_cache.c>
+        CacheEnable mem /
+        MCacheSize 4096
+        MCacheMaxObjectCount 100
+        MCacheMinObjectSize 1
+        MCacheMaxObjectSize 2048
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_connect.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_connect.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_connect_module /opt/puppet/lib/httpd/modules/mod_proxy_connect.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authnz_ldap.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authnz_ldap.load
@@ -0,0 +1,2 @@
+# Depends: ldap
+LoadModule authnz_ldap_module /opt/puppet/lib/httpd/modules/mod_authnz_ldap.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_file.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_file.load
@@ -0,0 +1 @@
+LoadModule authn_file_module /opt/puppet/lib/httpd/modules/mod_authn_file.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dav_fs.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dav_fs.conf
@@ -0,0 +1 @@
+DAVLockDB ${APACHE_LOCK_DIR}/DAVLock
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mime.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mime.conf
@@ -0,0 +1,246 @@
+<IfModule mod_mime.c>
+
+#
+# TypesConfig points to the file containing the list of mappings from
+# filename extension to MIME-type.
+#
+TypesConfig /etc/mime.types
+
+#
+# AddType allows you to add to or override the MIME configuration
+# file mime.types for specific file types.
+#
+#AddType application/x-gzip .tgz
+#
+# AddEncoding allows you to have certain browsers uncompress
+# information on the fly. Note: Not all browsers support this.
+# Despite the name similarity, the following Add* directives have
+# nothing to do with the FancyIndexing customization directives above.
+#
+#AddEncoding x-compress .Z
+#AddEncoding x-gzip .gz .tgz
+#AddEncoding x-bzip2 .bz2
+#
+# If the AddEncoding directives above are commented-out, then you
+# probably should define those extensions to indicate media types:
+#
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+AddType application/x-bzip2 .bz2
+
+#
+# DefaultLanguage and AddLanguage allows you to specify the language of 
+# a document. You can then use content negotiation to give a browser a 
+# file in a language the user can understand.
+#
+# Specify a default language. This means that all data
+# going out without a specific language tag (see below) will 
+# be marked with this one. You probably do NOT want to set
+# this unless you are sure it is correct for all cases.
+#
+# * It is generally better to not mark a page as 
+# * being a certain language than marking it with the wrong
+# * language!
+#
+# DefaultLanguage nl
+#
+# Note 1: The suffix does not have to be the same as the language
+# keyword --- those with documents in Polish (whose net-standard
+# language code is pl) may wish to use "AddLanguage pl .po" to
+# avoid the ambiguity with the common suffix for perl scripts.
+#
+# Note 2: The example entries below illustrate that in some cases 
+# the two character 'Language' abbreviation is not identical to 
+# the two character 'Country' code for its country,
+# E.g. 'Danmark/dk' versus 'Danish/da'.
+#
+# Note 3: In the case of 'ltz' we violate the RFC by using a three char
+# specifier. There is 'work in progress' to fix this and get
+# the reference data for rfc1766 cleaned up.
+#
+# Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl)
+# English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de)
+# Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja)
+# Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn)
+# Norwegian (no) - Polish (pl) - Portugese (pt)
+# Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv)
+# Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW)
+#
+AddLanguage am .amh
+AddLanguage ar .ara
+AddLanguage be .be
+AddLanguage bg .bg
+AddLanguage bn .bn
+AddLanguage br .br
+AddLanguage bs .bs
+AddLanguage ca .ca
+AddLanguage cs .cz .cs
+AddLanguage cy .cy
+AddLanguage da .dk
+AddLanguage de .de
+AddLanguage dz .dz
+AddLanguage el .el
+AddLanguage en .en
+AddLanguage eo .eo
+# es is ecmascript in /etc/mime.types
+RemoveType  es
+AddLanguage es .es
+AddLanguage et .et
+AddLanguage eu .eu
+AddLanguage fa .fa
+AddLanguage fi .fi
+AddLanguage fr .fr
+AddLanguage ga .ga
+AddLanguage gl .glg
+AddLanguage gu .gu
+AddLanguage he .he
+AddLanguage hi .hi
+AddLanguage hr .hr
+AddLanguage hu .hu
+AddLanguage hy .hy
+AddLanguage id .id
+AddLanguage is .is
+AddLanguage it .it
+AddLanguage ja .ja
+AddLanguage ka .ka
+AddLanguage kk .kk
+AddLanguage km .km
+AddLanguage kn .kn
+AddLanguage ko .ko
+AddLanguage ku .ku
+AddLanguage lo .lo
+AddLanguage lt .lt
+AddLanguage ltz .ltz
+AddLanguage lv .lv
+AddLanguage mg .mg
+AddLanguage mk .mk
+AddLanguage ml .ml
+AddLanguage mr .mr
+AddLanguage ms .msa
+AddLanguage nb .nob
+AddLanguage ne .ne
+AddLanguage nl .nl
+AddLanguage nn .nn
+AddLanguage no .no
+AddLanguage pa .pa
+AddLanguage pl .po
+AddLanguage pt-BR .pt-br
+AddLanguage pt .pt
+AddLanguage ro .ro
+AddLanguage ru .ru
+AddLanguage sa .sa
+AddLanguage se .se
+AddLanguage si .si
+AddLanguage sk .sk
+AddLanguage sl .sl
+AddLanguage sq .sq
+AddLanguage sr .sr
+AddLanguage sv .sv
+AddLanguage ta .ta
+AddLanguage te .te
+AddLanguage th .th
+AddLanguage tl .tl
+RemoveType  tr
+# tr is troff in /etc/mime.types
+AddLanguage tr .tr
+AddLanguage uk .uk
+AddLanguage ur .ur
+AddLanguage vi .vi
+AddLanguage wo .wo
+AddLanguage xh .xh
+AddLanguage zh-CN .zh-cn
+AddLanguage zh-TW .zh-tw
+
+#
+# Commonly used filename extensions to character sets. You probably
+# want to avoid clashes with the language extensions, unless you
+# are good at carefully testing your setup after each change.
+# See http://www.iana.org/assignments/character-sets for the
+# official list of charset names and their respective RFCs.
+#
+AddCharset us-ascii    .ascii .us-ascii
+AddCharset ISO-8859-1  .iso8859-1  .latin1
+AddCharset ISO-8859-2  .iso8859-2  .latin2 .cen
+AddCharset ISO-8859-3  .iso8859-3  .latin3
+AddCharset ISO-8859-4  .iso8859-4  .latin4
+AddCharset ISO-8859-5  .iso8859-5  .cyr .iso-ru
+AddCharset ISO-8859-6  .iso8859-6  .arb .arabic
+AddCharset ISO-8859-7  .iso8859-7  .grk .greek
+AddCharset ISO-8859-8  .iso8859-8  .heb .hebrew
+AddCharset ISO-8859-9  .iso8859-9  .latin5 .trk
+AddCharset ISO-8859-10  .iso8859-10  .latin6
+AddCharset ISO-8859-13  .iso8859-13
+AddCharset ISO-8859-14  .iso8859-14  .latin8
+AddCharset ISO-8859-15  .iso8859-15  .latin9
+AddCharset ISO-8859-16  .iso8859-16  .latin10
+AddCharset ISO-2022-JP .iso2022-jp .jis
+AddCharset ISO-2022-KR .iso2022-kr .kis
+AddCharset ISO-2022-CN .iso2022-cn .cis
+AddCharset Big5        .Big5       .big5 .b5
+AddCharset cn-Big5     .cn-big5
+# For russian, more than one charset is used (depends on client, mostly):
+AddCharset WINDOWS-1251 .cp-1251   .win-1251
+AddCharset CP866       .cp866
+AddCharset KOI8      .koi8
+AddCharset KOI8-E      .koi8-e
+AddCharset KOI8-r      .koi8-r .koi8-ru
+AddCharset KOI8-U      .koi8-u
+AddCharset KOI8-ru     .koi8-uk .ua
+AddCharset ISO-10646-UCS-2 .ucs2
+AddCharset ISO-10646-UCS-4 .ucs4
+AddCharset UTF-7       .utf7
+AddCharset UTF-8       .utf8
+AddCharset UTF-16      .utf16
+AddCharset UTF-16BE    .utf16be
+AddCharset UTF-16LE    .utf16le
+AddCharset UTF-32      .utf32
+AddCharset UTF-32BE    .utf32be
+AddCharset UTF-32LE    .utf32le
+AddCharset euc-cn      .euc-cn
+AddCharset euc-gb      .euc-gb
+AddCharset euc-jp      .euc-jp
+AddCharset euc-kr      .euc-kr
+#Not sure how euc-tw got in - IANA doesn't list it???
+AddCharset EUC-TW      .euc-tw
+AddCharset gb2312      .gb2312 .gb
+AddCharset iso-10646-ucs-2 .ucs-2 .iso-10646-ucs-2
+AddCharset iso-10646-ucs-4 .ucs-4 .iso-10646-ucs-4
+AddCharset shift_jis   .shift_jis .sjis
+
+#
+# AddHandler allows you to map certain file extensions to "handlers":
+# actions unrelated to filetype. These can be either built into the server
+# or added with the Action directive (see below)
+#
+# To use CGI scripts outside of ScriptAliased directories:
+# (You will also need to add "ExecCGI" to the "Options" directive.)
+#
+#AddHandler cgi-script .cgi
+
+#
+# For files that include their own HTTP headers:
+#
+#AddHandler send-as-is asis
+
+#
+# For server-parsed imagemap files:
+#
+#AddHandler imap-file map
+
+#
+# For type maps (negotiated resources):
+# (This is enabled by default to allow the Apache "It Worked" page
+#  to be distributed in multiple languages.)
+#
+AddHandler type-map var
+
+#
+# Filters allow you to process content before it is sent to the client.
+#
+# To parse .shtml files for server-side includes (SSI):
+# (You will also need to add "Includes" to the "Options" directive.)
+#
+AddType text/html .shtml
+AddOutputFilter INCLUDES .shtml
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mime_magic.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mime_magic.conf
@@ -0,0 +1,3 @@
+<IfModule mod_mime_magic.c>
+        MIMEMagicFile /etc/puppetlabs/httpd/magic
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/env.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/env.load
@@ -0,0 +1 @@
+LoadModule env_module /opt/puppet/lib/httpd/modules/mod_env.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/info.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/info.load
@@ -0,0 +1 @@
+LoadModule info_module /opt/puppet/lib/httpd/modules/mod_info.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/asis.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/asis.load
@@ -0,0 +1 @@
+LoadModule asis_module /opt/puppet/lib/httpd/modules/mod_asis.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_dbd.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_dbd.load
@@ -0,0 +1,2 @@
+# Depends: dbd
+LoadModule authn_dbd_module /opt/puppet/lib/httpd/modules/mod_authn_dbd.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mem_cache.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mem_cache.load
@@ -0,0 +1,2 @@
+# Depends: cache
+LoadModule mem_cache_module /opt/puppet/lib/httpd/modules/mod_mem_cache.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ldap.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ldap.load
@@ -0,0 +1 @@
+LoadModule ldap_module /opt/puppet/lib/httpd/modules/mod_ldap.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ssl.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ssl.conf
@@ -0,0 +1,73 @@
+<IfModule mod_ssl.c>
+#
+# Pseudo Random Number Generator (PRNG):
+# Configure one or more sources to seed the PRNG of the SSL library.
+# The seed data should be of good random quality.
+# WARNING! On some platforms /dev/random blocks if not enough entropy
+# is available. This means you then cannot use the /dev/random device
+# because it would lead to very long connection times (as long as
+# it requires to make more entropy available). But usually those
+# platforms additionally provide a /dev/urandom device which doesn't
+# block. So, if available, use this one instead. Read the mod_ssl User
+# Manual for more details.
+#
+SSLRandomSeed startup builtin
+SSLRandomSeed startup file:/dev/urandom 512
+SSLRandomSeed connect builtin
+SSLRandomSeed connect file:/dev/urandom 512
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#
+#   Some MIME-types for downloading Certificates and CRLs
+#
+AddType application/x-x509-ca-cert .crt
+AddType application/x-pkcs7-crl    .crl
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#   (The mechanism dbm has known memory leaks and should not be used).
+#SSLSessionCache         dbm:${APACHE_RUN_DIR}/ssl_scache
+SSLSessionCache        shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
+SSLSessionCacheTimeout  300
+
+#   Semaphore:
+#   Configure the path to the mutual exclusion semaphore the
+#   SSL engine uses internally for inter-process synchronization. 
+SSLMutex  file:${APACHE_RUN_DIR}/ssl_mutex
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+#   enable only secure ciphers:
+SSLCipherSuite HIGH:MEDIUM:!ADH
+#   Use this instead if you want to allow cipher upgrades via SGC facility.
+#   In this case you also have to use something like 
+#        SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
+#   see http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html.en#upgradeenc
+#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
+
+# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
+SSLProtocol all -SSLv2
+
+# Allow insecure renegotiation with clients which do not yet support the
+# secure renegotiation protocol. Default: Off
+#SSLInsecureRenegotiation on
+
+# Whether to forbid non-SNI clients to access name based virtual hosts.
+# Default: Off
+#SSLStrictSNIVHostCheck On
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/log_forensic.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/log_forensic.load
@@ -0,0 +1 @@
+LoadModule log_forensic_module /opt/puppet/lib/httpd/modules/mod_log_forensic.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/autoindex.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/autoindex.conf
@@ -0,0 +1,101 @@
+<IfModule mod_autoindex.c>
+#
+# Directives controlling the display of server-generated directory listings.
+#
+
+#
+# IndexOptions: Controls the appearance of server-generated directory
+# listings.
+# Remove/replace the "Charset=UTF-8" if you don't use UTF-8 for your filenames.
+#
+IndexOptions FancyIndexing VersionSort HTMLTable NameWidth=* DescriptionWidth=* Charset=UTF-8
+
+#
+# AddIcon* directives tell the server which icon to show for different
+# files or filename extensions.  These are only displayed for
+# FancyIndexed directories.
+#
+AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip x-bzip2
+
+AddIconByType (TXT,/icons/text.gif) text/*
+AddIconByType (IMG,/icons/image2.gif) image/*
+AddIconByType (SND,/icons/sound2.gif) audio/*
+AddIconByType (VID,/icons/movie.gif) video/*
+
+AddIcon /icons/binary.gif .bin .exe
+AddIcon /icons/binhex.gif .hqx
+AddIcon /icons/tar.gif .tar
+AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
+AddIcon /icons/a.gif .ps .ai .eps
+AddIcon /icons/layout.gif .html .shtml .htm .pdf
+AddIcon /icons/text.gif .txt
+AddIcon /icons/c.gif .c
+AddIcon /icons/p.gif .pl .py
+AddIcon /icons/f.gif .for
+AddIcon /icons/dvi.gif .dvi
+AddIcon /icons/uuencoded.gif .uu
+AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+AddIcon /icons/tex.gif .tex
+# It's a suffix rule, so simply matching "core" matches "score" as well !
+AddIcon /icons/bomb.gif /core
+AddIcon (SND,/icons/sound2.gif) .ogg
+AddIcon (VID,/icons/movie.gif) .ogm
+
+AddIcon /icons/back.gif ..
+AddIcon /icons/hand.right.gif README
+AddIcon /icons/folder.gif ^^DIRECTORY^^
+AddIcon /icons/blank.gif ^^BLANKICON^^
+
+# Default icons for OpenDocument format
+AddIcon /icons/odf6odt-20x22.png .odt
+AddIcon /icons/odf6ods-20x22.png .ods
+AddIcon /icons/odf6odp-20x22.png .odp
+AddIcon /icons/odf6odg-20x22.png .odg
+AddIcon /icons/odf6odc-20x22.png .odc
+AddIcon /icons/odf6odf-20x22.png .odf
+AddIcon /icons/odf6odb-20x22.png .odb
+AddIcon /icons/odf6odi-20x22.png .odi
+AddIcon /icons/odf6odm-20x22.png .odm
+
+AddIcon /icons/odf6ott-20x22.png .ott
+AddIcon /icons/odf6ots-20x22.png .ots
+AddIcon /icons/odf6otp-20x22.png .otp
+AddIcon /icons/odf6otg-20x22.png .otg
+AddIcon /icons/odf6otc-20x22.png .otc
+AddIcon /icons/odf6otf-20x22.png .otf
+AddIcon /icons/odf6oti-20x22.png .oti
+AddIcon /icons/odf6oth-20x22.png .oth
+
+#
+# DefaultIcon is which icon to show for files which do not have an icon
+# explicitly set.
+#
+DefaultIcon /icons/unknown.gif
+
+#
+# AddDescription allows you to place a short description after a file in
+# server-generated indexes.  These are only displayed for FancyIndexed
+# directories.
+# Format: AddDescription "description" filename
+#
+#AddDescription "GZIP compressed document" .gz
+#AddDescription "tar archive" .tar
+#AddDescription "GZIP compressed tar archive" .tgz
+
+#
+# ReadmeName is the name of the README file the server will look for by
+# default, and append to directory listings.
+#
+# HeaderName is the name of a file which should be prepended to
+# directory indexes. 
+ReadmeName README.html
+HeaderName HEADER.html
+
+#
+# IndexIgnore is a set of filenames which directory indexing should ignore
+# and not include in the listing.  Shell-style wildcarding is permitted.
+#
+IndexIgnore .??* *~ *# RCS CVS *,v *,t 
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_ajp.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_ajp.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_ajp_module /opt/puppet/lib/httpd/modules/mod_proxy_ajp.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/status.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/status.load
@@ -0,0 +1 @@
+LoadModule status_module /opt/puppet/lib/httpd/modules/mod_status.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/actions.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/actions.conf
@@ -0,0 +1,10 @@
+# a2enmod-note: needs-configuration
+
+#
+# Action lets you define media types that will execute a script whenever
+# a matching file is called. This eliminates the need for repeated URL
+# pathnames for oft-used CGI file processors.
+# Format: Action media/type /cgi-script/location
+# Format: Action handler-name /cgi-script/location
+#
+
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dav_lock.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dav_lock.load
@@ -0,0 +1 @@
+LoadModule dav_lock_module /opt/puppet/lib/httpd/modules/mod_dav_lock.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/disk_cache.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/disk_cache.load
@@ -0,0 +1,2 @@
+# Depends: cache
+LoadModule disk_cache_module /opt/puppet/lib/httpd/modules/mod_disk_cache.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/alias.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/alias.conf
@@ -0,0 +1,24 @@
+<IfModule alias_module>
+#
+# Aliases: Add here as many aliases as you need (with no limit). The format is 
+# Alias fakename realname
+#
+# Note that if you include a trailing / on fakename then the server will
+# require it to be present in the URL.  So "/icons" isn't aliased in this
+# example, only "/icons/".  If the fakename is slash-terminated, then the 
+# realname must also be slash terminated, and if the fakename omits the 
+# trailing slash, the realname must also omit it.
+#
+# We include the /icons/ alias for FancyIndexed directory listings.  If
+# you do not use FancyIndexing, you may comment this out.
+#
+Alias /icons/ "/opt/puppet/share/httpd/icons/"
+
+<Directory "/opt/puppet/share/httpd/icons">
+    Options Indexes MultiViews
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/charset_lite.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/charset_lite.load
@@ -0,0 +1 @@
+LoadModule charset_lite_module /opt/puppet/lib/httpd/modules/mod_charset_lite.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ext_filter.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ext_filter.load
@@ -0,0 +1 @@
+LoadModule ext_filter_module /opt/puppet/lib/httpd/modules/mod_ext_filter.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy.conf
@@ -0,0 +1,26 @@
+<IfModule mod_proxy.c>
+
+# If you want to use apache2 as a forward proxy, uncomment the
+# 'ProxyRequests On' line and the <Proxy *> block below.
+# WARNING: Be careful to restrict access inside the <Proxy *> block.
+# Open proxy servers are dangerous both to your network and to the
+# Internet at large.
+#
+# If you only want to use apache2 as a reverse proxy/gateway in
+# front of some web application server, you DON'T need
+# 'ProxyRequests On'.
+
+#ProxyRequests On
+#<Proxy *>
+#        AddDefaultCharset off
+#        Order deny,allow
+#        Deny from all
+#        #Allow from .example.com
+#</Proxy>
+
+# Enable/disable the handling of HTTP/1.1 "Via:" headers.
+# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
+# Set to one of: Off | On | Full | Block
+#ProxyVia Off
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dav_fs.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dav_fs.load
@@ -0,0 +1,2 @@
+# Depends: dav
+LoadModule dav_fs_module /opt/puppet/lib/http/modules/mod_dav_fs.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_dbm.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_dbm.load
@@ -0,0 +1 @@
+LoadModule authz_dbm_module /opt/puppet/lib/httpd/modules/mod_authz_dbm.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/suexec.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/suexec.load
@@ -0,0 +1 @@
+LoadModule suexec_module /opt/puppet/lib/httpd/modules/mod_suexec.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/version.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/version.load
@@ -0,0 +1 @@
+LoadModule version_module /opt/puppet/lib/httpd/modules/mod_version.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dir.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dir.load
@@ -0,0 +1 @@
+LoadModule dir_module /opt/puppet/lib/httpd/modules/mod_dir.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/filter.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/filter.load
@@ -0,0 +1 @@
+LoadModule filter_module /opt/puppet/lib/httpd/modules/mod_filter.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/cern_meta.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/cern_meta.load
@@ -0,0 +1 @@
+LoadModule cern_meta_module /opt/puppet/lib/httpd/modules/mod_cern_meta.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/unique_id.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/unique_id.load
@@ -0,0 +1 @@
+LoadModule unique_id_module /opt/puppet/lib/httpd/modules/mod_unique_id.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/setenvif.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/setenvif.conf
@@ -0,0 +1,30 @@
+<IfModule mod_setenvif.c>
+
+#
+# The following directives modify normal HTTP response behavior to
+# handle known problems with browser implementations.
+#
+BrowserMatch "Mozilla/2" nokeepalive
+BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
+BrowserMatch "RealPlayer 4\.0" force-response-1.0
+BrowserMatch "Java/1\.0" force-response-1.0
+BrowserMatch "JDK/1\.0" force-response-1.0
+
+#
+# The following directive disables redirects on non-GET requests for
+# a directory that does not include the trailing slash.  This fixes a 
+# problem with Microsoft WebFolders which does not appropriately handle 
+# redirects for folders with DAV methods.
+# Same deal with Apple's DAV filesystem and Gnome VFS support for DAV.
+#
+BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+BrowserMatch "MS FrontPage" redirect-carefully
+BrowserMatch "^WebDrive" redirect-carefully
+BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully
+BrowserMatch "^gnome-vfs/1.0" redirect-carefully
+BrowserMatch "^gvfs/1" redirect-carefully
+BrowserMatch "^XML Spy" redirect-carefully
+BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+BrowserMatch " Konqueror/4" redirect-carefully
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ident.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ident.load
@@ -0,0 +1 @@
+LoadModule ident_module /opt/puppet/lib/httpd/modules/mod_ident.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/expires.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/expires.load
@@ -0,0 +1 @@
+LoadModule expires_module /opt/puppet/lib/httpd/modules/mod_expires.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/setenvif.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/setenvif.load
@@ -0,0 +1 @@
+LoadModule setenvif_module /opt/puppet/lib/httpd/modules/mod_setenvif.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/auth_basic.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/auth_basic.load
@@ -0,0 +1 @@
+LoadModule auth_basic_module /opt/puppet/lib/httpd/modules/mod_auth_basic.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dav.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dav.load
@@ -0,0 +1 @@
+LoadModule dav_module /opt/puppet/lib/httpd/modules/mod_dav.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/imagemap.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/imagemap.load
@@ -0,0 +1 @@
+LoadModule imagemap_module /opt/puppet/lib/httpd/modules/mod_imagemap.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/cache.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/cache.load
@@ -0,0 +1 @@
+LoadModule cache_module /opt/puppet/lib/httpd/modules/mod_cache.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/status.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/status.conf
@@ -0,0 +1,30 @@
+<IfModule mod_status.c>
+#
+# Allow server status reports generated by mod_status,
+# with the URL of http://servername/server-status
+# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
+#
+<Location /server-status>
+    SetHandler server-status
+    Order deny,allow
+    Deny from all
+    Allow from 127.0.0.1 ::1
+#    Allow from 192.0.2.0/24
+</Location>
+
+# Keep track of extended status information for each request
+ExtendedStatus On
+
+# Determine if mod_status displays the first 63 characters of a request or
+# the last 63, assuming the request itself is greater than 63 chars.
+# Default: Off
+#SeeRequestTail On
+
+
+<IfModule mod_proxy.c>
+    # Show Proxy LoadBalancer status in mod_status
+    ProxyStatus On
+</IfModule>
+
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/deflate.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/deflate.conf
@@ -0,0 +1,7 @@
+<IfModule mod_deflate.c>
+	AddOutputFilterByType DEFLATE text/html text/plain text/xml
+	AddOutputFilterByType DEFLATE text/css
+	AddOutputFilterByType DEFLATE application/x-javascript application/javascript application/ecmascript
+	AddOutputFilterByType DEFLATE application/json
+	AddOutputFilterByType DEFLATE application/rss+xml
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/cgid.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/cgid.conf
@@ -0,0 +1,2 @@
+# Socket for cgid communication
+ScriptSock ${APACHE_RUN_DIR}/cgisock
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dbd.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dbd.load
@@ -0,0 +1 @@
+LoadModule dbd_module /opt/puppet/lib/httpd/modules/mod_dbd.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/alias.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/alias.load
@@ -0,0 +1 @@
+LoadModule alias_module /opt/puppet/lib/httpd/modules/mod_alias.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mime.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mime.load
@@ -0,0 +1 @@
+LoadModule mime_module /opt/puppet/lib/httpd/modules/mod_mime.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_owner.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_owner.load
@@ -0,0 +1 @@
+LoadModule authz_owner_module /opt/puppet/lib/httpd/modules/mod_authz_owner.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/autoindex.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/autoindex.load
@@ -0,0 +1 @@
+LoadModule autoindex_module /opt/puppet/lib/httpd/modules/mod_autoindex.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/mime_magic.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/mime_magic.load
@@ -0,0 +1 @@
+LoadModule mime_magic_module /opt/puppet/lib/httpd/modules/mod_mime_magic.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_balancer.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_balancer.conf
@@ -0,0 +1,16 @@
+<IfModule mod_proxy_balancer.c>
+
+# Balancer manager enables dynamic update of balancer members
+# (needs mod_status). Uncomment to enable.
+#
+#<IfModule mod_status.c>
+#<Location /balancer-manager>
+#    SetHandler balancer-manager
+#    Order deny,allow
+#    Deny from all
+#    Allow from 127.0.0.1 ::1
+#    Satisfy all
+#</Location>
+#</IfModule>
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/disk_cache.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/disk_cache.conf
@@ -0,0 +1,19 @@
+<IfModule mod_disk_cache.c>
+# cache cleaning is done by htcacheclean, which can be configured in
+# /etc/default/apache2
+#
+# For further information, see the comments in that file, 
+# /usr/share/doc/apache2.2-common/README.Debian, and the htcacheclean(8)
+# man page.
+
+	# This path must be the same as the one in /etc/default/apache2
+        CacheRoot /var/cache/pe-httpd/mod_disk_cache
+
+	# This will also cache local documents. It usually makes more sense to
+	# put this into the configuration for just one virtual host.
+
+	#CacheEnable disk /
+
+        CacheDirLevels 5
+        CacheDirLength 3
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_anon.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_anon.load
@@ -0,0 +1 @@
+LoadModule authn_anon_module /opt/puppet/lib/httpd/modules/mod_authn_anon.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/actions.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/actions.load
@@ -0,0 +1 @@
+LoadModule actions_module /opt/puppet/lib/httpd/modules/mod_actions.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/ssl.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/ssl.load
@@ -0,0 +1 @@
+LoadModule ssl_module /opt/puppet/lib/httpd/modules/mod_ssl.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_balancer.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_balancer.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_balancer_module /opt/puppet/lib/httpd/modules/mod_proxy_balancer.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/headers.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/headers.load
@@ -0,0 +1 @@
+LoadModule headers_module /opt/puppet/lib/httpd/modules/mod_headers.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/info.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/info.conf
@@ -0,0 +1,16 @@
+<IfModule mod_info.c>
+#
+# Allow remote server configuration reports, with the URL of
+#  http://servername/server-info (requires that mod_info.c be loaded).
+# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
+#
+<Location /server-info>
+    SetHandler server-info
+    Order deny,allow
+    Deny from all
+    Allow from 127.0.0.1 ::1
+#    Allow from 192.0.2.0/24
+</Location>
+
+</IfModule>
+
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/reqtimeout.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/reqtimeout.conf
@@ -0,0 +1,12 @@
+<IfModule reqtimeout_module>
+
+# Wait max 10 seconds for the first byte of the request line+headers
+# From then, require a minimum data rate of 500 bytes/s, but don't
+# wait longer than 20 seconds in total.
+RequestReadTimeout header=10-20,minrate=500
+
+# Wait max 10 seconds for the first byte of the request body (if any)
+# From then, require a minimum data rate of 500 bytes/s
+RequestReadTimeout body=10,minrate=500
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/dir.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/dir.conf
@@ -0,0 +1,5 @@
+<IfModule mod_dir.c>
+
+          DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_default.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_default.load
@@ -0,0 +1 @@
+LoadModule authz_default_module /opt/puppet/lib/httpd/modules/mod_authz_default.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authz_groupfile.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authz_groupfile.load
@@ -0,0 +1 @@
+LoadModule authz_groupfile_module /opt/puppet/lib/httpd/modules/mod_authz_groupfile.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/rewrite.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/rewrite.load
@@ -0,0 +1 @@
+LoadModule rewrite_module /opt/puppet/lib/httpd/modules/mod_rewrite.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_scgi.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_scgi.load
@@ -0,0 +1,2 @@
+# Depends: proxy
+LoadModule proxy_scgi_module /opt/puppet/lib/httpd/modules/mod_proxy_scgi.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/cgi.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/cgi.load
@@ -0,0 +1 @@
+LoadModule cgi_module /opt/puppet/lib/httpd/modules/mod_cgi.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/userdir.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/userdir.conf
@@ -0,0 +1,18 @@
+<IfModule mod_userdir.c>
+        UserDir public_html
+        UserDir disabled root
+
+        <Directory /home/*/public_html>
+                AllowOverride FileInfo AuthConfig Limit Indexes
+                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+                <Limit GET POST OPTIONS>
+                        Order allow,deny
+                        Allow from all
+                </Limit>
+                <LimitExcept GET POST OPTIONS>
+                        Order deny,allow
+                        Deny from all
+                </LimitExcept>
+        </Directory>
+</IfModule>
+
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy_ftp.conf
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy_ftp.conf
@@ -0,0 +1,6 @@
+<IfModule mod_proxy_ftp.c>
+
+# Define the character set for proxied FTP listings. Default is ISO-8859-1
+ProxyFtpDirCharset UTF-8
+
+</IfModule>
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/reqtimeout.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/reqtimeout.load
@@ -0,0 +1 @@
+LoadModule reqtimeout_module /opt/puppet/lib/httpd/modules/mod_reqtimeout.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/vhost_alias.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/vhost_alias.load
@@ -0,0 +1 @@
+LoadModule vhost_alias_module /opt/puppet/lib/httpd/modules/mod_vhost_alias.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/proxy.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/proxy.load
@@ -0,0 +1 @@
+LoadModule proxy_module /opt/puppet/lib/httpd/modules/mod_proxy.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/cgid.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/cgid.load
@@ -0,0 +1 @@
+LoadModule cgid_module /opt/puppet/lib/httpd/modules/mod_cgid.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/file_cache.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/file_cache.load
@@ -0,0 +1,2 @@
+# Depends: cache
+LoadModule file_cache_module /opt/puppet/lib/httpd/modules/mod_file_cache.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/speling.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/speling.load
@@ -0,0 +1 @@
+LoadModule speling_module /opt/puppet/lib/httpd/modules/mod_speling.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/negotiation.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/negotiation.load
@@ -0,0 +1 @@
+LoadModule negotiation_module /opt/puppet/lib/httpd/modules/mod_negotiation.so
--- pe-httpd-2.2.29.orig/debian/config-dir/mods-available/authn_default.load
+++ pe-httpd-2.2.29/debian/config-dir/mods-available/authn_default.load
@@ -0,0 +1 @@
+LoadModule authn_default_module /opt/puppet/lib/httpd/modules/mod_authn_default.so
--- pe-httpd-2.2.29.orig/debian/patches/201_build_suexec-custom.dpatch
+++ pe-httpd-2.2.29/debian/patches/201_build_suexec-custom.dpatch
@@ -0,0 +1,42 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 201_make_suexec-custom.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: add suexec-custom to the build system
+
+@DPATCH@
+diff -urNad trunk~/Makefile.in trunk/Makefile.in
+--- trunk~/Makefile.in	2007-04-24 13:08:01.000000000 +0200
++++ trunk/Makefile.in	2008-04-02 23:03:53.928260185 +0200
+@@ -221,7 +221,7 @@
+ 	fi
+ 
+ suexec:
+-	cd support && $(MAKE) suexec
++	cd support && $(MAKE) suexec suexec-custom
+ 
+ x-local-distclean:
+ 	@rm -rf autom4te.cache
+diff -urNad trunk~/support/Makefile.in trunk/support/Makefile.in
+--- trunk~/support/Makefile.in	2008-04-02 23:03:30.000000000 +0200
++++ trunk/support/Makefile.in	2008-04-02 23:03:39.188260967 +0200
+@@ -1,7 +1,7 @@
+ DISTCLEAN_TARGETS = apxs apachectl dbmmanage log_server_status \
+ 	logresolve.pl phf_abuse_log.cgi split-logfile envvars-std
+ 
+-CLEAN_TARGETS = suexec
++CLEAN_TARGETS = suexec suexec-custom
+ 
+ PROGRAMS = htpasswd htdigest rotatelogs logresolve ab checkgid htdbm htcacheclean httxt2dbm
+ TARGETS  = $(PROGRAMS)
+@@ -62,6 +62,10 @@
+ suexec: $(suexec_OBJECTS)
+ 	$(LINK) $(suexec_OBJECTS)
+ 
++suexec-custom_OBJECTS = suexec-custom.lo
++suexec-custom: $(suexec-custom_OBJECTS)
++	$(LINK) $(suexec-custom_OBJECTS)
++
+ htcacheclean_OBJECTS = htcacheclean.lo
+ htcacheclean: $(htcacheclean_OBJECTS)
+ 	$(LINK) $(htcacheclean_LTFLAGS) $(htcacheclean_OBJECTS) $(PROGRAM_LDADD)
--- pe-httpd-2.2.29.orig/debian/patches/075_mod_rewrite_literal_ipv6_redirect.dpatch
+++ pe-httpd-2.2.29/debian/patches/075_mod_rewrite_literal_ipv6_redirect.dpatch
@@ -0,0 +1,52 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 075_mod_rewrite_literal_ipv6_redirect.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Add [] to literal ipv6 hosts in URLs (bug #557015)
+
+@DPATCH@
+diff -urNad trunk~/modules/mappers/mod_rewrite.c trunk/modules/mappers/mod_rewrite.c
+--- trunk~/modules/mappers/mod_rewrite.c	2009-07-10 14:20:45.000000000 +0200
++++ trunk/modules/mappers/mod_rewrite.c	2009-12-06 00:10:57.468047872 +0100
+@@ -833,6 +833,23 @@
+ }
+ 
+ /*
++ * Get the current server name from the request for the purposes
++ * of using in a URL.  If the server name is an IPv6 literal
++ * address, it will be returned in URL format (e.g., "[fe80::1]").
++ */
++static const char *get_server_name_for_url(request_rec *r)
++{
++    const char *plain_server_name = ap_get_server_name(r);
++
++#if APR_HAVE_IPV6
++    if (ap_strchr_c(plain_server_name, ':')) { /* IPv6 literal? */
++        return apr_psprintf(r->pool, "[%s]", plain_server_name);
++    }
++#endif
++    return plain_server_name;
++}
++
++/*
+  * add 'http[s]://ourhost[:ourport]/' to URI
+  * if URI is still not fully qualified
+  */
+@@ -843,7 +860,7 @@
+         char *thisport;
+         int port;
+ 
+-        thisserver = ap_get_server_name(r);
++        thisserver = get_server_name_for_url(r);
+         port = ap_get_server_port(r);
+         thisport = ap_is_default_port(port, r)
+                    ? ""
+@@ -4271,7 +4288,7 @@
+      */
+ 
+     /* add the canonical URI of this URL */
+-    thisserver = ap_get_server_name(r);
++    thisserver = get_server_name_for_url(r);
+     port = ap_get_server_port(r);
+     if (ap_is_default_port(port, r)) {
+         thisport = "";
--- pe-httpd-2.2.29.orig/debian/patches/203_fix-ab-segfault.dpatch
+++ pe-httpd-2.2.29/debian/patches/203_fix-ab-segfault.dpatch
@@ -0,0 +1,21 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+
+@DPATCH@
+diff -Naurp httpd-2.2.14.orig/support/ab.c httpd-2.2.14/support/ab.c
+--- httpd-2.2.14.orig/support/ab.c	2009-09-14 15:43:02.000000000 -0400
++++ httpd-2.2.14/support/ab.c	2010-03-08 13:51:32.342885487 -0500
+@@ -1568,7 +1568,14 @@ static void test(void)
+ 
+     con = calloc(concurrency, sizeof(struct connection));
+ 
++    /*
++     * XXX: a way to caluclate the stats without requiring O(requests) memory
++     * XXX: would be nice.
++     */
+     stats = calloc(requests, sizeof(struct data));
++    if (stats == NULL) {
++	err("Cannot allocate memory for result statistics");
++    }
+ 
+     if ((status = apr_pollset_create(&readbits, concurrency, cntxt, 0)) != APR_SUCCESS) {
+         apr_err("apr_pollset_create failed", status);
--- pe-httpd-2.2.29.orig/debian/patches/074_link_support_progs_with_lcrypt.dpatch
+++ pe-httpd-2.2.29/debian/patches/074_link_support_progs_with_lcrypt.dpatch
@@ -0,0 +1,39 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 074_support_link_lcrypt.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Link support programs with -lcrypt where necessary. Required by
+## DP: binutils-gold (bug #553946)
+
+@DPATCH@
+diff -urNad trunk~/configure trunk/configure
+--- trunk~/configure	2009-12-05 23:44:43.501042252 +0100
++++ trunk/configure	2009-12-05 23:47:07.640043829 +0100
+@@ -14628,11 +14628,11 @@
+ 
+ fi
+ 
+-htpasswd_LTFLAGS=""
++htpasswd_LTFLAGS="-lcrypt"
+ htdigest_LTFLAGS=""
+ rotatelogs_LTFLAGS=""
+ logresolve_LTFLAGS=""
+-htdbm_LTFLAGS=""
++htdbm_LTFLAGS="-lcrypt"
+ ab_LTFLAGS=""
+ checkgid_LTFLAGS=""
+ htcacheclean_LTFLAGS=""
+diff -urNad trunk~/support/config.m4 trunk/support/config.m4
+--- trunk~/support/config.m4	2006-12-24 15:40:19.000000000 +0100
++++ trunk/support/config.m4	2009-12-05 23:47:29.388150162 +0100
+@@ -1,8 +1,8 @@
+-htpasswd_LTFLAGS=""
++htpasswd_LTFLAGS="-lcrypt"
+ htdigest_LTFLAGS=""
+ rotatelogs_LTFLAGS=""
+ logresolve_LTFLAGS=""
+-htdbm_LTFLAGS=""
++htdbm_LTFLAGS="-lcrypt"
+ ab_LTFLAGS=""
+ checkgid_LTFLAGS=""
+ htcacheclean_LTFLAGS=""
--- pe-httpd-2.2.29.orig/debian/patches/052_logresolve_linelength.dpatch
+++ pe-httpd-2.2.29/debian/patches/052_logresolve_linelength.dpatch
@@ -0,0 +1,78 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 052_logresolve_linelength.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: remove limit of 1024 bytes per line #331631
+
+@DPATCH@
+diff -urNad trunk~/support/logresolve.c trunk/support/logresolve.c
+--- trunk~/support/logresolve.c	2006-07-12 05:38:44.000000000 +0200
++++ trunk/support/logresolve.c	2007-09-27 20:12:47.093217594 +0200
+@@ -82,7 +82,7 @@
+ #endif
+ 
+ static void cgethost(struct in_addr ipnum, char *string, int check);
+-static int get_line(char *s, int n);
++static int get_line();
+ static void stats(FILE *output);
+ 
+ #ifdef BEOS
+@@ -90,11 +90,6 @@
+ #endif
+ 
+ 
+-/* maximum line length */
+-#ifndef MAXLINE
+-#define MAXLINE 1024
+-#endif
+-
+ /* maximum length of a domain name */
+ #ifndef MAXDNAME
+ #define MAXDNAME 256
+@@ -141,6 +136,8 @@
+ static int resolves = 0;
+ static int withname = 0;
+ static int errors[MAX_ERR + 3];
++static size_t maxline=0;
++static char *line = NULL;
+ 
+ /*
+  * cgethost - gets hostname by IP address, caching, and adding unresolvable
+@@ -287,14 +284,15 @@
+  * gets a line from stdin
+  */
+ 
+-static int get_line (char *s, int n)
++static int get_line ()
+ {
++    ssize_t len;
+     char *cp;
+ 
+-    if (!fgets(s, n, stdin))
++    if ( (len = getline(&line, &maxline, stdin)) == -1 )
+         return (0);
+-    cp = strchr(s, '\n');
+-    if (cp)
++    cp = line + len -1;
++    if (*cp == '\n')
+         *cp = '\0';
+     return (1);
+ }
+@@ -302,7 +300,7 @@
+ int main (int argc, char *argv[])
+ {
+     struct in_addr ipnum;
+-    char *bar, hoststring[MAXDNAME + 1], line[MAXLINE], *statfile;
++    char *bar, hoststring[MAXDNAME + 1], *statfile;
+     int i, check;
+ 
+ #if defined(WIN32) || (defined(NETWARE) && defined(USE_WINSOCK))
+@@ -337,7 +335,7 @@
+     for (i = 0; i < MAX_ERR + 2; i++)
+         errors[i] = 0;
+ 
+-    while (get_line(line, MAXLINE)) {
++    while (get_line()) {
+         if (line[0] == '\0')
+             continue;
+         entries++;
--- pe-httpd-2.2.29.orig/debian/patches/032_suexec_is_shared
+++ pe-httpd-2.2.29/debian/patches/032_suexec_is_shared
@@ -0,0 +1,20 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 032_suexec_is_shared by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Patch to allow suEXEC as shared.
+
+@DPATCH@
+--- apache2/os/unix/unixd.c	2004-09-27 19:53:29.000000000 -0600
++++ apache2/os/unix/unixd.c	2004-09-27 19:56:57.000000000 -0600
+@@ -209,6 +209,10 @@
+ 
+     /* Check for suexec */
+     unixd_config.suexec_enabled = 0;
++    /* If mod_suexec isn't linked in, we shouldn't test for the binary */
++    if (ap_find_linked_module("mod_suexec.c") == NULL) {
++	return;
++    }
+     if ((apr_stat(&wrapper, SUEXEC_BIN,
+                   APR_FINFO_NORM, ptemp)) != APR_SUCCESS) {
+         return;
--- pe-httpd-2.2.29.orig/debian/patches/069_no_deflate_for_HEAD.dpatch
+++ pe-httpd-2.2.29/debian/patches/069_no_deflate_for_HEAD.dpatch
@@ -0,0 +1,30 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: mod_deflate DoS
+## DP: This should switch off deflate for HEAD requests
+## DP: Patch by Ruediger Pluem
+
+@DPATCH@
+--- a/modules/filters/mod_deflate.c       (revision 793927)
++++ a/modules/filters/mod_deflate.c       (working copy)
+@@ -629,6 +629,19 @@
+         apr_bucket *b;
+         apr_size_t len;
+
++        /*
++         * Optimization: If we are a HEAD request and bytes_sent is not zero
++         * it means that we have passed the content-length filter once and
++         * have more data to sent. This means that the content-length filter
++         * could not determine our content-length for the response to the
++         * HEAD request anyway (the associated GET request would deliver the
++         * body in chunked encoding) and we can stop compressing.
++         */
++        if (r->header_only && r->bytes_sent) {
++            ap_remove_output_filter(f);
++            return ap_pass_brigade(f->next, bb);
++        }
++
+         e = APR_BRIGADE_FIRST(bb);
+
+         if (APR_BUCKET_IS_EOS(e)) {
--- pe-httpd-2.2.29.orig/debian/patches/076_apxs2_a2enmod.dpatch
+++ pe-httpd-2.2.29/debian/patches/076_apxs2_a2enmod.dpatch
@@ -0,0 +1,151 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 076_apxs2_a2enmo.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Make apxs2 use a2enmod and /etc/puppetlabs/httpd/mods-available
+
+@DPATCH@
+diff -urNad trunk~/support/apxs.in trunk/support/apxs.in
+--- trunk~/support/apxs.in	2010-01-02 21:52:57.828866228 +0100
++++ trunk/support/apxs.in	2010-01-02 21:55:48.375597120 +0100
+@@ -521,7 +521,7 @@
+ 	# $dir =~ s|^$CFG_PREFIX/?||;
+         $dir =~ s|(.)$|$1/|;
+ 	$t =~ s|\.la$|.so|;
+-        push(@lmd, sprintf("LoadModule %-18s %s", "${name}_module", "$dir$t"));
++        push(@lmd, [ $name, sprintf("LoadModule %-18s %s", "${name}_module", "$dir$t") ] );
+     }
+ 
+     #   execute the commands
+@@ -529,108 +529,35 @@
+ 
+     #   activate module via LoadModule/AddModule directive
+     if ($opt_a or $opt_A) {
+-        if (not -f "$CFG_SYSCONFDIR/$CFG_TARGET.conf") {
+-            error("Config file $CFG_SYSCONFDIR/$CFG_TARGET.conf not found");
++        if (not -d "$CFG_SYSCONFDIR/mods-available") {
++            error("Config file $CFG_SYSCONFDIR/mods-available not found");
+             exit(1);
+         }
+ 
+-        open(FP, "<$CFG_SYSCONFDIR/$CFG_TARGET.conf") || die;
+-        my $content = join('', <FP>);
+-        close(FP);
+-
+-        if ($content !~ m|\n#?\s*LoadModule\s+|) {
+-            error("Activation failed for custom $CFG_SYSCONFDIR/$CFG_TARGET.conf file.");
+-            error("At least one `LoadModule' directive already has to exist.");
+-            exit(1);
+-        }
+-
+-        my $lmd;
+-        my $c = '';
+-        $c = '#' if ($opt_A);
+-        foreach $lmd (@lmd) {
+-            my $what = $opt_A ? "preparing" : "activating";
+-            my $lmd_re = $lmd;
+-            $lmd_re =~ s/\s+/\\s+/g;
+-
+-            if ($content !~ m|\n#?\s*$lmd_re|) {
+-                # check for open <containers>, so that the new LoadModule
+-                # directive always appears *outside* of an <container>.
+-
+-                my $before = ($content =~ m|^(.*\n)#?\s*LoadModule\s+[^\n]+\n|s)[0];
+-
+-                # the '()=' trick forces list context and the scalar
+-                # assignment counts the number of list members (aka number
+-                # of matches) then
+-                my $cntopen = () = ($before =~ m|^\s*<[^/].*$|mg);
+-                my $cntclose = () = ($before =~ m|^\s*</.*$|mg);
+-
+-                if ($cntopen == $cntclose) {
+-                    # fine. Last LoadModule is contextless.
+-                    $content =~ s|^(.*\n#?\s*LoadModule\s+[^\n]+\n)|$1$c$lmd\n|s;
+-                }
+-                elsif ($cntopen < $cntclose) {
+-                    error('Configuration file is not valid. There are sections'
+-                          . ' closed before opened.');
+-                    exit(1);
+-                }
+-                else {
+-                    # put our cmd after the section containing the last
+-                    # LoadModule.
+-                    my $found =
+-                    $content =~ s!\A (               # string and capture start
+-                                  (?:(?:
+-                                    ^\s*             # start of conf line with a
+-                                    (?:[^<]|<[^/])   # directive which does not
+-                                                     # start with '</'
+-
+-                                    .*(?:$)\n        # rest of the line.
+-                                                     # the '$' is in parentheses
+-                                                     # to avoid misinterpreting
+-                                                     # the string "$\" as
+-                                                     # perl variable.
+-
+-                                    )*               # catch as much as possible
+-                                                     # of such lines. (including
+-                                                     # zero)
+-
+-                                    ^\s*</.*(?:$)\n? # after the above, we
+-                                                     # expect a config line with
+-                                                     # a closing container (</)
+-
+-                                  ) {$cntopen}       # the whole pattern (bunch
+-                                                     # of lines that end up with
+-                                                     # a closing directive) must
+-                                                     # be repeated $cntopen
+-                                                     # times. That's it.
+-                                                     # Simple, eh? ;-)
+-
+-                                  )                  # capture end
+-                                 !$1$c$lmd\n!mx;
+-
+-                    unless ($found) {
+-                        error('Configuration file is not valid. There are '
+-                              . 'sections opened and not closed.');
+-                        exit(1);
+-                    }
++        my $entry;
++        foreach $entry (@lmd) {
++            my ($name, $lmd) = @{$entry};
++            my $filename = "$CFG_SYSCONFDIR/mods-available/$name.load";
++            if (-f $filename) {
++                my $cmd = "mv $filename $filename.bak~";
++                if (system($cmd) != 0) {
++                    die "'$cmd' failed\n";
+                 }
+-            } else {
+-                # replace already existing LoadModule line
+-                $content =~ s|^(.*\n)#?\s*$lmd_re[^\n]*\n|$1$c$lmd\n|s;
+             }
+-            $lmd =~ m|LoadModule\s+(.+?)_module.*|;
+-            notice("[$what module `$1' in $CFG_SYSCONFDIR/$CFG_TARGET.conf]");
++
++            notice("[preparing module `$name' in $filename]");
++            open(FP, ">$filename") || die;
++            print FP "$lmd\n";
++            close(FP);
++
++            if ($opt_a) {
++                my $cmd = "a2enmod $name";
++                if (system($cmd) != 0) {
++                    die "'$cmd' failed\n";
++                }
++            }               
++
+         }
+-        if (@lmd) {
+-            if (open(FP, ">$CFG_SYSCONFDIR/$CFG_TARGET.conf.new")) {
+-                print FP $content;
+-                close(FP);
+-                system("cp $CFG_SYSCONFDIR/$CFG_TARGET.conf $CFG_SYSCONFDIR/$CFG_TARGET.conf.bak && " .
+-                       "cp $CFG_SYSCONFDIR/$CFG_TARGET.conf.new $CFG_SYSCONFDIR/$CFG_TARGET.conf && " .
+-                       "rm $CFG_SYSCONFDIR/$CFG_TARGET.conf.new");
+-            } else {
+-                notice("unable to open configuration file");
+-            }
+-	}
+     }
+ }
+ 
--- pe-httpd-2.2.29.orig/debian/patches/001_branding
+++ pe-httpd-2.2.29/debian/patches/001_branding
@@ -0,0 +1,36 @@
+#!/bin/sh -e
+## 02_branding.dpatch by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Changes apache's PLATFORM based on lsb_release output
+
+BUILD_DIST="($(lsb_release -i -s))"
+
+if [ $# -ne 1 ]; then
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+fi
+
+case "$1" in
+  -patch)
+    if grep -q "${BUILD_DIST}" server/core.c 2>/dev/null; then
+      echo >&2 "`basename $0`: patch already applied"
+      exit 1
+    else
+      # This is where we get our distribution-specific server signature from:
+      sed -i -e "s/(\" PLATFORM \")/${BUILD_DIST}/" server/core.c
+    fi
+  ;;
+  -unpatch) 
+    if grep -q "${BUILD_DIST}" server/core.c 2>/dev/null; then
+      sed -i -e "s/${BUILD_DIST}/(\" PLATFORM \")/" server/core.c
+    else
+      echo >&2 "`basename $0`: patch not yet applied, cannot unpatch"
+      exit 1
+    fi
+  ;;
+  *)
+    echo >&2 "`basename $0`: script expects -patch|-unpatch as argument"
+    exit 1
+  ;;
+esac
--- pe-httpd-2.2.29.orig/debian/patches/057_disablemods.dpatch
+++ pe-httpd-2.2.29/debian/patches/057_disablemods.dpatch
@@ -0,0 +1,62 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## Stolen from the fedora package
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Support "--enable-modules=none" to build an httpd binary with 
+## DP: no optional modules enabled.
+
+@DPATCH@
+diff -urNad trunk~/acinclude.m4 trunk/acinclude.m4
+--- trunk~/acinclude.m4	2005-11-13 07:33:15.000000000 +0100
++++ trunk/acinclude.m4	2008-03-14 01:28:42.379287995 +0100
+@@ -289,14 +289,19 @@
+ 
+   AC_ARG_ENABLE(modules,
+   APACHE_HELP_STRING(--enable-modules=MODULE-LIST,Space-separated list of modules to enable | "all" | "most"),[
+-    for i in $enableval; do
+-      if test "$i" = "all" -o "$i" = "most"; then
+-        module_selection=$i
+-      else
+-        i=`echo $i | sed 's/-/_/g'`
+-        eval "enable_$i=yes"
+-      fi
+-    done
++    if test "$enableval" = "none"; then
++       module_default=no
++       module_selection=none
++    else
++      for i in $enableval; do
++        if test "$i" = "all" -o "$i" = "most"; then
++          module_selection=$i
++        else
++          i=`echo $i | sed 's/-/_/g'`
++          eval "enable_$i=yes"
++        fi
++      done
++    fi
+   ])
+   
+   AC_ARG_ENABLE(mods-shared,
+diff -urNad trunk~/configure trunk/configure
+--- trunk~/configure	2008-01-10 17:54:40.000000000 +0100
++++ trunk/configure	2008-03-14 01:31:55.675287371 +0100
+@@ -8106,6 +8106,10 @@
+   # Check whether --enable-modules was given.
+ if test "${enable_modules+set}" = set; then
+   enableval=$enable_modules;
++  if test "$enableval" = "none"; then
++     module_default=no
++     module_selection=none
++  else
+     for i in $enableval; do
+       if test "$i" = "all" -o "$i" = "most"; then
+         module_selection=$i
+@@ -8114,7 +8118,7 @@
+         eval "enable_$i=yes"
+       fi
+     done
+-
++  fi
+ fi
+ 
+ 
--- pe-httpd-2.2.29.orig/debian/patches/215_httpd-2.2.15-CVE-2014-0231.dpatch
+++ pe-httpd-2.2.29/debian/patches/215_httpd-2.2.15-CVE-2014-0231.dpatch
@@ -0,0 +1,151 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 215_httpd-2.2.15-CVE-2014-0231.dpatch by Ryan McKern <ryan.mckern@puppetlabs.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix for CVE-2014-0231 (mod_cgid denial of service)
+
+@DPATCH@
+
+--- a/modules/generators/mod_cgid.c	2014/07/16 20:53:11	1611184
++++ b/modules/generators/mod_cgid.c	2014/07/16 20:56:51	1611185
+@@ -93,6 +93,10 @@
+ static pid_t parent_pid;
+ static ap_unix_identity_t empty_ugid = { (uid_t)-1, (gid_t)-1, -1 };
+ 
++typedef struct { 
++    apr_interval_time_t timeout;
++} cgid_dirconf;
++
+ /* The APR other-child API doesn't tell us how the daemon exited
+  * (SIGSEGV vs. exit(1)).  The other-child maintenance function
+  * needs to decide whether to restart the daemon after a failure
+@@ -934,7 +938,14 @@
+     return overrides->logname ? overrides : base;
+ }
+ 
++static void *create_cgid_dirconf(apr_pool_t *p, char *dummy)
++{
++    cgid_dirconf *c = (cgid_dirconf *) apr_pcalloc(p, sizeof(cgid_dirconf));
++    return c;
++}
++
+ static const char *set_scriptlog(cmd_parms *cmd, void *dummy, const char *arg)
++
+ {
+     server_rec *s = cmd->server;
+     cgid_server_conf *conf = ap_get_module_config(s->module_config,
+@@ -987,7 +998,16 @@
+ 
+     return NULL;
+ }
++static const char *set_script_timeout(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    cgid_dirconf *dc = dummy;
+ 
++    if (ap_timeout_parameter_parse(arg, &dc->timeout, "s") != APR_SUCCESS) { 
++        return "CGIDScriptTimeout has wrong format";
++    }
++ 
++    return NULL;
++}
+ static const command_rec cgid_cmds[] =
+ {
+     AP_INIT_TAKE1("ScriptLog", set_scriptlog, NULL, RSRC_CONF,
+@@ -999,6 +1019,10 @@
+     AP_INIT_TAKE1("ScriptSock", set_script_socket, NULL, RSRC_CONF,
+                   "the name of the socket to use for communication with "
+                   "the cgi daemon."),
++    AP_INIT_TAKE1("CGIDScriptTimeout", set_script_timeout, NULL, RSRC_CONF | ACCESS_CONF,
++                  "The amount of time to wait between successful reads from "
++                  "the CGI script, in seconds."),
++                  
+     {NULL}
+ };
+ 
+@@ -1335,11 +1359,15 @@
+     apr_file_t *tempsock;
+     struct cleanup_script_info *info;
+     apr_status_t rv;
++    cgid_dirconf *dc;
+ 
+     if (strcmp(r->handler,CGI_MAGIC_TYPE) && strcmp(r->handler,"cgi-script"))
+         return DECLINED;
+ 
+     conf = ap_get_module_config(r->server->module_config, &cgid_module);
++    dc = ap_get_module_config(r->per_dir_config, &cgid_module);
++
++    
+     is_included = !strcmp(r->protocol, "INCLUDED");
+ 
+     if ((argv0 = strrchr(r->filename, '/')) != NULL)
+@@ -1412,6 +1440,12 @@
+      */
+ 
+     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
++    if (dc->timeout > 0) { 
++        apr_file_pipe_timeout_set(tempsock, dc->timeout);
++    }
++    else { 
++        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
++    }
+     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
+ 
+     if ((argv0 = strrchr(r->filename, '/')) != NULL)
+@@ -1487,6 +1521,10 @@
+             if (rv != APR_SUCCESS) {
+                 /* silly script stopped reading, soak up remaining message */
+                 child_stopped_reading = 1;
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, 
++                              "Error writing request body to script %s", 
++                              r->filename);
++
+             }
+         }
+         apr_brigade_cleanup(bb);
+@@ -1577,7 +1615,13 @@
+             return HTTP_MOVED_TEMPORARILY;
+         }
+ 
+-        ap_pass_brigade(r->output_filters, bb);
++        rv = ap_pass_brigade(r->output_filters, bb);
++        if (rv != APR_SUCCESS) { 
++            /* APLOG_ERR because the core output filter message is at error,
++             * but doesn't know it's passing CGI output 
++             */
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, "Failed to flush CGI output to client");
++        }
+     }
+ 
+     if (nph) {
+@@ -1707,6 +1751,8 @@
+     request_rec *r = f->r;
+     cgid_server_conf *conf = ap_get_module_config(r->server->module_config,
+                                                   &cgid_module);
++    cgid_dirconf *dc = ap_get_module_config(r->per_dir_config, &cgid_module);
++
+     struct cleanup_script_info *info;
+ 
+     add_ssi_vars(r);
+@@ -1736,6 +1782,13 @@
+      * get rid of the cleanup we registered when we created the socket.
+      */
+     apr_os_pipe_put_ex(&tempsock, &sd, 1, r->pool);
++    if (dc->timeout > 0) {
++        apr_file_pipe_timeout_set(tempsock, dc->timeout);
++    }
++    else {
++        apr_file_pipe_timeout_set(tempsock, r->server->timeout);
++    }
++
+     apr_pool_cleanup_kill(r->pool, (void *)((long)sd), close_unix_socket);
+ 
+     APR_BRIGADE_INSERT_TAIL(bb, apr_bucket_pipe_create(tempsock,
+@@ -1841,7 +1894,7 @@
+ 
+ module AP_MODULE_DECLARE_DATA cgid_module = {
+     STANDARD20_MODULE_STUFF,
+-    NULL, /* dir config creater */
++    create_cgid_dirconf, /* dir config creater */
+     NULL, /* dir merger --- default is to override */
+     create_cgid_config, /* server config */
+     merge_cgid_config, /* merge server config */
--- pe-httpd-2.2.29.orig/debian/patches/218_httpd-2.2.29-logjam.dpatch
+++ pe-httpd-2.2.29/debian/patches/218_httpd-2.2.29-logjam.dpatch
@@ -0,0 +1,1277 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 218_httpd-2.2.29-logjam.dpatch by  <mckern@dolphin.delivery.puppetlabs.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Logjam mitigation
+
+@DPATCH@
+
+diff -ur httpd-2.2.29/modules/ssl/mod_ssl.c httpd-2.2.29.logjam/modules/ssl/mod_ssl.c
+--- httpd-2.2.29/modules/ssl/mod_ssl.c	2013-11-11 06:00:57.000000000 -0800
++++ httpd-2.2.29.logjam/modules/ssl/mod_ssl.c	2015-06-05 11:52:23.000000000 -0700
+@@ -436,15 +436,6 @@
+ 
+     sslconn->ssl = ssl;
+ 
+-    /*
+-     *  Configure callbacks for SSL connection
+-     */
+-    SSL_set_tmp_rsa_callback(ssl, ssl_callback_TmpRSA);
+-    SSL_set_tmp_dh_callback(ssl,  ssl_callback_TmpDH);
+-#ifndef OPENSSL_NO_EC
+-    SSL_set_tmp_ecdh_callback(ssl, ssl_callback_TmpECDH);
+-#endif
+-
+     SSL_set_verify_result(ssl, X509_V_OK);
+ 
+     ssl_io_filter_init(c, ssl);
+Only in httpd-2.2.29.logjam/modules/ssl: mod_ssl.c.orig
+diff -ur httpd-2.2.29/modules/ssl/ssl_engine_config.c httpd-2.2.29.logjam/modules/ssl/ssl_engine_config.c
+--- httpd-2.2.29/modules/ssl/ssl_engine_config.c	2013-11-11 06:05:50.000000000 -0800
++++ httpd-2.2.29.logjam/modules/ssl/ssl_engine_config.c	2015-06-05 11:52:23.000000000 -0700
+@@ -76,8 +76,6 @@
+     mc->szCryptoDevice         = NULL;
+ #endif
+ 
+-    memset(mc->pTmpKeys, 0, sizeof(mc->pTmpKeys));
+-
+     apr_pool_userdata_set(mc, SSL_MOD_CONFIG_KEY,
+                           apr_pool_cleanup_null,
+                           pool);
+@@ -680,6 +678,9 @@
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+     SSLDirConfigRec *dc = (SSLDirConfigRec *)dcfg;
+ 
++    /* always disable null and export ciphers */
++    arg = apr_pstrcat(cmd->pool, "!aNULL:!eNULL:!EXP:", arg, NULL);
++
+     if (cmd->path) {
+         dc->szCipherSuite = arg;
+     }
+@@ -1382,6 +1383,9 @@
+ {
+     SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
+ 
++    /* always disable null and export ciphers */
++    arg = apr_pstrcat(cmd->pool, "!aNULL:!eNULL:!EXP:", arg, NULL);
++
+     sc->proxy->auth.cipher_suite = arg;
+ 
+     return NULL;
+Only in httpd-2.2.29.logjam/modules/ssl: ssl_engine_config.c.orig
+diff -ur httpd-2.2.29/modules/ssl/ssl_engine_dh.c httpd-2.2.29.logjam/modules/ssl/ssl_engine_dh.c
+--- httpd-2.2.29/modules/ssl/ssl_engine_dh.c	2006-07-11 20:38:44.000000000 -0700
++++ httpd-2.2.29.logjam/modules/ssl/ssl_engine_dh.c	2015-06-05 11:52:23.000000000 -0700
+@@ -41,21 +41,9 @@
+ **         0e:3e:30:06:80:a3:03:0c:6e:4c:37:57:d0:8f:70:
+ **         e6:aa:87:10:33
+ **     generator: 2 (0x2)
+-** Diffie-Hellman-Parameters: (1024 bit)
+-**     prime:
+-**         00:d6:7d:e4:40:cb:bb:dc:19:36:d6:93:d3:4a:fd:
+-**         0a:d5:0c:84:d2:39:a4:5f:52:0b:b8:81:74:cb:98:
+-**         bc:e9:51:84:9f:91:2e:63:9c:72:fb:13:b4:b4:d7:
+-**         17:7e:16:d5:5a:c1:79:ba:42:0b:2a:29:fe:32:4a:
+-**         46:7a:63:5e:81:ff:59:01:37:7b:ed:dc:fd:33:16:
+-**         8a:46:1a:ad:3b:72:da:e8:86:00:78:04:5b:07:a7:
+-**         db:ca:78:74:08:7d:15:10:ea:9f:cc:9d:dd:33:05:
+-**         07:dd:62:db:88:ae:aa:74:7d:e0:f4:d6:e2:bd:68:
+-**         b0:e7:39:3e:0f:24:21:8e:b3
+-**     generator: 2 (0x2)
+ */
+ 
+-static unsigned char dh512_p[] = {
++static const unsigned char dh512_p[] = {
+     0x9F, 0xDB, 0x8B, 0x8A, 0x00, 0x45, 0x44, 0xF0, 0x04, 0x5F, 0x17, 0x37,
+     0xD0, 0xBA, 0x2E, 0x0B, 0x27, 0x4C, 0xDF, 0x1A, 0x9F, 0x58, 0x82, 0x18,
+     0xFB, 0x43, 0x53, 0x16, 0xA1, 0x6E, 0x37, 0x41, 0x71, 0xFD, 0x19, 0xD8,
+@@ -63,7 +51,7 @@
+     0x80, 0xA3, 0x03, 0x0C, 0x6E, 0x4C, 0x37, 0x57, 0xD0, 0x8F, 0x70, 0xE6,
+     0xAA, 0x87, 0x10, 0x33,
+ };
+-static unsigned char dh512_g[] = {
++static const unsigned char dh512_g[] = {
+     0x02,
+ };
+ 
+@@ -73,7 +61,23 @@
+                                dh512_g, sizeof(dh512_g));
+ }
+ 
+-static unsigned char dh1024_p[] = {
++#if 0 /* Legacy (replaced by RFC2409's below) */
++/*
++** Diffie-Hellman-Parameters: (1024 bit)
++**     prime:
++**         00:d6:7d:e4:40:cb:bb:dc:19:36:d6:93:d3:4a:fd:
++**         0a:d5:0c:84:d2:39:a4:5f:52:0b:b8:81:74:cb:98:
++**         bc:e9:51:84:9f:91:2e:63:9c:72:fb:13:b4:b4:d7:
++**         17:7e:16:d5:5a:c1:79:ba:42:0b:2a:29:fe:32:4a:
++**         46:7a:63:5e:81:ff:59:01:37:7b:ed:dc:fd:33:16:
++**         8a:46:1a:ad:3b:72:da:e8:86:00:78:04:5b:07:a7:
++**         db:ca:78:74:08:7d:15:10:ea:9f:cc:9d:dd:33:05:
++**         07:dd:62:db:88:ae:aa:74:7d:e0:f4:d6:e2:bd:68:
++**         b0:e7:39:3e:0f:24:21:8e:b3
++**     generator: 2 (0x2)
++*/
++
++static const unsigned char dh1024_p[] = {
+     0xD6, 0x7D, 0xE4, 0x40, 0xCB, 0xBB, 0xDC, 0x19, 0x36, 0xD6, 0x93, 0xD3,
+     0x4A, 0xFD, 0x0A, 0xD5, 0x0C, 0x84, 0xD2, 0x39, 0xA4, 0x5F, 0x52, 0x0B,
+     0xB8, 0x81, 0x74, 0xCB, 0x98, 0xBC, 0xE9, 0x51, 0x84, 0x9F, 0x91, 0x2E,
+@@ -86,7 +90,7 @@
+     0x88, 0xAE, 0xAA, 0x74, 0x7D, 0xE0, 0xF4, 0xD6, 0xE2, 0xBD, 0x68, 0xB0,
+     0xE7, 0x39, 0x3E, 0x0F, 0x24, 0x21, 0x8E, 0xB3,
+ };
+-static unsigned char dh1024_g[] = {
++static const unsigned char dh1024_g[] = {
+     0x02,
+ };
+ 
+@@ -95,23 +99,581 @@
+     return modssl_dh_configure(dh1024_p, sizeof(dh1024_p),
+                                dh1024_g, sizeof(dh1024_g));
+ }
++#endif
+ 
+ /* ----END GENERATED SECTION---------- */
+ 
++/*
++ * "Second Oakley Default Group" from RFC2409, section 6.2.
++ *
++ * The prime is: 2^1024 - 2^960 - 1 + 2^64 * { [2^894 pi] + 129093 }.
++ *
++ * RFC2409 specifies a generator of 2.
++ */
++static const unsigned char dh1024_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE6, 0x53, 0x81,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh1024_g[] = {
++    0x02,
++};
++
++static DH *get_dh1024(void)
++{
++    return modssl_dh_configure(dh1024_p, sizeof(dh1024_p),
++                               dh1024_g, sizeof(dh1024_g));
++}
++
++/*
++ * "2048-bit MODP Group" from RFC3526, Section 3.
++ *
++ * The prime is: 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 }
++ *
++ * RFC3526 specifies a generator of 2.
++ */
++static const unsigned char dh2048_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
++    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
++    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
++    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
++    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
++    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
++    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
++    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
++    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
++    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
++    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
++    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
++    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
++    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAC, 0xAA, 0x68,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh2048_g[] = {
++    0x02,
++};
++
++static DH *get_dh2048(void)
++{
++    return modssl_dh_configure(dh2048_p, sizeof(dh2048_p),
++                               dh2048_g, sizeof(dh2048_g));
++}
++
++/*
++ * "3072-bit MODP Group" from RFC3526, Section 4.
++ *
++ * The prime is: 2^3072 - 2^3008 - 1 + 2^64 * { [2^2942 pi] + 1690314 }
++ *
++ * RFC3526 specifies a generator of 2.
++ */
++static const unsigned char dh3072_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
++    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
++    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
++    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
++    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
++    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
++    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
++    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
++    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
++    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
++    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
++    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
++    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
++    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D,
++    0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
++    0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64,
++    0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
++    0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D,
++    0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
++    0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7,
++    0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
++    0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B,
++    0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
++    0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64,
++    0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
++    0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C,
++    0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
++    0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31,
++    0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
++    0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x3A, 0xD2, 0xCA,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh3072_g[] = {
++    0x02,
++};
++
++static DH *get_dh3072(void)
++{
++    return modssl_dh_configure(dh3072_p, sizeof(dh3072_p),
++                               dh3072_g, sizeof(dh3072_g));
++}
++
++/*
++ * "4096-bit MODP Group" from RFC3526, Section 5.
++ *
++ * The prime is: 2^4096 - 2^4032 - 1 + 2^64 * { [2^3966 pi] + 240904 }
++ *
++ * RFC3526 specifies a generator of 2.
++ */
++static const unsigned char dh4096_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
++    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
++    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
++    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
++    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
++    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
++    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
++    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
++    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
++    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
++    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
++    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
++    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
++    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D,
++    0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
++    0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64,
++    0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
++    0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D,
++    0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
++    0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7,
++    0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
++    0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B,
++    0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
++    0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64,
++    0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
++    0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C,
++    0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
++    0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31,
++    0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
++    0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01,
++    0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
++    0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26,
++    0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
++    0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA,
++    0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
++    0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9,
++    0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
++    0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D,
++    0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
++    0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED,
++    0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
++    0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C,
++    0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
++    0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1,
++    0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
++    0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x06, 0x31, 0x99,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh4096_g[] = {
++    0x02,
++};
++
++static DH *get_dh4096(void)
++{
++    return modssl_dh_configure(dh4096_p, sizeof(dh4096_p),
++                               dh4096_g, sizeof(dh4096_g));
++}
++
++/*
++ * "6144-bit MODP Group" from RFC3526, Section 6.
++ *
++ * The prime is: 2^6144 - 2^6080 - 1 + 2^64 * { [2^6014 pi] + 929484 }
++ *
++ * RFC3526 specifies a generator of 2.
++ */
++static const unsigned char dh6144_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
++    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
++    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
++    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
++    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
++    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
++    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
++    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
++    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
++    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
++    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
++    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
++    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
++    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D,
++    0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
++    0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64,
++    0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
++    0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D,
++    0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
++    0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7,
++    0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
++    0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B,
++    0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
++    0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64,
++    0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
++    0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C,
++    0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
++    0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31,
++    0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
++    0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01,
++    0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
++    0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26,
++    0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
++    0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA,
++    0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
++    0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9,
++    0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
++    0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D,
++    0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
++    0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED,
++    0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
++    0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C,
++    0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
++    0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1,
++    0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
++    0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x02, 0x84, 0x92,
++    0x36, 0xC3, 0xFA, 0xB4, 0xD2, 0x7C, 0x70, 0x26,
++    0xC1, 0xD4, 0xDC, 0xB2, 0x60, 0x26, 0x46, 0xDE,
++    0xC9, 0x75, 0x1E, 0x76, 0x3D, 0xBA, 0x37, 0xBD,
++    0xF8, 0xFF, 0x94, 0x06, 0xAD, 0x9E, 0x53, 0x0E,
++    0xE5, 0xDB, 0x38, 0x2F, 0x41, 0x30, 0x01, 0xAE,
++    0xB0, 0x6A, 0x53, 0xED, 0x90, 0x27, 0xD8, 0x31,
++    0x17, 0x97, 0x27, 0xB0, 0x86, 0x5A, 0x89, 0x18,
++    0xDA, 0x3E, 0xDB, 0xEB, 0xCF, 0x9B, 0x14, 0xED,
++    0x44, 0xCE, 0x6C, 0xBA, 0xCE, 0xD4, 0xBB, 0x1B,
++    0xDB, 0x7F, 0x14, 0x47, 0xE6, 0xCC, 0x25, 0x4B,
++    0x33, 0x20, 0x51, 0x51, 0x2B, 0xD7, 0xAF, 0x42,
++    0x6F, 0xB8, 0xF4, 0x01, 0x37, 0x8C, 0xD2, 0xBF,
++    0x59, 0x83, 0xCA, 0x01, 0xC6, 0x4B, 0x92, 0xEC,
++    0xF0, 0x32, 0xEA, 0x15, 0xD1, 0x72, 0x1D, 0x03,
++    0xF4, 0x82, 0xD7, 0xCE, 0x6E, 0x74, 0xFE, 0xF6,
++    0xD5, 0x5E, 0x70, 0x2F, 0x46, 0x98, 0x0C, 0x82,
++    0xB5, 0xA8, 0x40, 0x31, 0x90, 0x0B, 0x1C, 0x9E,
++    0x59, 0xE7, 0xC9, 0x7F, 0xBE, 0xC7, 0xE8, 0xF3,
++    0x23, 0xA9, 0x7A, 0x7E, 0x36, 0xCC, 0x88, 0xBE,
++    0x0F, 0x1D, 0x45, 0xB7, 0xFF, 0x58, 0x5A, 0xC5,
++    0x4B, 0xD4, 0x07, 0xB2, 0x2B, 0x41, 0x54, 0xAA,
++    0xCC, 0x8F, 0x6D, 0x7E, 0xBF, 0x48, 0xE1, 0xD8,
++    0x14, 0xCC, 0x5E, 0xD2, 0x0F, 0x80, 0x37, 0xE0,
++    0xA7, 0x97, 0x15, 0xEE, 0xF2, 0x9B, 0xE3, 0x28,
++    0x06, 0xA1, 0xD5, 0x8B, 0xB7, 0xC5, 0xDA, 0x76,
++    0xF5, 0x50, 0xAA, 0x3D, 0x8A, 0x1F, 0xBF, 0xF0,
++    0xEB, 0x19, 0xCC, 0xB1, 0xA3, 0x13, 0xD5, 0x5C,
++    0xDA, 0x56, 0xC9, 0xEC, 0x2E, 0xF2, 0x96, 0x32,
++    0x38, 0x7F, 0xE8, 0xD7, 0x6E, 0x3C, 0x04, 0x68,
++    0x04, 0x3E, 0x8F, 0x66, 0x3F, 0x48, 0x60, 0xEE,
++    0x12, 0xBF, 0x2D, 0x5B, 0x0B, 0x74, 0x74, 0xD6,
++    0xE6, 0x94, 0xF9, 0x1E, 0x6D, 0xCC, 0x40, 0x24,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh6144_g[] = {
++    0x02,
++};
++
++static DH *get_dh6144(void)
++{
++    return modssl_dh_configure(dh6144_p, sizeof(dh6144_p),
++                               dh6144_g, sizeof(dh6144_g));
++}
++
++/*
++ * "8192-bit MODP Group" from RFC3526, Section 7.
++ *
++ * The prime is: 2^8192 - 2^8128 - 1 + 2^64 * { [2^8062 pi] + 4743158 }
++ *
++ * RFC3526 specifies a generator of 2.
++ */
++static const unsigned char dh8192_p[] = {
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++    0xC9, 0x0F, 0xDA, 0xA2, 0x21, 0x68, 0xC2, 0x34,
++    0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
++    0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74,
++    0x02, 0x0B, 0xBE, 0xA6, 0x3B, 0x13, 0x9B, 0x22,
++    0x51, 0x4A, 0x08, 0x79, 0x8E, 0x34, 0x04, 0xDD,
++    0xEF, 0x95, 0x19, 0xB3, 0xCD, 0x3A, 0x43, 0x1B,
++    0x30, 0x2B, 0x0A, 0x6D, 0xF2, 0x5F, 0x14, 0x37,
++    0x4F, 0xE1, 0x35, 0x6D, 0x6D, 0x51, 0xC2, 0x45,
++    0xE4, 0x85, 0xB5, 0x76, 0x62, 0x5E, 0x7E, 0xC6,
++    0xF4, 0x4C, 0x42, 0xE9, 0xA6, 0x37, 0xED, 0x6B,
++    0x0B, 0xFF, 0x5C, 0xB6, 0xF4, 0x06, 0xB7, 0xED,
++    0xEE, 0x38, 0x6B, 0xFB, 0x5A, 0x89, 0x9F, 0xA5,
++    0xAE, 0x9F, 0x24, 0x11, 0x7C, 0x4B, 0x1F, 0xE6,
++    0x49, 0x28, 0x66, 0x51, 0xEC, 0xE4, 0x5B, 0x3D,
++    0xC2, 0x00, 0x7C, 0xB8, 0xA1, 0x63, 0xBF, 0x05,
++    0x98, 0xDA, 0x48, 0x36, 0x1C, 0x55, 0xD3, 0x9A,
++    0x69, 0x16, 0x3F, 0xA8, 0xFD, 0x24, 0xCF, 0x5F,
++    0x83, 0x65, 0x5D, 0x23, 0xDC, 0xA3, 0xAD, 0x96,
++    0x1C, 0x62, 0xF3, 0x56, 0x20, 0x85, 0x52, 0xBB,
++    0x9E, 0xD5, 0x29, 0x07, 0x70, 0x96, 0x96, 0x6D,
++    0x67, 0x0C, 0x35, 0x4E, 0x4A, 0xBC, 0x98, 0x04,
++    0xF1, 0x74, 0x6C, 0x08, 0xCA, 0x18, 0x21, 0x7C,
++    0x32, 0x90, 0x5E, 0x46, 0x2E, 0x36, 0xCE, 0x3B,
++    0xE3, 0x9E, 0x77, 0x2C, 0x18, 0x0E, 0x86, 0x03,
++    0x9B, 0x27, 0x83, 0xA2, 0xEC, 0x07, 0xA2, 0x8F,
++    0xB5, 0xC5, 0x5D, 0xF0, 0x6F, 0x4C, 0x52, 0xC9,
++    0xDE, 0x2B, 0xCB, 0xF6, 0x95, 0x58, 0x17, 0x18,
++    0x39, 0x95, 0x49, 0x7C, 0xEA, 0x95, 0x6A, 0xE5,
++    0x15, 0xD2, 0x26, 0x18, 0x98, 0xFA, 0x05, 0x10,
++    0x15, 0x72, 0x8E, 0x5A, 0x8A, 0xAA, 0xC4, 0x2D,
++    0xAD, 0x33, 0x17, 0x0D, 0x04, 0x50, 0x7A, 0x33,
++    0xA8, 0x55, 0x21, 0xAB, 0xDF, 0x1C, 0xBA, 0x64,
++    0xEC, 0xFB, 0x85, 0x04, 0x58, 0xDB, 0xEF, 0x0A,
++    0x8A, 0xEA, 0x71, 0x57, 0x5D, 0x06, 0x0C, 0x7D,
++    0xB3, 0x97, 0x0F, 0x85, 0xA6, 0xE1, 0xE4, 0xC7,
++    0xAB, 0xF5, 0xAE, 0x8C, 0xDB, 0x09, 0x33, 0xD7,
++    0x1E, 0x8C, 0x94, 0xE0, 0x4A, 0x25, 0x61, 0x9D,
++    0xCE, 0xE3, 0xD2, 0x26, 0x1A, 0xD2, 0xEE, 0x6B,
++    0xF1, 0x2F, 0xFA, 0x06, 0xD9, 0x8A, 0x08, 0x64,
++    0xD8, 0x76, 0x02, 0x73, 0x3E, 0xC8, 0x6A, 0x64,
++    0x52, 0x1F, 0x2B, 0x18, 0x17, 0x7B, 0x20, 0x0C,
++    0xBB, 0xE1, 0x17, 0x57, 0x7A, 0x61, 0x5D, 0x6C,
++    0x77, 0x09, 0x88, 0xC0, 0xBA, 0xD9, 0x46, 0xE2,
++    0x08, 0xE2, 0x4F, 0xA0, 0x74, 0xE5, 0xAB, 0x31,
++    0x43, 0xDB, 0x5B, 0xFC, 0xE0, 0xFD, 0x10, 0x8E,
++    0x4B, 0x82, 0xD1, 0x20, 0xA9, 0x21, 0x08, 0x01,
++    0x1A, 0x72, 0x3C, 0x12, 0xA7, 0x87, 0xE6, 0xD7,
++    0x88, 0x71, 0x9A, 0x10, 0xBD, 0xBA, 0x5B, 0x26,
++    0x99, 0xC3, 0x27, 0x18, 0x6A, 0xF4, 0xE2, 0x3C,
++    0x1A, 0x94, 0x68, 0x34, 0xB6, 0x15, 0x0B, 0xDA,
++    0x25, 0x83, 0xE9, 0xCA, 0x2A, 0xD4, 0x4C, 0xE8,
++    0xDB, 0xBB, 0xC2, 0xDB, 0x04, 0xDE, 0x8E, 0xF9,
++    0x2E, 0x8E, 0xFC, 0x14, 0x1F, 0xBE, 0xCA, 0xA6,
++    0x28, 0x7C, 0x59, 0x47, 0x4E, 0x6B, 0xC0, 0x5D,
++    0x99, 0xB2, 0x96, 0x4F, 0xA0, 0x90, 0xC3, 0xA2,
++    0x23, 0x3B, 0xA1, 0x86, 0x51, 0x5B, 0xE7, 0xED,
++    0x1F, 0x61, 0x29, 0x70, 0xCE, 0xE2, 0xD7, 0xAF,
++    0xB8, 0x1B, 0xDD, 0x76, 0x21, 0x70, 0x48, 0x1C,
++    0xD0, 0x06, 0x91, 0x27, 0xD5, 0xB0, 0x5A, 0xA9,
++    0x93, 0xB4, 0xEA, 0x98, 0x8D, 0x8F, 0xDD, 0xC1,
++    0x86, 0xFF, 0xB7, 0xDC, 0x90, 0xA6, 0xC0, 0x8F,
++    0x4D, 0xF4, 0x35, 0xC9, 0x34, 0x02, 0x84, 0x92,
++    0x36, 0xC3, 0xFA, 0xB4, 0xD2, 0x7C, 0x70, 0x26,
++    0xC1, 0xD4, 0xDC, 0xB2, 0x60, 0x26, 0x46, 0xDE,
++    0xC9, 0x75, 0x1E, 0x76, 0x3D, 0xBA, 0x37, 0xBD,
++    0xF8, 0xFF, 0x94, 0x06, 0xAD, 0x9E, 0x53, 0x0E,
++    0xE5, 0xDB, 0x38, 0x2F, 0x41, 0x30, 0x01, 0xAE,
++    0xB0, 0x6A, 0x53, 0xED, 0x90, 0x27, 0xD8, 0x31,
++    0x17, 0x97, 0x27, 0xB0, 0x86, 0x5A, 0x89, 0x18,
++    0xDA, 0x3E, 0xDB, 0xEB, 0xCF, 0x9B, 0x14, 0xED,
++    0x44, 0xCE, 0x6C, 0xBA, 0xCE, 0xD4, 0xBB, 0x1B,
++    0xDB, 0x7F, 0x14, 0x47, 0xE6, 0xCC, 0x25, 0x4B,
++    0x33, 0x20, 0x51, 0x51, 0x2B, 0xD7, 0xAF, 0x42,
++    0x6F, 0xB8, 0xF4, 0x01, 0x37, 0x8C, 0xD2, 0xBF,
++    0x59, 0x83, 0xCA, 0x01, 0xC6, 0x4B, 0x92, 0xEC,
++    0xF0, 0x32, 0xEA, 0x15, 0xD1, 0x72, 0x1D, 0x03,
++    0xF4, 0x82, 0xD7, 0xCE, 0x6E, 0x74, 0xFE, 0xF6,
++    0xD5, 0x5E, 0x70, 0x2F, 0x46, 0x98, 0x0C, 0x82,
++    0xB5, 0xA8, 0x40, 0x31, 0x90, 0x0B, 0x1C, 0x9E,
++    0x59, 0xE7, 0xC9, 0x7F, 0xBE, 0xC7, 0xE8, 0xF3,
++    0x23, 0xA9, 0x7A, 0x7E, 0x36, 0xCC, 0x88, 0xBE,
++    0x0F, 0x1D, 0x45, 0xB7, 0xFF, 0x58, 0x5A, 0xC5,
++    0x4B, 0xD4, 0x07, 0xB2, 0x2B, 0x41, 0x54, 0xAA,
++    0xCC, 0x8F, 0x6D, 0x7E, 0xBF, 0x48, 0xE1, 0xD8,
++    0x14, 0xCC, 0x5E, 0xD2, 0x0F, 0x80, 0x37, 0xE0,
++    0xA7, 0x97, 0x15, 0xEE, 0xF2, 0x9B, 0xE3, 0x28,
++    0x06, 0xA1, 0xD5, 0x8B, 0xB7, 0xC5, 0xDA, 0x76,
++    0xF5, 0x50, 0xAA, 0x3D, 0x8A, 0x1F, 0xBF, 0xF0,
++    0xEB, 0x19, 0xCC, 0xB1, 0xA3, 0x13, 0xD5, 0x5C,
++    0xDA, 0x56, 0xC9, 0xEC, 0x2E, 0xF2, 0x96, 0x32,
++    0x38, 0x7F, 0xE8, 0xD7, 0x6E, 0x3C, 0x04, 0x68,
++    0x04, 0x3E, 0x8F, 0x66, 0x3F, 0x48, 0x60, 0xEE,
++    0x12, 0xBF, 0x2D, 0x5B, 0x0B, 0x74, 0x74, 0xD6,
++    0xE6, 0x94, 0xF9, 0x1E, 0x6D, 0xBE, 0x11, 0x59,
++    0x74, 0xA3, 0x92, 0x6F, 0x12, 0xFE, 0xE5, 0xE4,
++    0x38, 0x77, 0x7C, 0xB6, 0xA9, 0x32, 0xDF, 0x8C,
++    0xD8, 0xBE, 0xC4, 0xD0, 0x73, 0xB9, 0x31, 0xBA,
++    0x3B, 0xC8, 0x32, 0xB6, 0x8D, 0x9D, 0xD3, 0x00,
++    0x74, 0x1F, 0xA7, 0xBF, 0x8A, 0xFC, 0x47, 0xED,
++    0x25, 0x76, 0xF6, 0x93, 0x6B, 0xA4, 0x24, 0x66,
++    0x3A, 0xAB, 0x63, 0x9C, 0x5A, 0xE4, 0xF5, 0x68,
++    0x34, 0x23, 0xB4, 0x74, 0x2B, 0xF1, 0xC9, 0x78,
++    0x23, 0x8F, 0x16, 0xCB, 0xE3, 0x9D, 0x65, 0x2D,
++    0xE3, 0xFD, 0xB8, 0xBE, 0xFC, 0x84, 0x8A, 0xD9,
++    0x22, 0x22, 0x2E, 0x04, 0xA4, 0x03, 0x7C, 0x07,
++    0x13, 0xEB, 0x57, 0xA8, 0x1A, 0x23, 0xF0, 0xC7,
++    0x34, 0x73, 0xFC, 0x64, 0x6C, 0xEA, 0x30, 0x6B,
++    0x4B, 0xCB, 0xC8, 0x86, 0x2F, 0x83, 0x85, 0xDD,
++    0xFA, 0x9D, 0x4B, 0x7F, 0xA2, 0xC0, 0x87, 0xE8,
++    0x79, 0x68, 0x33, 0x03, 0xED, 0x5B, 0xDD, 0x3A,
++    0x06, 0x2B, 0x3C, 0xF5, 0xB3, 0xA2, 0x78, 0xA6,
++    0x6D, 0x2A, 0x13, 0xF8, 0x3F, 0x44, 0xF8, 0x2D,
++    0xDF, 0x31, 0x0E, 0xE0, 0x74, 0xAB, 0x6A, 0x36,
++    0x45, 0x97, 0xE8, 0x99, 0xA0, 0x25, 0x5D, 0xC1,
++    0x64, 0xF3, 0x1C, 0xC5, 0x08, 0x46, 0x85, 0x1D,
++    0xF9, 0xAB, 0x48, 0x19, 0x5D, 0xED, 0x7E, 0xA1,
++    0xB1, 0xD5, 0x10, 0xBD, 0x7E, 0xE7, 0x4D, 0x73,
++    0xFA, 0xF3, 0x6B, 0xC3, 0x1E, 0xCF, 0xA2, 0x68,
++    0x35, 0x90, 0x46, 0xF4, 0xEB, 0x87, 0x9F, 0x92,
++    0x40, 0x09, 0x43, 0x8B, 0x48, 0x1C, 0x6C, 0xD7,
++    0x88, 0x9A, 0x00, 0x2E, 0xD5, 0xEE, 0x38, 0x2B,
++    0xC9, 0x19, 0x0D, 0xA6, 0xFC, 0x02, 0x6E, 0x47,
++    0x95, 0x58, 0xE4, 0x47, 0x56, 0x77, 0xE9, 0xAA,
++    0x9E, 0x30, 0x50, 0xE2, 0x76, 0x56, 0x94, 0xDF,
++    0xC8, 0x1F, 0x56, 0xE8, 0x80, 0xB9, 0x6E, 0x71,
++    0x60, 0xC9, 0x80, 0xDD, 0x98, 0xED, 0xD3, 0xDF,
++    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
++};
++static const unsigned char dh8192_g[] = {
++    0x02,
++};
++
++static DH *get_dh8192(void)
++{
++    return modssl_dh_configure(dh8192_p, sizeof(dh8192_p),
++                               dh8192_g, sizeof(dh8192_g));
++}
++
++/* Storage and initialization for DH parameters. */
++static struct dhparam {
++    DH *(*const make)(void);          /* function to generate... */
++    DH *dh;                           /* ...this, used for keys.... */
++    const unsigned int min;           /* ...of length >= this. */
++} dhparams[] = {
++    { get_dh8192, NULL, 6145 },
++    { get_dh6144, NULL, 4097 },
++    { get_dh4096, NULL, 3073 },
++    { get_dh3072, NULL, 2049 },
++    { get_dh2048, NULL, 1025 },
++    { get_dh1024, NULL,  513 },
++    { get_dh512,  NULL,    0 }
++};
++
++int ssl_dh_InitParams(server_rec *s)
++{
++    unsigned n;
++
++    for (n = 0; n < sizeof(dhparams)/sizeof(dhparams[0]); n++) {
++        const unsigned int bits =
++            dhparams[n].min ? (dhparams[n].min - 1) * 2 : 512;
++#ifdef HAVE_FIPS
++        if (bits < 1024 && FIPS_mode()) {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                         "Init: Skipping generating temporary "
++                         "%u bit DH parameters in FIPS mode", bits);
++            continue;
++        }
++#endif
++        dhparams[n].dh = dhparams[n].make();
++        if (!dhparams[n].dh) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
++                         "Init: Failed to generate temporary "
++                         "%u bit DH parameters", bits);
++            return !OK;
++        }
++    }
++    return OK;
++}
++
++void ssl_dh_FreeParams(void)
++{
++    unsigned n;
++
++    /* DH_free() is a noop for a NULL parameter, so these are harmless
++     * in the (unexpected) case where these variables are already
++     * NULL. */
++    for (n = 0; n < sizeof(dhparams)/sizeof(dhparams[0]); n++) {
++        DH_free(dhparams[n].dh);
++        dhparams[n].dh = NULL;
++    }
++}
++
++/* Hand out the same DH structure though once generated as we leak
++ * memory otherwise and freeing the structure up after use would be
++ * hard to track and in fact is not needed at all as it is safe to
++ * use the same parameters over and over again security wise (in
++ * contrast to the keys itself) and code safe as the returned structure
++ * is duplicated by OpenSSL anyway. Hence no modification happens
++ * to our copy. */
+ DH *ssl_dh_GetTmpParam(int nKeyLen)
+ {
+-    DH *dh;
++    unsigned n;
+ 
+-    if (nKeyLen == 512)
+-        dh = get_dh512();
+-    else if (nKeyLen == 1024)
+-        dh = get_dh1024();
+-    else
+-        dh = get_dh1024();
+-    return dh;
++    for (n = 0; n < sizeof(dhparams)/sizeof(dhparams[0]); n++)
++        if (nKeyLen >= dhparams[n].min)
++            return dhparams[n].dh;
++        
++    return NULL; /* impossible to reach. */
+ }
+ 
+-DH *ssl_dh_GetParamFromFile(char *file)
++DH *ssl_dh_GetParamFromFile(const char *file)
+ {
+     DH *dh = NULL;
+     BIO *bio;
+@@ -127,6 +689,20 @@
+     return (dh);
+ }
+ 
++#ifndef OPENSSL_NO_EC
++EC_GROUP *ssl_ec_GetParamFromFile(const char *file)
++{
++    EC_GROUP *group = NULL;
++    BIO *bio;
++
++    if ((bio = BIO_new_file(file, "r")) == NULL)
++        return NULL;
++    group = PEM_read_bio_ECPKParameters(bio, NULL, NULL, NULL);
++    BIO_free(bio);
++    return (group);
++}
++#endif
++
+ /*
+ =cut
+ ##
+diff -ur httpd-2.2.29/modules/ssl/ssl_engine_init.c httpd-2.2.29.logjam/modules/ssl/ssl_engine_init.c
+--- httpd-2.2.29/modules/ssl/ssl_engine_init.c	2014-07-15 23:04:38.000000000 -0700
++++ httpd-2.2.29.logjam/modules/ssl/ssl_engine_init.c	2015-06-05 11:52:23.000000000 -0700
+@@ -51,161 +51,6 @@
+                  modver, AP_SERVER_BASEVERSION, incver);
+ }
+ 
+-
+-/*
+- * Handle the Temporary RSA Keys and DH Params
+- */
+-
+-#define MODSSL_TMP_KEY_FREE(mc, type, idx) \
+-    if (mc->pTmpKeys[idx]) { \
+-        type##_free((type *)mc->pTmpKeys[idx]); \
+-        mc->pTmpKeys[idx] = NULL; \
+-    }
+-
+-#define MODSSL_TMP_KEYS_FREE(mc, type) \
+-    MODSSL_TMP_KEY_FREE(mc, type, SSL_TMP_KEY_##type##_512); \
+-    MODSSL_TMP_KEY_FREE(mc, type, SSL_TMP_KEY_##type##_1024)
+-
+-static void ssl_tmp_keys_free(server_rec *s)
+-{
+-    SSLModConfigRec *mc = myModConfig(s);
+-
+-    MODSSL_TMP_KEYS_FREE(mc, RSA);
+-    MODSSL_TMP_KEYS_FREE(mc, DH);
+-#ifndef OPENSSL_NO_EC
+-    MODSSL_TMP_KEY_FREE(mc, EC_KEY, SSL_TMP_KEY_EC_256);
+-#endif
+-}
+-
+-static int ssl_tmp_key_init_rsa(server_rec *s,
+-                                int bits, int idx)
+-{
+-    SSLModConfigRec *mc = myModConfig(s);
+-
+-#ifdef HAVE_FIPS
+-
+-    if (FIPS_mode() && bits < 1024) {
+-        mc->pTmpKeys[idx] = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+-                     "Init: Skipping generating temporary "
+-                     "%d bit RSA private key in FIPS mode", bits);
+-        return OK;
+-    }
+-
+-#endif
+-
+-    if (!(mc->pTmpKeys[idx] =
+-          RSA_generate_key(bits, RSA_F4, NULL, NULL)))
+-    {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                     "Init: Failed to generate temporary "
+-                     "%d bit RSA private key", bits);
+-        ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, s);
+-        return !OK;
+-    }
+-
+-    return OK;
+-}
+-
+-static int ssl_tmp_key_init_dh(server_rec *s,
+-                               int bits, int idx)
+-{
+-    SSLModConfigRec *mc = myModConfig(s);
+-
+-#ifdef HAVE_FIPS
+-
+-    if (FIPS_mode() && bits < 1024) {
+-        mc->pTmpKeys[idx] = NULL;
+-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+-                     "Init: Skipping generating temporary "
+-                     "%d bit DH parameters in FIPS mode", bits);
+-        return OK;
+-    }
+-
+-#endif
+-
+-    if (!(mc->pTmpKeys[idx] =
+-          ssl_dh_GetTmpParam(bits)))
+-    {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                     "Init: Failed to generate temporary "
+-                     "%d bit DH parameters", bits);
+-        return !OK;
+-    }
+-
+-    return OK;
+-}
+-
+-#ifndef OPENSSL_NO_EC
+-static int ssl_tmp_key_init_ec(server_rec *s,
+-                               int bits, int idx)
+-{
+-    SSLModConfigRec *mc = myModConfig(s);
+-    EC_KEY *ecdh = NULL;
+-
+-    /* XXX: Are there any FIPS constraints we should enforce? */
+-
+-    if (bits != 256) {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                     "Init: Failed to generate temporary "
+-                     "%d bit EC parameters, only 256 bits supported", bits);
+-        return !OK;
+-    }
+-
+-    if ((ecdh = EC_KEY_new()) == NULL ||
+-        EC_KEY_set_group(ecdh, EC_GROUP_new_by_curve_name(NID_X9_62_prime256v1)) != 1)
+-    {
+-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+-                     "Init: Failed to generate temporary "
+-                     "%d bit EC parameters", bits);
+-        return !OK;
+-    }
+-
+-    mc->pTmpKeys[idx] = ecdh;
+-    return OK;
+-}
+-
+-#define MODSSL_TMP_KEY_INIT_EC(s, bits) \
+-    ssl_tmp_key_init_ec(s, bits, SSL_TMP_KEY_EC_##bits)
+-
+-#endif
+-
+-#define MODSSL_TMP_KEY_INIT_RSA(s, bits) \
+-    ssl_tmp_key_init_rsa(s, bits, SSL_TMP_KEY_RSA_##bits)
+-
+-#define MODSSL_TMP_KEY_INIT_DH(s, bits) \
+-    ssl_tmp_key_init_dh(s, bits, SSL_TMP_KEY_DH_##bits)
+-
+-static int ssl_tmp_keys_init(server_rec *s)
+-{
+-    ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+-                 "Init: Generating temporary RSA private keys (512/1024 bits)");
+-
+-    if (MODSSL_TMP_KEY_INIT_RSA(s, 512) ||
+-        MODSSL_TMP_KEY_INIT_RSA(s, 1024)) {
+-        return !OK;
+-    }
+-
+-    ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+-                 "Init: Generating temporary DH parameters (512/1024 bits)");
+-
+-    if (MODSSL_TMP_KEY_INIT_DH(s, 512) ||
+-        MODSSL_TMP_KEY_INIT_DH(s, 1024)) {
+-        return !OK;
+-    }
+-
+-#ifndef OPENSSL_NO_EC
+-    ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+-                 "Init: Generating temporary EC parameters (256 bits)");
+-
+-    if (MODSSL_TMP_KEY_INIT_EC(s, 256)) {
+-        return !OK;
+-    }
+-#endif
+-
+-    return OK;
+-}
+-
+ /*
+  *  Per-module initialization
+  */
+@@ -335,7 +180,7 @@
+      */
+     ssl_pphrase_Handle(base_server, ptemp);
+ 
+-    if (ssl_tmp_keys_init(base_server)) {
++    if (ssl_dh_InitParams(base_server)) {
+         return !OK;
+     }
+ 
+@@ -607,6 +452,9 @@
+      * Configure additional context ingredients
+      */
+     SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE);
++#ifndef OPENSSL_NO_EC
++    SSL_CTX_set_options(ctx, SSL_OP_SINGLE_ECDH_USE);
++#endif
+ 
+ #ifdef SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
+     /*
+@@ -647,11 +495,7 @@
+ {
+     SSL_CTX *ctx = mctx->ssl_ctx;
+ 
+-    SSL_CTX_set_tmp_rsa_callback(ctx, ssl_callback_TmpRSA);
+     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
+-#ifndef OPENSSL_NO_EC
+-    SSL_CTX_set_tmp_ecdh_callback(ctx,ssl_callback_TmpECDH);
+-#endif
+ 
+     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
+ }
+@@ -747,14 +591,18 @@
+                                       modssl_ctx_t *mctx)
+ {
+     SSL_CTX *ctx = mctx->ssl_ctx;
+-    const char *suite = mctx->auth.cipher_suite;
++    const char *suite;
+ 
+     /*
+-     *  Configure SSL Cipher Suite
+-     */
+-    if (!suite) {
+-        return;
+-    }
++     *  Configure SSL Cipher Suite. Always disable NULL and export ciphers,
++     *  see also ssl_engine_config.c:ssl_cmd_SSLCipherSuite().
++     *  OpenSSL's SSL_DEFAULT_CIPHER_LIST includes !aNULL:!eNULL from 0.9.8f,
++     *  and !EXP from 0.9.8zf/1.0.1m/1.0.2a, so prepend them while we support
++     *  earlier versions.
++     */
++    suite = mctx->auth.cipher_suite ? mctx->auth.cipher_suite :
++            apr_pstrcat(ptemp, "!aNULL:!eNULL:!EXP:", SSL_DEFAULT_CIPHER_LIST,
++                        NULL);
+ 
+     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+                  "Configuring permitted SSL ciphers [%s]",
+@@ -1041,10 +889,14 @@
+     const char *rsa_id, *dsa_id;
+ #ifndef OPENSSL_NO_EC
+     const char *ecc_id;
++    EC_GROUP *ecparams;
++    int nid;
++    EC_KEY *eckey = NULL;
+ #endif
+     const char *vhost_id = mctx->sc->vhost_id;
+     int i;
+     int have_rsa, have_dsa;
++    DH *dhparams;
+ #ifndef OPENSSL_NO_EC
+     int have_ecc;
+ #endif
+@@ -1099,6 +951,46 @@
+ #endif
+         ssl_die();
+     }
++
++    /*
++     * Try to read DH parameters from the (first) SSLCertificateFile
++     */
++    if ((mctx->pks->cert_files[0] != NULL) &&
++        (dhparams = ssl_dh_GetParamFromFile(mctx->pks->cert_files[0]))) {
++        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
++        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                     "Custom DH parameters (%d bits) for %s loaded from %s",
++                     BN_num_bits(dhparams->p), vhost_id,
++                     mctx->pks->cert_files[0]);
++    }
++
++#ifndef OPENSSL_NO_EC
++    /*
++     * Similarly, try to read the ECDH curve name from SSLCertificateFile...
++     */
++    if ((mctx->pks->cert_files[0] != NULL) &&
++        (ecparams = ssl_ec_GetParamFromFile(mctx->pks->cert_files[0])) &&
++        (nid = EC_GROUP_get_curve_name(ecparams)) &&
++        (eckey = EC_KEY_new_by_curve_name(nid))) {
++        SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
++        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
++                     "ECDH curve %s for %s specified in %s",
++                     OBJ_nid2sn(nid), vhost_id, mctx->pks->cert_files[0]);
++    }
++    /*
++     * ...otherwise, enable auto curve selection (OpenSSL 1.0.2 and later)
++     * or configure NIST P-256 (required to enable ECDHE for earlier versions)
++     */
++    else {
++#if defined(SSL_CTX_set_ecdh_auto)
++        SSL_CTX_set_ecdh_auto(mctx->ssl_ctx, 1);
++#else
++        eckey = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
++        SSL_CTX_set_tmp_ecdh(mctx->ssl_ctx, eckey);
++#endif
++    }
++    EC_KEY_free(eckey);
++#endif
+ }
+ 
+ static void ssl_init_proxy_certs(server_rec *s,
+@@ -1569,7 +1461,7 @@
+     /*
+      * Destroy the temporary keys and params
+      */
+-    ssl_tmp_keys_free(base_server);
++    ssl_dh_FreeParams();
+ 
+     /*
+      * Free the non-pool allocated structures
+Only in httpd-2.2.29.logjam/modules/ssl: ssl_engine_init.c.orig
+diff -ur httpd-2.2.29/modules/ssl/ssl_engine_kernel.c httpd-2.2.29.logjam/modules/ssl/ssl_engine_kernel.c
+--- httpd-2.2.29/modules/ssl/ssl_engine_kernel.c	2014-03-12 05:32:51.000000000 -0700
++++ httpd-2.2.29.logjam/modules/ssl/ssl_engine_kernel.c	2015-06-05 11:52:23.000000000 -0700
+@@ -1187,117 +1187,48 @@
+ */
+ 
+ /*
+- * Handle out temporary RSA private keys on demand
+- *
+- * The background of this as the TLSv1 standard explains it:
+- *
+- * | D.1. Temporary RSA keys
+- * |
+- * |    US Export restrictions limit RSA keys used for encryption to 512
+- * |    bits, but do not place any limit on lengths of RSA keys used for
+- * |    signing operations. Certificates often need to be larger than 512
+- * |    bits, since 512-bit RSA keys are not secure enough for high-value
+- * |    transactions or for applications requiring long-term security. Some
+- * |    certificates are also designated signing-only, in which case they
+- * |    cannot be used for key exchange.
+- * |
+- * |    When the public key in the certificate cannot be used for encryption,
+- * |    the server signs a temporary RSA key, which is then exchanged. In
+- * |    exportable applications, the temporary RSA key should be the maximum
+- * |    allowable length (i.e., 512 bits). Because 512-bit RSA keys are
+- * |    relatively insecure, they should be changed often. For typical
+- * |    electronic commerce applications, it is suggested that keys be
+- * |    changed daily or every 500 transactions, and more often if possible.
+- * |    Note that while it is acceptable to use the same temporary key for
+- * |    multiple transactions, it must be signed each time it is used.
+- * |
+- * |    RSA key generation is a time-consuming process. In many cases, a
+- * |    low-priority process can be assigned the task of key generation.
+- * |    Whenever a new key is completed, the existing temporary key can be
+- * |    replaced with the new one.
+- *
+- * XXX: base on comment above, if thread support is enabled,
+- * we should spawn a low-priority thread to generate new keys
+- * on the fly.
+- *
+- * So we generated 512 and 1024 bit temporary keys on startup
+- * which we now just hand out on demand....
+- */
+-
+-RSA *ssl_callback_TmpRSA(SSL *ssl, int export, int keylen)
+-{
+-    conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
+-    int idx;
+-
+-    ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+-                  "handing out temporary %d bit RSA key", keylen);
+-
+-    /* doesn't matter if export flag is on,
+-     * we won't be asked for keylen > 512 in that case.
+-     * if we are asked for a keylen > 1024, it is too expensive
+-     * to generate on the fly.
+-     * XXX: any reason not to generate 2048 bit keys at startup?
+-     */
+-
+-    switch (keylen) {
+-      case 512:
+-        idx = SSL_TMP_KEY_RSA_512;
+-        break;
+-
+-      case 1024:
+-      default:
+-        idx = SSL_TMP_KEY_RSA_1024;
+-    }
+-
+-    return (RSA *)mc->pTmpKeys[idx];
+-}
+-
+-/*
+  * Hand out the already generated DH parameters...
++ * Based on the authentication strength.
+  */
+ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
+ {
+     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
+-    int idx;
++    EVP_PKEY *pkey;
++    int type;
+ 
+     ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+-                  "handing out temporary %d bit DH key", keylen);
++                  "handing out built-in DH parameters for %d-bit "
++                  "authenticated connection", keylen);
+ 
+-    switch (keylen) {
+-      case 512:
+-        idx = SSL_TMP_KEY_DH_512;
+-        break;
+-
+-      case 1024:
+-      default:
+-        idx = SSL_TMP_KEY_DH_1024;
+-    }
+-
+-    return (DH *)mc->pTmpKeys[idx];
+-}
+-
+-#ifndef OPENSSL_NO_EC
+-EC_KEY *ssl_callback_TmpECDH(SSL *ssl, int export, int keylen)
+-{
+-    conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
+-    SSLModConfigRec *mc = myModConfigFromConn(c);
+-    int idx;
+-
+-    /* XXX Uses 256-bit key for now. TODO: support other sizes. */
+-    ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+-                  "handing out temporary 256 bit ECC key");
++#ifdef SSL_CERT_SET_SERVER
++    /*
++     * When multiple certs/keys are configured for the SSL_CTX: make sure
++     * that we get the private key which is indeed used for the current
++     * SSL connection (available in OpenSSL 1.0.2 or later only)
++     */
++    SSL_set_current_cert(ssl, SSL_CERT_SET_SERVER);
++#endif
++    pkey = SSL_get_privatekey(ssl);
++    type = pkey ? EVP_PKEY_type(pkey->type) : EVP_PKEY_NONE;
+ 
+-    switch (keylen) {
+-      case 256:
+-      default:
+-        idx = SSL_TMP_KEY_EC_256;
++    /*
++     * OpenSSL will call us with either keylen == 512 or keylen == 1024
++     * (see the definition of SSL_EXPORT_PKEYLENGTH in ssl_locl.h).
++     * Adjust the DH parameter length according to the size of the
++     * RSA/DSA private key used for the current connection, and always
++     * use at least 1024-bit parameters.
++     * Note: This may cause interoperability issues with implementations
++     * which limit their DH support to 1024 bit - e.g. Java 7 and earlier.
++     * In this case, SSLCertificateFile can be used to specify fixed
++     * 1024-bit DH parameters (with the effect that OpenSSL skips this
++     * callback).
++     */
++    if ((type == EVP_PKEY_RSA) || (type == EVP_PKEY_DSA)) {
++        keylen = EVP_PKEY_bits(pkey);
+     }
+ 
+-    return (EC_KEY *)mc->pTmpKeys[idx];
++    return ssl_dh_GetTmpParam(keylen);
+ }
+-#endif
+ 
+ /*
+  * This OpenSSL callback function is called when OpenSSL
+diff -ur httpd-2.2.29/modules/ssl/ssl_private.h httpd-2.2.29.logjam/modules/ssl/ssl_private.h
+--- httpd-2.2.29/modules/ssl/ssl_private.h	2013-11-11 06:00:57.000000000 -0800
++++ httpd-2.2.29.logjam/modules/ssl/ssl_private.h	2015-06-05 11:52:23.000000000 -0700
+@@ -207,22 +207,6 @@
+ #define SSL_AIDX_MAX     (2)
+ #endif
+ 
+-
+-/**
+- * Define IDs for the temporary RSA keys and DH params
+- */
+-
+-#define SSL_TMP_KEY_RSA_512  (0)
+-#define SSL_TMP_KEY_RSA_1024 (1)
+-#define SSL_TMP_KEY_DH_512   (2)
+-#define SSL_TMP_KEY_DH_1024  (3)
+-#ifndef OPENSSL_NO_EC
+-#define SSL_TMP_KEY_EC_256   (4)
+-#define SSL_TMP_KEY_MAX      (5)
+-#else
+-#define SSL_TMP_KEY_MAX      (4)
+-#endif
+-
+ /**
+  * Define the SSL options
+  */
+@@ -431,7 +415,6 @@
+     apr_global_mutex_t   *pMutex;
+     apr_array_header_t   *aRandSeed;
+     apr_hash_t     *tVHostKeys;
+-    void           *pTmpKeys[SSL_TMP_KEY_MAX];
+     apr_hash_t     *tPublicCert;
+     apr_hash_t     *tPrivateKey;
+ #if defined(HAVE_OPENSSL_ENGINE_H) && defined(HAVE_ENGINE_INIT)
+@@ -638,11 +621,7 @@
+ void         ssl_hook_ConfigTest(apr_pool_t *pconf, server_rec *s);
+ 
+ /**  OpenSSL callbacks */
+-RSA         *ssl_callback_TmpRSA(SSL *, int, int);
+ DH          *ssl_callback_TmpDH(SSL *, int, int);
+-#ifndef OPENSSL_NO_EC
+-EC_KEY      *ssl_callback_TmpECDH(SSL *, int, int);
+-#endif
+ int          ssl_callback_SSLVerify(int, X509_STORE_CTX *);
+ int          ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX *, conn_rec *);
+ int          ssl_callback_proxy_cert(SSL *ssl, MODSSL_CLIENT_CERT_CB_ARG_TYPE **x509, EVP_PKEY **pkey);
+@@ -717,8 +696,13 @@
+ void         ssl_pphrase_Handle(server_rec *, apr_pool_t *);
+ 
+ /**  Diffie-Hellman Parameter Support  */
+-DH           *ssl_dh_GetTmpParam(int);
+-DH           *ssl_dh_GetParamFromFile(char *);
++DH          *ssl_dh_GetTmpParam(int);
++DH          *ssl_dh_GetParamFromFile(const char *);
++#ifndef OPENSSL_NO_EC
++EC_GROUP    *ssl_ec_GetParamFromFile(const char *);
++#endif
++int          ssl_dh_InitParams(server_rec *);
++void         ssl_dh_FreeParams(void);
+ 
+ unsigned char *ssl_asn1_table_set(apr_hash_t *table,
+                                   const char *key,
+Only in httpd-2.2.29.logjam/modules/ssl: ssl_private.h.orig
+diff -ur httpd-2.2.29/modules/ssl/ssl_util_ssl.c httpd-2.2.29.logjam/modules/ssl/ssl_util_ssl.c
+--- httpd-2.2.29/modules/ssl/ssl_util_ssl.c	2012-08-17 10:30:46.000000000 -0700
++++ httpd-2.2.29.logjam/modules/ssl/ssl_util_ssl.c	2015-06-05 11:52:23.000000000 -0700
+@@ -582,8 +582,8 @@
+ #define SSLC_VERSION_NUMBER 0x0000
+ #endif
+ 
+-DH *modssl_dh_configure(unsigned char *p, int plen,
+-                        unsigned char *g, int glen)
++DH *modssl_dh_configure(const unsigned char *p, int plen,
++                        const unsigned char *g, int glen)
+ {
+     DH *dh;
+ 
+diff -ur httpd-2.2.29/modules/ssl/ssl_util_ssl.h httpd-2.2.29.logjam/modules/ssl/ssl_util_ssl.h
+--- httpd-2.2.29/modules/ssl/ssl_util_ssl.h	2012-08-17 10:30:46.000000000 -0700
++++ httpd-2.2.29.logjam/modules/ssl/ssl_util_ssl.h	2015-06-05 11:52:23.000000000 -0700
+@@ -95,8 +95,8 @@
+ /** util functions for OpenSSL+sslc compat */
+ int modssl_session_get_time(SSL_SESSION *session);
+ 
+-DH *modssl_dh_configure(unsigned char *p, int plen,
+-                        unsigned char *g, int glen);
++DH *modssl_dh_configure(const unsigned char *p, int plen,
++                        const unsigned char *g, int glen);
+ 
+ #endif /* __SSL_UTIL_SSL_H__ */
+ /** @} */
--- pe-httpd-2.2.29.orig/debian/patches/079_polish_translation.dpatch
+++ pe-httpd-2.2.29/debian/patches/079_polish_translation.dpatch
@@ -0,0 +1,19 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 079_polish_translation.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: #570228
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/docs/error/HTTP_NOT_FOUND.html.var trunk/docs/error/HTTP_NOT_FOUND.html.var
+--- trunk~/docs/error/HTTP_NOT_FOUND.html.var	2005-11-13 14:22:28.000000000 +0100
++++ trunk/docs/error/HTTP_NOT_FOUND.html.var	2010-02-20 11:37:08.229021346 +0100
+@@ -292,7 +292,7 @@
+     o problemie.
+ 
+   <!--#else -->
+-    Je¶li wpisa³e¶ URLa rêcznie, sprawd¼, czy nie siê nie pomyli³e¶.
++    Je¶li wpisa³e¶ URLa rêcznie, sprawd¼, czy siê nie pomyli³e¶.
+ 
+   <!--#endif -->
+ 
--- pe-httpd-2.2.29.orig/debian/patches/082_ab_num_requests.dpatch
+++ pe-httpd-2.2.29/debian/patches/082_ab_num_requests.dpatch
@@ -0,0 +1,45 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 082_ab_num_requests.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Upstream r940526, Debian bug #541158
+
+@DPATCH@
+diff -urNad trunk~/support/ab.c trunk/support/ab.c
+--- trunk~/support/ab.c	2010-07-16 22:17:41.697762479 +0200
++++ trunk/support/ab.c	2010-07-16 22:17:45.661763246 +0200
+@@ -628,6 +628,10 @@
+ 
+ static void write_request(struct connection * c)
+ {
++    if (started >= requests) {
++        return;
++    }
++
+     do {
+         apr_time_t tnow;
+         apr_size_t l = c->rwrite;
+@@ -690,6 +694,7 @@
+         new_pollfd.client_data = c;
+         apr_pollset_add(readbits, &new_pollfd);
+     }
++    started++;
+ }
+ 
+ /* --------------------------------------------------------- */
+@@ -1239,7 +1244,6 @@
+ 
+     /* connected first time */
+     c->state = STATE_CONNECTED;
+-    started++;
+ #ifdef USE_SSL
+     if (c->ssl) {
+         ssl_proceed_handshake(c);
+@@ -1766,7 +1770,6 @@
+                     }
+                     else {
+                         c->state = STATE_CONNECTED;
+-                        started++;
+ #ifdef USE_SSL
+                         if (c->ssl)
+                             ssl_proceed_handshake(c);
--- pe-httpd-2.2.29.orig/debian/patches/034_apxs2_libtool_fixtastic
+++ pe-httpd-2.2.29/debian/patches/034_apxs2_libtool_fixtastic
@@ -0,0 +1,26 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 034_apxs2_libtool_fixtastic by Peter Samuelson <peter@p12n.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Make libtool happier
+
+--- support/apxs.in
++++ apache2/support/apxs.in
+@@ -409,7 +409,7 @@
+         $la =~ s|\.c$|.la|;
+         my $o = $s;
+         $o =~ s|\.c$|.o|;
+-        push(@cmds, "$libtool $ltflags --mode=compile $CFG_CC $cflags -I$CFG_INCLUDEDIR $apr_includedir $apu_includedir $opt -c -o $lo $s && touch $slo");
++        push(@cmds, "$libtool $ltflags --mode=compile --tag=disable-static $CFG_CC $cflags -I$CFG_INCLUDEDIR $apr_includedir $apu_includedir $opt -c -o $lo $s && touch $slo");
+         unshift(@objs, $lo);
+     }
+ 
+@@ -446,7 +446,7 @@
+         $opt .= " -rpath $CFG_LIBEXECDIR -module -avoid-version $apr_ldflags";
+     }
+ 
+-    push(@cmds, "$libtool $ltflags --mode=link $CFG_CC -o $dso_file $opt $lo");
++    push(@cmds, "$libtool $ltflags --mode=link --tag=disable-static $CFG_CC -o $dso_file $opt $lo");
+ 
+     #   execute the commands
+     &execute_cmds(@cmds);
--- pe-httpd-2.2.29.orig/debian/patches/099_config_guess_sub_update.dpatch
+++ pe-httpd-2.2.29/debian/patches/099_config_guess_sub_update.dpatch
@@ -0,0 +1,3123 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 099_config_guess_sub_update.dpatch by  <tfheen@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad apache2-2.2.3~/config.guess apache2-2.2.3/config.guess
+--- apache2-2.2.3~/config.guess	1970-01-01 01:00:00.000000000 +0100
++++ apache2-2.2.3/config.guess	2006-09-27 21:50:35.000000000 +0200
+@@ -0,0 +1,1500 @@
++#! /bin/sh
++# Attempt to guess a canonical system name.
++#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
++#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
++#   Inc.
++
++timestamp='2006-07-02'
++
++# This file is free software; you can redistribute it and/or modify it
++# under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful, but
++# WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++# General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
++# 02110-1301, USA.
++#
++# As a special exception to the GNU General Public License, if you
++# distribute this file as part of a program that contains a
++# configuration script generated by Autoconf, you may include it under
++# the same distribution terms that you use for the rest of that program.
++
++
++# Originally written by Per Bothner <per@bothner.com>.
++# Please send patches to <config-patches@gnu.org>.  Submit a context
++# diff and a properly formatted ChangeLog entry.
++#
++# This script attempts to guess a canonical system name similar to
++# config.sub.  If it succeeds, it prints the system name on stdout, and
++# exits with 0.  Otherwise, it exits with 1.
++#
++# The plan is that this can be called by configure scripts if you
++# don't specify an explicit build system type.
++
++me=`echo "$0" | sed -e 's,.*/,,'`
++
++usage="\
++Usage: $0 [OPTION]
++
++Output the configuration name of the system \`$me' is run on.
++
++Operation modes:
++  -h, --help         print this help, then exit
++  -t, --time-stamp   print date of last modification, then exit
++  -v, --version      print version number, then exit
++
++Report bugs and patches to <config-patches@gnu.org>."
++
++version="\
++GNU config.guess ($timestamp)
++
++Originally written by Per Bothner.
++Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
++Free Software Foundation, Inc.
++
++This is free software; see the source for copying conditions.  There is NO
++warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
++
++help="
++Try \`$me --help' for more information."
++
++# Parse command line
++while test $# -gt 0 ; do
++  case $1 in
++    --time-stamp | --time* | -t )
++       echo "$timestamp" ; exit ;;
++    --version | -v )
++       echo "$version" ; exit ;;
++    --help | --h* | -h )
++       echo "$usage"; exit ;;
++    -- )     # Stop option processing
++       shift; break ;;
++    - )	# Use stdin as input.
++       break ;;
++    -* )
++       echo "$me: invalid option $1$help" >&2
++       exit 1 ;;
++    * )
++       break ;;
++  esac
++done
++
++if test $# != 0; then
++  echo "$me: too many arguments$help" >&2
++  exit 1
++fi
++
++trap 'exit 1' 1 2 15
++
++# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
++# compiler to aid in system detection is discouraged as it requires
++# temporary files to be created and, as you can see below, it is a
++# headache to deal with in a portable fashion.
++
++# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
++# use `HOST_CC' if defined, but it is deprecated.
++
++# Portable tmp directory creation inspired by the Autoconf team.
++
++set_cc_for_build='
++trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
++trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
++: ${TMPDIR=/tmp} ;
++ { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
++ { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
++ { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
++ { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
++dummy=$tmp/dummy ;
++tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
++case $CC_FOR_BUILD,$HOST_CC,$CC in
++ ,,)    echo "int x;" > $dummy.c ;
++	for c in cc gcc c89 c99 ; do
++	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
++	     CC_FOR_BUILD="$c"; break ;
++	  fi ;
++	done ;
++	if test x"$CC_FOR_BUILD" = x ; then
++	  CC_FOR_BUILD=no_compiler_found ;
++	fi
++	;;
++ ,,*)   CC_FOR_BUILD=$CC ;;
++ ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
++esac ; set_cc_for_build= ;'
++
++# This is needed to find uname on a Pyramid OSx when run in the BSD universe.
++# (ghazi@noc.rutgers.edu 1994-08-24)
++if (test -f /.attbin/uname) >/dev/null 2>&1 ; then
++	PATH=$PATH:/.attbin ; export PATH
++fi
++
++UNAME_MACHINE=`(uname -m) 2>/dev/null` || UNAME_MACHINE=unknown
++UNAME_RELEASE=`(uname -r) 2>/dev/null` || UNAME_RELEASE=unknown
++UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
++UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
++
++# Note: order is significant - the case branches are not exclusive.
++
++case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
++    *:NetBSD:*:*)
++	# NetBSD (nbsd) targets should (where applicable) match one or
++	# more of the tupples: *-*-netbsdelf*, *-*-netbsdaout*,
++	# *-*-netbsdecoff* and *-*-netbsd*.  For targets that recently
++	# switched to ELF, *-*-netbsd* would select the old
++	# object file format.  This provides both forward
++	# compatibility and a consistent mechanism for selecting the
++	# object file format.
++	#
++	# Note: NetBSD doesn't particularly care about the vendor
++	# portion of the name.  We always set it to "unknown".
++	sysctl="sysctl -n hw.machine_arch"
++	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
++	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
++	case "${UNAME_MACHINE_ARCH}" in
++	    armeb) machine=armeb-unknown ;;
++	    arm*) machine=arm-unknown ;;
++	    sh3el) machine=shl-unknown ;;
++	    sh3eb) machine=sh-unknown ;;
++	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
++	esac
++	# The Operating System including object format, if it has switched
++	# to ELF recently, or will in the future.
++	case "${UNAME_MACHINE_ARCH}" in
++	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
++		eval $set_cc_for_build
++		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
++			| grep __ELF__ >/dev/null
++		then
++		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
++		    # Return netbsd for either.  FIX?
++		    os=netbsd
++		else
++		    os=netbsdelf
++		fi
++		;;
++	    *)
++	        os=netbsd
++		;;
++	esac
++	# The OS release
++	# Debian GNU/NetBSD machines have a different userland, and
++	# thus, need a distinct triplet. However, they do not need
++	# kernel version information, so it can be replaced with a
++	# suitable tag, in the style of linux-gnu.
++	case "${UNAME_VERSION}" in
++	    Debian*)
++		release='-gnu'
++		;;
++	    *)
++		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
++		;;
++	esac
++	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
++	# contains redundant information, the shorter form:
++	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
++	echo "${machine}-${os}${release}"
++	exit ;;
++    *:OpenBSD:*:*)
++	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
++	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
++	exit ;;
++    *:ekkoBSD:*:*)
++	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
++	exit ;;
++    *:SolidBSD:*:*)
++	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
++	exit ;;
++    macppc:MirBSD:*:*)
++	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
++	exit ;;
++    *:MirBSD:*:*)
++	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
++	exit ;;
++    alpha:OSF1:*:*)
++	case $UNAME_RELEASE in
++	*4.0)
++		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
++		;;
++	*5.*)
++	        UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
++		;;
++	esac
++	# According to Compaq, /usr/sbin/psrinfo has been available on
++	# OSF/1 and Tru64 systems produced since 1995.  I hope that
++	# covers most systems running today.  This code pipes the CPU
++	# types through head -n 1, so we only detect the type of CPU 0.
++	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
++	case "$ALPHA_CPU_TYPE" in
++	    "EV4 (21064)")
++		UNAME_MACHINE="alpha" ;;
++	    "EV4.5 (21064)")
++		UNAME_MACHINE="alpha" ;;
++	    "LCA4 (21066/21068)")
++		UNAME_MACHINE="alpha" ;;
++	    "EV5 (21164)")
++		UNAME_MACHINE="alphaev5" ;;
++	    "EV5.6 (21164A)")
++		UNAME_MACHINE="alphaev56" ;;
++	    "EV5.6 (21164PC)")
++		UNAME_MACHINE="alphapca56" ;;
++	    "EV5.7 (21164PC)")
++		UNAME_MACHINE="alphapca57" ;;
++	    "EV6 (21264)")
++		UNAME_MACHINE="alphaev6" ;;
++	    "EV6.7 (21264A)")
++		UNAME_MACHINE="alphaev67" ;;
++	    "EV6.8CB (21264C)")
++		UNAME_MACHINE="alphaev68" ;;
++	    "EV6.8AL (21264B)")
++		UNAME_MACHINE="alphaev68" ;;
++	    "EV6.8CX (21264D)")
++		UNAME_MACHINE="alphaev68" ;;
++	    "EV6.9A (21264/EV69A)")
++		UNAME_MACHINE="alphaev69" ;;
++	    "EV7 (21364)")
++		UNAME_MACHINE="alphaev7" ;;
++	    "EV7.9 (21364A)")
++		UNAME_MACHINE="alphaev79" ;;
++	esac
++	# A Pn.n version is a patched version.
++	# A Vn.n version is a released version.
++	# A Tn.n version is a released field test version.
++	# A Xn.n version is an unreleased experimental baselevel.
++	# 1.2 uses "1.2" for uname -r.
++	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
++	exit ;;
++    Alpha\ *:Windows_NT*:*)
++	# How do we know it's Interix rather than the generic POSIX subsystem?
++	# Should we change UNAME_MACHINE based on the output of uname instead
++	# of the specific Alpha model?
++	echo alpha-pc-interix
++	exit ;;
++    21064:Windows_NT:50:3)
++	echo alpha-dec-winnt3.5
++	exit ;;
++    Amiga*:UNIX_System_V:4.0:*)
++	echo m68k-unknown-sysv4
++	exit ;;
++    *:[Aa]miga[Oo][Ss]:*:*)
++	echo ${UNAME_MACHINE}-unknown-amigaos
++	exit ;;
++    *:[Mm]orph[Oo][Ss]:*:*)
++	echo ${UNAME_MACHINE}-unknown-morphos
++	exit ;;
++    *:OS/390:*:*)
++	echo i370-ibm-openedition
++	exit ;;
++    *:z/VM:*:*)
++	echo s390-ibm-zvmoe
++	exit ;;
++    *:OS400:*:*)
++        echo powerpc-ibm-os400
++	exit ;;
++    arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
++	echo arm-acorn-riscix${UNAME_RELEASE}
++	exit ;;
++    arm:riscos:*:*|arm:RISCOS:*:*)
++	echo arm-unknown-riscos
++	exit ;;
++    SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
++	echo hppa1.1-hitachi-hiuxmpp
++	exit ;;
++    Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
++	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
++	if test "`(/bin/universe) 2>/dev/null`" = att ; then
++		echo pyramid-pyramid-sysv3
++	else
++		echo pyramid-pyramid-bsd
++	fi
++	exit ;;
++    NILE*:*:*:dcosx)
++	echo pyramid-pyramid-svr4
++	exit ;;
++    DRS?6000:unix:4.0:6*)
++	echo sparc-icl-nx6
++	exit ;;
++    DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
++	case `/usr/bin/uname -p` in
++	    sparc) echo sparc-icl-nx7; exit ;;
++	esac ;;
++    sun4H:SunOS:5.*:*)
++	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
++	exit ;;
++    sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
++	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
++	exit ;;
++    i86pc:SunOS:5.*:*)
++	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
++	exit ;;
++    sun4*:SunOS:6*:*)
++	# According to config.sub, this is the proper way to canonicalize
++	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
++	# it's likely to be more like Solaris than SunOS4.
++	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
++	exit ;;
++    sun4*:SunOS:*:*)
++	case "`/usr/bin/arch -k`" in
++	    Series*|S4*)
++		UNAME_RELEASE=`uname -v`
++		;;
++	esac
++	# Japanese Language versions have a version number like `4.1.3-JL'.
++	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
++	exit ;;
++    sun3*:SunOS:*:*)
++	echo m68k-sun-sunos${UNAME_RELEASE}
++	exit ;;
++    sun*:*:4.2BSD:*)
++	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
++	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
++	case "`/bin/arch`" in
++	    sun3)
++		echo m68k-sun-sunos${UNAME_RELEASE}
++		;;
++	    sun4)
++		echo sparc-sun-sunos${UNAME_RELEASE}
++		;;
++	esac
++	exit ;;
++    aushp:SunOS:*:*)
++	echo sparc-auspex-sunos${UNAME_RELEASE}
++	exit ;;
++    # The situation for MiNT is a little confusing.  The machine name
++    # can be virtually everything (everything which is not
++    # "atarist" or "atariste" at least should have a processor
++    # > m68000).  The system name ranges from "MiNT" over "FreeMiNT"
++    # to the lowercase version "mint" (or "freemint").  Finally
++    # the system name "TOS" denotes a system which is actually not
++    # MiNT.  But MiNT is downward compatible to TOS, so this should
++    # be no problem.
++    atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
++        echo m68k-atari-mint${UNAME_RELEASE}
++	exit ;;
++    atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
++	echo m68k-atari-mint${UNAME_RELEASE}
++        exit ;;
++    *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
++        echo m68k-atari-mint${UNAME_RELEASE}
++	exit ;;
++    milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
++        echo m68k-milan-mint${UNAME_RELEASE}
++        exit ;;
++    hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
++        echo m68k-hades-mint${UNAME_RELEASE}
++        exit ;;
++    *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
++        echo m68k-unknown-mint${UNAME_RELEASE}
++        exit ;;
++    m68k:machten:*:*)
++	echo m68k-apple-machten${UNAME_RELEASE}
++	exit ;;
++    powerpc:machten:*:*)
++	echo powerpc-apple-machten${UNAME_RELEASE}
++	exit ;;
++    RISC*:Mach:*:*)
++	echo mips-dec-mach_bsd4.3
++	exit ;;
++    RISC*:ULTRIX:*:*)
++	echo mips-dec-ultrix${UNAME_RELEASE}
++	exit ;;
++    VAX*:ULTRIX*:*:*)
++	echo vax-dec-ultrix${UNAME_RELEASE}
++	exit ;;
++    2020:CLIX:*:* | 2430:CLIX:*:*)
++	echo clipper-intergraph-clix${UNAME_RELEASE}
++	exit ;;
++    mips:*:*:UMIPS | mips:*:*:RISCos)
++	eval $set_cc_for_build
++	sed 's/^	//' << EOF >$dummy.c
++#ifdef __cplusplus
++#include <stdio.h>  /* for printf() prototype */
++	int main (int argc, char *argv[]) {
++#else
++	int main (argc, argv) int argc; char *argv[]; {
++#endif
++	#if defined (host_mips) && defined (MIPSEB)
++	#if defined (SYSTYPE_SYSV)
++	  printf ("mips-mips-riscos%ssysv\n", argv[1]); exit (0);
++	#endif
++	#if defined (SYSTYPE_SVR4)
++	  printf ("mips-mips-riscos%ssvr4\n", argv[1]); exit (0);
++	#endif
++	#if defined (SYSTYPE_BSD43) || defined(SYSTYPE_BSD)
++	  printf ("mips-mips-riscos%sbsd\n", argv[1]); exit (0);
++	#endif
++	#endif
++	  exit (-1);
++	}
++EOF
++	$CC_FOR_BUILD -o $dummy $dummy.c &&
++	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
++	  SYSTEM_NAME=`$dummy $dummyarg` &&
++	    { echo "$SYSTEM_NAME"; exit; }
++	echo mips-mips-riscos${UNAME_RELEASE}
++	exit ;;
++    Motorola:PowerMAX_OS:*:*)
++	echo powerpc-motorola-powermax
++	exit ;;
++    Motorola:*:4.3:PL8-*)
++	echo powerpc-harris-powermax
++	exit ;;
++    Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
++	echo powerpc-harris-powermax
++	exit ;;
++    Night_Hawk:Power_UNIX:*:*)
++	echo powerpc-harris-powerunix
++	exit ;;
++    m88k:CX/UX:7*:*)
++	echo m88k-harris-cxux7
++	exit ;;
++    m88k:*:4*:R4*)
++	echo m88k-motorola-sysv4
++	exit ;;
++    m88k:*:3*:R3*)
++	echo m88k-motorola-sysv3
++	exit ;;
++    AViiON:dgux:*:*)
++        # DG/UX returns AViiON for all architectures
++        UNAME_PROCESSOR=`/usr/bin/uname -p`
++	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
++	then
++	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
++	       [ ${TARGET_BINARY_INTERFACE}x = x ]
++	    then
++		echo m88k-dg-dgux${UNAME_RELEASE}
++	    else
++		echo m88k-dg-dguxbcs${UNAME_RELEASE}
++	    fi
++	else
++	    echo i586-dg-dgux${UNAME_RELEASE}
++	fi
++ 	exit ;;
++    M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
++	echo m88k-dolphin-sysv3
++	exit ;;
++    M88*:*:R3*:*)
++	# Delta 88k system running SVR3
++	echo m88k-motorola-sysv3
++	exit ;;
++    XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
++	echo m88k-tektronix-sysv3
++	exit ;;
++    Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
++	echo m68k-tektronix-bsd
++	exit ;;
++    *:IRIX*:*:*)
++	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
++	exit ;;
++    ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
++	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
++	exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
++    i*86:AIX:*:*)
++	echo i386-ibm-aix
++	exit ;;
++    ia64:AIX:*:*)
++	if [ -x /usr/bin/oslevel ] ; then
++		IBM_REV=`/usr/bin/oslevel`
++	else
++		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
++	fi
++	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
++	exit ;;
++    *:AIX:2:3)
++	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
++		eval $set_cc_for_build
++		sed 's/^		//' << EOF >$dummy.c
++		#include <sys/systemcfg.h>
++
++		main()
++			{
++			if (!__power_pc())
++				exit(1);
++			puts("powerpc-ibm-aix3.2.5");
++			exit(0);
++			}
++EOF
++		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
++		then
++			echo "$SYSTEM_NAME"
++		else
++			echo rs6000-ibm-aix3.2.5
++		fi
++	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
++		echo rs6000-ibm-aix3.2.4
++	else
++		echo rs6000-ibm-aix3.2
++	fi
++	exit ;;
++    *:AIX:*:[45])
++	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
++	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
++		IBM_ARCH=rs6000
++	else
++		IBM_ARCH=powerpc
++	fi
++	if [ -x /usr/bin/oslevel ] ; then
++		IBM_REV=`/usr/bin/oslevel`
++	else
++		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
++	fi
++	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
++	exit ;;
++    *:AIX:*:*)
++	echo rs6000-ibm-aix
++	exit ;;
++    ibmrt:4.4BSD:*|romp-ibm:BSD:*)
++	echo romp-ibm-bsd4.4
++	exit ;;
++    ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
++	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
++	exit ;;                             # report: romp-ibm BSD 4.3
++    *:BOSX:*:*)
++	echo rs6000-bull-bosx
++	exit ;;
++    DPX/2?00:B.O.S.:*:*)
++	echo m68k-bull-sysv3
++	exit ;;
++    9000/[34]??:4.3bsd:1.*:*)
++	echo m68k-hp-bsd
++	exit ;;
++    hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
++	echo m68k-hp-bsd4.4
++	exit ;;
++    9000/[34678]??:HP-UX:*:*)
++	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
++	case "${UNAME_MACHINE}" in
++	    9000/31? )            HP_ARCH=m68000 ;;
++	    9000/[34]?? )         HP_ARCH=m68k ;;
++	    9000/[678][0-9][0-9])
++		if [ -x /usr/bin/getconf ]; then
++		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
++                    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
++                    case "${sc_cpu_version}" in
++                      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
++                      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
++                      532)                      # CPU_PA_RISC2_0
++                        case "${sc_kernel_bits}" in
++                          32) HP_ARCH="hppa2.0n" ;;
++                          64) HP_ARCH="hppa2.0w" ;;
++			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
++                        esac ;;
++                    esac
++		fi
++		if [ "${HP_ARCH}" = "" ]; then
++		    eval $set_cc_for_build
++		    sed 's/^              //' << EOF >$dummy.c
++
++              #define _HPUX_SOURCE
++              #include <stdlib.h>
++              #include <unistd.h>
++
++              int main ()
++              {
++              #if defined(_SC_KERNEL_BITS)
++                  long bits = sysconf(_SC_KERNEL_BITS);
++              #endif
++                  long cpu  = sysconf (_SC_CPU_VERSION);
++
++                  switch (cpu)
++              	{
++              	case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
++              	case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
++              	case CPU_PA_RISC2_0:
++              #if defined(_SC_KERNEL_BITS)
++              	    switch (bits)
++              		{
++              		case 64: puts ("hppa2.0w"); break;
++              		case 32: puts ("hppa2.0n"); break;
++              		default: puts ("hppa2.0"); break;
++              		} break;
++              #else  /* !defined(_SC_KERNEL_BITS) */
++              	    puts ("hppa2.0"); break;
++              #endif
++              	default: puts ("hppa1.0"); break;
++              	}
++                  exit (0);
++              }
++EOF
++		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
++		    test -z "$HP_ARCH" && HP_ARCH=hppa
++		fi ;;
++	esac
++	if [ ${HP_ARCH} = "hppa2.0w" ]
++	then
++	    eval $set_cc_for_build
++
++	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
++	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
++	    # generating 64-bit code.  GNU and HP use different nomenclature:
++	    #
++	    # $ CC_FOR_BUILD=cc ./config.guess
++	    # => hppa2.0w-hp-hpux11.23
++	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
++	    # => hppa64-hp-hpux11.23
++
++	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
++		grep __LP64__ >/dev/null
++	    then
++		HP_ARCH="hppa2.0w"
++	    else
++		HP_ARCH="hppa64"
++	    fi
++	fi
++	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
++	exit ;;
++    ia64:HP-UX:*:*)
++	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
++	echo ia64-hp-hpux${HPUX_REV}
++	exit ;;
++    3050*:HI-UX:*:*)
++	eval $set_cc_for_build
++	sed 's/^	//' << EOF >$dummy.c
++	#include <unistd.h>
++	int
++	main ()
++	{
++	  long cpu = sysconf (_SC_CPU_VERSION);
++	  /* The order matters, because CPU_IS_HP_MC68K erroneously returns
++	     true for CPU_PA_RISC1_0.  CPU_IS_PA_RISC returns correct
++	     results, however.  */
++	  if (CPU_IS_PA_RISC (cpu))
++	    {
++	      switch (cpu)
++		{
++		  case CPU_PA_RISC1_0: puts ("hppa1.0-hitachi-hiuxwe2"); break;
++		  case CPU_PA_RISC1_1: puts ("hppa1.1-hitachi-hiuxwe2"); break;
++		  case CPU_PA_RISC2_0: puts ("hppa2.0-hitachi-hiuxwe2"); break;
++		  default: puts ("hppa-hitachi-hiuxwe2"); break;
++		}
++	    }
++	  else if (CPU_IS_HP_MC68K (cpu))
++	    puts ("m68k-hitachi-hiuxwe2");
++	  else puts ("unknown-hitachi-hiuxwe2");
++	  exit (0);
++	}
++EOF
++	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
++		{ echo "$SYSTEM_NAME"; exit; }
++	echo unknown-hitachi-hiuxwe2
++	exit ;;
++    9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
++	echo hppa1.1-hp-bsd
++	exit ;;
++    9000/8??:4.3bsd:*:*)
++	echo hppa1.0-hp-bsd
++	exit ;;
++    *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
++	echo hppa1.0-hp-mpeix
++	exit ;;
++    hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
++	echo hppa1.1-hp-osf
++	exit ;;
++    hp8??:OSF1:*:*)
++	echo hppa1.0-hp-osf
++	exit ;;
++    i*86:OSF1:*:*)
++	if [ -x /usr/sbin/sysversion ] ; then
++	    echo ${UNAME_MACHINE}-unknown-osf1mk
++	else
++	    echo ${UNAME_MACHINE}-unknown-osf1
++	fi
++	exit ;;
++    parisc*:Lites*:*:*)
++	echo hppa1.1-hp-lites
++	exit ;;
++    C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
++	echo c1-convex-bsd
++        exit ;;
++    C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
++	if getsysinfo -f scalar_acc
++	then echo c32-convex-bsd
++	else echo c2-convex-bsd
++	fi
++        exit ;;
++    C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
++	echo c34-convex-bsd
++        exit ;;
++    C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
++	echo c38-convex-bsd
++        exit ;;
++    C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
++	echo c4-convex-bsd
++        exit ;;
++    CRAY*Y-MP:*:*:*)
++	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
++	exit ;;
++    CRAY*[A-Z]90:*:*:*)
++	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
++	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
++	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
++	      -e 's/\.[^.]*$/.X/'
++	exit ;;
++    CRAY*TS:*:*:*)
++	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
++	exit ;;
++    CRAY*T3E:*:*:*)
++	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
++	exit ;;
++    CRAY*SV1:*:*:*)
++	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
++	exit ;;
++    *:UNICOS/mp:*:*)
++	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
++	exit ;;
++    F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
++	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
++        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
++        FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
++        echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
++        exit ;;
++    5000:UNIX_System_V:4.*:*)
++        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
++        FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
++        echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
++	exit ;;
++    i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
++	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
++	exit ;;
++    sparc*:BSD/OS:*:*)
++	echo sparc-unknown-bsdi${UNAME_RELEASE}
++	exit ;;
++    *:BSD/OS:*:*)
++	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
++	exit ;;
++    *:FreeBSD:*:*)
++	case ${UNAME_MACHINE} in
++	    pc98)
++		echo i386-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
++	    amd64)
++		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
++	    *)
++		echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
++	esac
++	exit ;;
++    i*:CYGWIN*:*)
++	echo ${UNAME_MACHINE}-pc-cygwin
++	exit ;;
++    i*:MINGW*:*)
++	echo ${UNAME_MACHINE}-pc-mingw32
++	exit ;;
++    i*:windows32*:*)
++    	# uname -m includes "-pc" on this system.
++    	echo ${UNAME_MACHINE}-mingw32
++	exit ;;
++    i*:PW*:*)
++	echo ${UNAME_MACHINE}-pc-pw32
++	exit ;;
++    x86:Interix*:[3456]*)
++	echo i586-pc-interix${UNAME_RELEASE}
++	exit ;;
++    EM64T:Interix*:[3456]*)
++	echo x86_64-unknown-interix${UNAME_RELEASE}
++	exit ;;
++    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
++	echo i${UNAME_MACHINE}-pc-mks
++	exit ;;
++    i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
++	# How do we know it's Interix rather than the generic POSIX subsystem?
++	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
++	# UNAME_MACHINE based on the output of uname instead of i386?
++	echo i586-pc-interix
++	exit ;;
++    i*:UWIN*:*)
++	echo ${UNAME_MACHINE}-pc-uwin
++	exit ;;
++    amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
++	echo x86_64-unknown-cygwin
++	exit ;;
++    p*:CYGWIN*:*)
++	echo powerpcle-unknown-cygwin
++	exit ;;
++    prep*:SunOS:5.*:*)
++	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
++	exit ;;
++    *:GNU:*:*)
++	# the GNU system
++	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
++	exit ;;
++    *:GNU/*:*:*)
++	# other systems with GNU libc and userland
++	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-gnu
++	exit ;;
++    i*86:Minix:*:*)
++	echo ${UNAME_MACHINE}-pc-minix
++	exit ;;
++    arm*:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    avr32*:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    cris:Linux:*:*)
++	echo cris-axis-linux-gnu
++	exit ;;
++    crisv32:Linux:*:*)
++	echo crisv32-axis-linux-gnu
++	exit ;;
++    frv:Linux:*:*)
++    	echo frv-unknown-linux-gnu
++	exit ;;
++    ia64:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    m32r*:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    m68*:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    mips:Linux:*:*)
++	eval $set_cc_for_build
++	sed 's/^	//' << EOF >$dummy.c
++	#undef CPU
++	#undef mips
++	#undef mipsel
++	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
++	CPU=mipsel
++	#else
++	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
++	CPU=mips
++	#else
++	CPU=
++	#endif
++	#endif
++EOF
++	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
++	    /^CPU/{
++		s: ::g
++		p
++	    }'`"
++	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
++	;;
++    mips64:Linux:*:*)
++	eval $set_cc_for_build
++	sed 's/^	//' << EOF >$dummy.c
++	#undef CPU
++	#undef mips64
++	#undef mips64el
++	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
++	CPU=mips64el
++	#else
++	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
++	CPU=mips64
++	#else
++	CPU=
++	#endif
++	#endif
++EOF
++	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
++	    /^CPU/{
++		s: ::g
++		p
++	    }'`"
++	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
++	;;
++    or32:Linux:*:*)
++	echo or32-unknown-linux-gnu
++	exit ;;
++    ppc:Linux:*:*)
++	echo powerpc-unknown-linux-gnu
++	exit ;;
++    ppc64:Linux:*:*)
++	echo powerpc64-unknown-linux-gnu
++	exit ;;
++    alpha:Linux:*:*)
++	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
++	  EV5)   UNAME_MACHINE=alphaev5 ;;
++	  EV56)  UNAME_MACHINE=alphaev56 ;;
++	  PCA56) UNAME_MACHINE=alphapca56 ;;
++	  PCA57) UNAME_MACHINE=alphapca56 ;;
++	  EV6)   UNAME_MACHINE=alphaev6 ;;
++	  EV67)  UNAME_MACHINE=alphaev67 ;;
++	  EV68*) UNAME_MACHINE=alphaev68 ;;
++        esac
++	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
++	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
++	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
++	exit ;;
++    parisc:Linux:*:* | hppa:Linux:*:*)
++	# Look for CPU level
++	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
++	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
++	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
++	  *)    echo hppa-unknown-linux-gnu ;;
++	esac
++	exit ;;
++    parisc64:Linux:*:* | hppa64:Linux:*:*)
++	echo hppa64-unknown-linux-gnu
++	exit ;;
++    s390:Linux:*:* | s390x:Linux:*:*)
++	echo ${UNAME_MACHINE}-ibm-linux
++	exit ;;
++    sh64*:Linux:*:*)
++    	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    sh*:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    sparc:Linux:*:* | sparc64:Linux:*:*)
++	echo ${UNAME_MACHINE}-unknown-linux-gnu
++	exit ;;
++    vax:Linux:*:*)
++	echo ${UNAME_MACHINE}-dec-linux-gnu
++	exit ;;
++    x86_64:Linux:*:*)
++	echo x86_64-unknown-linux-gnu
++	exit ;;
++    i*86:Linux:*:*)
++	# The BFD linker knows what the default object file format is, so
++	# first see if it will tell us. cd to the root directory to prevent
++	# problems with other programs or directories called `ld' in the path.
++	# Set LC_ALL=C to ensure ld outputs messages in English.
++	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
++			 | sed -ne '/supported targets:/!d
++				    s/[ 	][ 	]*/ /g
++				    s/.*supported targets: *//
++				    s/ .*//
++				    p'`
++        case "$ld_supported_targets" in
++	  elf32-i386)
++		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
++		;;
++	  a.out-i386-linux)
++		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
++		exit ;;
++	  coff-i386)
++		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
++		exit ;;
++	  "")
++		# Either a pre-BFD a.out linker (linux-gnuoldld) or
++		# one that does not give us useful --help.
++		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
++		exit ;;
++	esac
++	# Determine whether the default compiler is a.out or elf
++	eval $set_cc_for_build
++	sed 's/^	//' << EOF >$dummy.c
++	#include <features.h>
++	#ifdef __ELF__
++	# ifdef __GLIBC__
++	#  if __GLIBC__ >= 2
++	LIBC=gnu
++	#  else
++	LIBC=gnulibc1
++	#  endif
++	# else
++	LIBC=gnulibc1
++	# endif
++	#else
++	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
++	LIBC=gnu
++	#else
++	LIBC=gnuaout
++	#endif
++	#endif
++	#ifdef __dietlibc__
++	LIBC=dietlibc
++	#endif
++EOF
++	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
++	    /^LIBC/{
++		s: ::g
++		p
++	    }'`"
++	test x"${LIBC}" != x && {
++		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
++		exit
++	}
++	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
++	;;
++    i*86:DYNIX/ptx:4*:*)
++	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
++	# earlier versions are messed up and put the nodename in both
++	# sysname and nodename.
++	echo i386-sequent-sysv4
++	exit ;;
++    i*86:UNIX_SV:4.2MP:2.*)
++        # Unixware is an offshoot of SVR4, but it has its own version
++        # number series starting with 2...
++        # I am not positive that other SVR4 systems won't match this,
++	# I just have to hope.  -- rms.
++        # Use sysv4.2uw... so that sysv4* matches it.
++	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
++	exit ;;
++    i*86:OS/2:*:*)
++	# If we were able to find `uname', then EMX Unix compatibility
++	# is probably installed.
++	echo ${UNAME_MACHINE}-pc-os2-emx
++	exit ;;
++    i*86:XTS-300:*:STOP)
++	echo ${UNAME_MACHINE}-unknown-stop
++	exit ;;
++    i*86:atheos:*:*)
++	echo ${UNAME_MACHINE}-unknown-atheos
++	exit ;;
++    i*86:syllable:*:*)
++	echo ${UNAME_MACHINE}-pc-syllable
++	exit ;;
++    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
++	echo i386-unknown-lynxos${UNAME_RELEASE}
++	exit ;;
++    i*86:*DOS:*:*)
++	echo ${UNAME_MACHINE}-pc-msdosdjgpp
++	exit ;;
++    i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
++	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
++	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
++		echo ${UNAME_MACHINE}-univel-sysv${UNAME_REL}
++	else
++		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
++	fi
++	exit ;;
++    i*86:*:5:[678]*)
++    	# UnixWare 7.x, OpenUNIX and OpenServer 6.
++	case `/bin/uname -X | grep "^Machine"` in
++	    *486*)	     UNAME_MACHINE=i486 ;;
++	    *Pentium)	     UNAME_MACHINE=i586 ;;
++	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
++	esac
++	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
++	exit ;;
++    i*86:*:3.2:*)
++	if test -f /usr/options/cb.name; then
++		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
++		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
++	elif /bin/uname -X 2>/dev/null >/dev/null ; then
++		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
++		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
++		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
++			&& UNAME_MACHINE=i586
++		(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
++			&& UNAME_MACHINE=i686
++		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
++			&& UNAME_MACHINE=i686
++		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
++	else
++		echo ${UNAME_MACHINE}-pc-sysv32
++	fi
++	exit ;;
++    pc:*:*:*)
++	# Left here for compatibility:
++        # uname -m prints for DJGPP always 'pc', but it prints nothing about
++        # the processor, so we play safe by assuming i386.
++	echo i386-pc-msdosdjgpp
++        exit ;;
++    Intel:Mach:3*:*)
++	echo i386-pc-mach3
++	exit ;;
++    paragon:*:*:*)
++	echo i860-intel-osf1
++	exit ;;
++    i860:*:4.*:*) # i860-SVR4
++	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
++	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
++	else # Add other i860-SVR4 vendors below as they are discovered.
++	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
++	fi
++	exit ;;
++    mini*:CTIX:SYS*5:*)
++	# "miniframe"
++	echo m68010-convergent-sysv
++	exit ;;
++    mc68k:UNIX:SYSTEM5:3.51m)
++	echo m68k-convergent-sysv
++	exit ;;
++    M680?0:D-NIX:5.3:*)
++	echo m68k-diab-dnix
++	exit ;;
++    M68*:*:R3V[5678]*:*)
++	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
++    3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
++	OS_REL=''
++	test -r /etc/.relid \
++	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
++	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
++	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
++	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
++	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
++    3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
++        /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
++          && { echo i486-ncr-sysv4; exit; } ;;
++    m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
++	echo m68k-unknown-lynxos${UNAME_RELEASE}
++	exit ;;
++    mc68030:UNIX_System_V:4.*:*)
++	echo m68k-atari-sysv4
++	exit ;;
++    TSUNAMI:LynxOS:2.*:*)
++	echo sparc-unknown-lynxos${UNAME_RELEASE}
++	exit ;;
++    rs6000:LynxOS:2.*:*)
++	echo rs6000-unknown-lynxos${UNAME_RELEASE}
++	exit ;;
++    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
++	echo powerpc-unknown-lynxos${UNAME_RELEASE}
++	exit ;;
++    SM[BE]S:UNIX_SV:*:*)
++	echo mips-dde-sysv${UNAME_RELEASE}
++	exit ;;
++    RM*:ReliantUNIX-*:*:*)
++	echo mips-sni-sysv4
++	exit ;;
++    RM*:SINIX-*:*:*)
++	echo mips-sni-sysv4
++	exit ;;
++    *:SINIX-*:*:*)
++	if uname -p 2>/dev/null >/dev/null ; then
++		UNAME_MACHINE=`(uname -p) 2>/dev/null`
++		echo ${UNAME_MACHINE}-sni-sysv4
++	else
++		echo ns32k-sni-sysv
++	fi
++	exit ;;
++    PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
++                      # says <Richard.M.Bartel@ccMail.Census.GOV>
++        echo i586-unisys-sysv4
++        exit ;;
++    *:UNIX_System_V:4*:FTX*)
++	# From Gerald Hewes <hewes@openmarket.com>.
++	# How about differentiating between stratus architectures? -djm
++	echo hppa1.1-stratus-sysv4
++	exit ;;
++    *:*:*:FTX*)
++	# From seanf@swdc.stratus.com.
++	echo i860-stratus-sysv4
++	exit ;;
++    i*86:VOS:*:*)
++	# From Paul.Green@stratus.com.
++	echo ${UNAME_MACHINE}-stratus-vos
++	exit ;;
++    *:VOS:*:*)
++	# From Paul.Green@stratus.com.
++	echo hppa1.1-stratus-vos
++	exit ;;
++    mc68*:A/UX:*:*)
++	echo m68k-apple-aux${UNAME_RELEASE}
++	exit ;;
++    news*:NEWS-OS:6*:*)
++	echo mips-sony-newsos6
++	exit ;;
++    R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
++	if [ -d /usr/nec ]; then
++	        echo mips-nec-sysv${UNAME_RELEASE}
++	else
++	        echo mips-unknown-sysv${UNAME_RELEASE}
++	fi
++        exit ;;
++    BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
++	echo powerpc-be-beos
++	exit ;;
++    BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
++	echo powerpc-apple-beos
++	exit ;;
++    BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
++	echo i586-pc-beos
++	exit ;;
++    SX-4:SUPER-UX:*:*)
++	echo sx4-nec-superux${UNAME_RELEASE}
++	exit ;;
++    SX-5:SUPER-UX:*:*)
++	echo sx5-nec-superux${UNAME_RELEASE}
++	exit ;;
++    SX-6:SUPER-UX:*:*)
++	echo sx6-nec-superux${UNAME_RELEASE}
++	exit ;;
++    Power*:Rhapsody:*:*)
++	echo powerpc-apple-rhapsody${UNAME_RELEASE}
++	exit ;;
++    *:Rhapsody:*:*)
++	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
++	exit ;;
++    *:Darwin:*:*)
++	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
++	case $UNAME_PROCESSOR in
++	    unknown) UNAME_PROCESSOR=powerpc ;;
++	esac
++	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
++	exit ;;
++    *:procnto*:*:* | *:QNX:[0123456789]*:*)
++	UNAME_PROCESSOR=`uname -p`
++	if test "$UNAME_PROCESSOR" = "x86"; then
++		UNAME_PROCESSOR=i386
++		UNAME_MACHINE=pc
++	fi
++	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
++	exit ;;
++    *:QNX:*:4*)
++	echo i386-pc-qnx
++	exit ;;
++    NSE-?:NONSTOP_KERNEL:*:*)
++	echo nse-tandem-nsk${UNAME_RELEASE}
++	exit ;;
++    NSR-?:NONSTOP_KERNEL:*:*)
++	echo nsr-tandem-nsk${UNAME_RELEASE}
++	exit ;;
++    *:NonStop-UX:*:*)
++	echo mips-compaq-nonstopux
++	exit ;;
++    BS2000:POSIX*:*:*)
++	echo bs2000-siemens-sysv
++	exit ;;
++    DS/*:UNIX_System_V:*:*)
++	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
++	exit ;;
++    *:Plan9:*:*)
++	# "uname -m" is not consistent, so use $cputype instead. 386
++	# is converted to i386 for consistency with other x86
++	# operating systems.
++	if test "$cputype" = "386"; then
++	    UNAME_MACHINE=i386
++	else
++	    UNAME_MACHINE="$cputype"
++	fi
++	echo ${UNAME_MACHINE}-unknown-plan9
++	exit ;;
++    *:TOPS-10:*:*)
++	echo pdp10-unknown-tops10
++	exit ;;
++    *:TENEX:*:*)
++	echo pdp10-unknown-tenex
++	exit ;;
++    KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
++	echo pdp10-dec-tops20
++	exit ;;
++    XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
++	echo pdp10-xkl-tops20
++	exit ;;
++    *:TOPS-20:*:*)
++	echo pdp10-unknown-tops20
++	exit ;;
++    *:ITS:*:*)
++	echo pdp10-unknown-its
++	exit ;;
++    SEI:*:*:SEIUX)
++        echo mips-sei-seiux${UNAME_RELEASE}
++	exit ;;
++    *:DragonFly:*:*)
++	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
++	exit ;;
++    *:*VMS:*:*)
++    	UNAME_MACHINE=`(uname -p) 2>/dev/null`
++	case "${UNAME_MACHINE}" in
++	    A*) echo alpha-dec-vms ; exit ;;
++	    I*) echo ia64-dec-vms ; exit ;;
++	    V*) echo vax-dec-vms ; exit ;;
++	esac ;;
++    *:XENIX:*:SysV)
++	echo i386-pc-xenix
++	exit ;;
++    i*86:skyos:*:*)
++	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
++	exit ;;
++    i*86:rdos:*:*)
++	echo ${UNAME_MACHINE}-pc-rdos
++	exit ;;
++esac
++
++#echo '(No uname command or uname output not recognized.)' 1>&2
++#echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2
++
++eval $set_cc_for_build
++cat >$dummy.c <<EOF
++#ifdef _SEQUENT_
++# include <sys/types.h>
++# include <sys/utsname.h>
++#endif
++main ()
++{
++#if defined (sony)
++#if defined (MIPSEB)
++  /* BFD wants "bsd" instead of "newsos".  Perhaps BFD should be changed,
++     I don't know....  */
++  printf ("mips-sony-bsd\n"); exit (0);
++#else
++#include <sys/param.h>
++  printf ("m68k-sony-newsos%s\n",
++#ifdef NEWSOS4
++          "4"
++#else
++	  ""
++#endif
++         ); exit (0);
++#endif
++#endif
++
++#if defined (__arm) && defined (__acorn) && defined (__unix)
++  printf ("arm-acorn-riscix\n"); exit (0);
++#endif
++
++#if defined (hp300) && !defined (hpux)
++  printf ("m68k-hp-bsd\n"); exit (0);
++#endif
++
++#if defined (NeXT)
++#if !defined (__ARCHITECTURE__)
++#define __ARCHITECTURE__ "m68k"
++#endif
++  int version;
++  version=`(hostinfo | sed -n 's/.*NeXT Mach \([0-9]*\).*/\1/p') 2>/dev/null`;
++  if (version < 4)
++    printf ("%s-next-nextstep%d\n", __ARCHITECTURE__, version);
++  else
++    printf ("%s-next-openstep%d\n", __ARCHITECTURE__, version);
++  exit (0);
++#endif
++
++#if defined (MULTIMAX) || defined (n16)
++#if defined (UMAXV)
++  printf ("ns32k-encore-sysv\n"); exit (0);
++#else
++#if defined (CMU)
++  printf ("ns32k-encore-mach\n"); exit (0);
++#else
++  printf ("ns32k-encore-bsd\n"); exit (0);
++#endif
++#endif
++#endif
++
++#if defined (__386BSD__)
++  printf ("i386-pc-bsd\n"); exit (0);
++#endif
++
++#if defined (sequent)
++#if defined (i386)
++  printf ("i386-sequent-dynix\n"); exit (0);
++#endif
++#if defined (ns32000)
++  printf ("ns32k-sequent-dynix\n"); exit (0);
++#endif
++#endif
++
++#if defined (_SEQUENT_)
++    struct utsname un;
++
++    uname(&un);
++
++    if (strncmp(un.version, "V2", 2) == 0) {
++	printf ("i386-sequent-ptx2\n"); exit (0);
++    }
++    if (strncmp(un.version, "V1", 2) == 0) { /* XXX is V1 correct? */
++	printf ("i386-sequent-ptx1\n"); exit (0);
++    }
++    printf ("i386-sequent-ptx\n"); exit (0);
++
++#endif
++
++#if defined (vax)
++# if !defined (ultrix)
++#  include <sys/param.h>
++#  if defined (BSD)
++#   if BSD == 43
++      printf ("vax-dec-bsd4.3\n"); exit (0);
++#   else
++#    if BSD == 199006
++      printf ("vax-dec-bsd4.3reno\n"); exit (0);
++#    else
++      printf ("vax-dec-bsd\n"); exit (0);
++#    endif
++#   endif
++#  else
++    printf ("vax-dec-bsd\n"); exit (0);
++#  endif
++# else
++    printf ("vax-dec-ultrix\n"); exit (0);
++# endif
++#endif
++
++#if defined (alliant) && defined (i860)
++  printf ("i860-alliant-bsd\n"); exit (0);
++#endif
++
++  exit (1);
++}
++EOF
++
++$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
++	{ echo "$SYSTEM_NAME"; exit; }
++
++# Apollos put the system type in the environment.
++
++test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
++
++# Convex versions that predate uname can use getsysinfo(1)
++
++if [ -x /usr/convex/getsysinfo ]
++then
++    case `getsysinfo -f cpu_type` in
++    c1*)
++	echo c1-convex-bsd
++	exit ;;
++    c2*)
++	if getsysinfo -f scalar_acc
++	then echo c32-convex-bsd
++	else echo c2-convex-bsd
++	fi
++	exit ;;
++    c34*)
++	echo c34-convex-bsd
++	exit ;;
++    c38*)
++	echo c38-convex-bsd
++	exit ;;
++    c4*)
++	echo c4-convex-bsd
++	exit ;;
++    esac
++fi
++
++cat >&2 <<EOF
++$0: unable to guess system type
++
++This script, last modified $timestamp, has failed to recognize
++the operating system you are using. It is advised that you
++download the most up to date version of the config scripts from
++
++  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
++and
++  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub
++
++If the version you run ($0) is already up to date, please
++send the following data and any information you think might be
++pertinent to <config-patches@gnu.org> in order to provide the needed
++information to handle your system.
++
++config.guess timestamp = $timestamp
++
++uname -m = `(uname -m) 2>/dev/null || echo unknown`
++uname -r = `(uname -r) 2>/dev/null || echo unknown`
++uname -s = `(uname -s) 2>/dev/null || echo unknown`
++uname -v = `(uname -v) 2>/dev/null || echo unknown`
++
++/usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null`
++/bin/uname -X     = `(/bin/uname -X) 2>/dev/null`
++
++hostinfo               = `(hostinfo) 2>/dev/null`
++/bin/universe          = `(/bin/universe) 2>/dev/null`
++/usr/bin/arch -k       = `(/usr/bin/arch -k) 2>/dev/null`
++/bin/arch              = `(/bin/arch) 2>/dev/null`
++/usr/bin/oslevel       = `(/usr/bin/oslevel) 2>/dev/null`
++/usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null`
++
++UNAME_MACHINE = ${UNAME_MACHINE}
++UNAME_RELEASE = ${UNAME_RELEASE}
++UNAME_SYSTEM  = ${UNAME_SYSTEM}
++UNAME_VERSION = ${UNAME_VERSION}
++EOF
++
++exit 1
++
++# Local variables:
++# eval: (add-hook 'write-file-hooks 'time-stamp)
++# time-stamp-start: "timestamp='"
++# time-stamp-format: "%:y-%02m-%02d"
++# time-stamp-end: "'"
++# End:
+diff -urNad apache2-2.2.3~/config.sub apache2-2.2.3/config.sub
+--- apache2-2.2.3~/config.sub	1970-01-01 01:00:00.000000000 +0100
++++ apache2-2.2.3/config.sub	2006-09-27 21:50:35.000000000 +0200
+@@ -0,0 +1,1608 @@
++#! /bin/sh
++# Configuration validation subroutine script.
++#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
++#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
++#   Inc.
++
++timestamp='2006-07-02'
++
++# This file is (in principle) common to ALL GNU software.
++# The presence of a machine in this file suggests that SOME GNU software
++# can handle that machine.  It does not imply ALL GNU software can.
++#
++# This file is free software; you can redistribute it and/or modify
++# it under the terms of the GNU General Public License as published by
++# the Free Software Foundation; either version 2 of the License, or
++# (at your option) any later version.
++#
++# This program is distributed in the hope that it will be useful,
++# but WITHOUT ANY WARRANTY; without even the implied warranty of
++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++# GNU General Public License for more details.
++#
++# You should have received a copy of the GNU General Public License
++# along with this program; if not, write to the Free Software
++# Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA
++# 02110-1301, USA.
++#
++# As a special exception to the GNU General Public License, if you
++# distribute this file as part of a program that contains a
++# configuration script generated by Autoconf, you may include it under
++# the same distribution terms that you use for the rest of that program.
++
++
++# Please send patches to <config-patches@gnu.org>.  Submit a context
++# diff and a properly formatted ChangeLog entry.
++#
++# Configuration subroutine to validate and canonicalize a configuration type.
++# Supply the specified configuration type as an argument.
++# If it is invalid, we print an error message on stderr and exit with code 1.
++# Otherwise, we print the canonical config type on stdout and succeed.
++
++# This file is supposed to be the same for all GNU packages
++# and recognize all the CPU types, system types and aliases
++# that are meaningful with *any* GNU software.
++# Each package is responsible for reporting which valid configurations
++# it does not support.  The user should be able to distinguish
++# a failure to support a valid configuration from a meaningless
++# configuration.
++
++# The goal of this file is to map all the various variations of a given
++# machine specification into a single specification in the form:
++#	CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM
++# or in some cases, the newer four-part form:
++#	CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM
++# It is wrong to echo any other type of specification.
++
++me=`echo "$0" | sed -e 's,.*/,,'`
++
++usage="\
++Usage: $0 [OPTION] CPU-MFR-OPSYS
++       $0 [OPTION] ALIAS
++
++Canonicalize a configuration name.
++
++Operation modes:
++  -h, --help         print this help, then exit
++  -t, --time-stamp   print date of last modification, then exit
++  -v, --version      print version number, then exit
++
++Report bugs and patches to <config-patches@gnu.org>."
++
++version="\
++GNU config.sub ($timestamp)
++
++Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
++Free Software Foundation, Inc.
++
++This is free software; see the source for copying conditions.  There is NO
++warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
++
++help="
++Try \`$me --help' for more information."
++
++# Parse command line
++while test $# -gt 0 ; do
++  case $1 in
++    --time-stamp | --time* | -t )
++       echo "$timestamp" ; exit ;;
++    --version | -v )
++       echo "$version" ; exit ;;
++    --help | --h* | -h )
++       echo "$usage"; exit ;;
++    -- )     # Stop option processing
++       shift; break ;;
++    - )	# Use stdin as input.
++       break ;;
++    -* )
++       echo "$me: invalid option $1$help"
++       exit 1 ;;
++
++    *local*)
++       # First pass through any local machine types.
++       echo $1
++       exit ;;
++
++    * )
++       break ;;
++  esac
++done
++
++case $# in
++ 0) echo "$me: missing argument$help" >&2
++    exit 1;;
++ 1) ;;
++ *) echo "$me: too many arguments$help" >&2
++    exit 1;;
++esac
++
++# Separate what the user gave into CPU-COMPANY and OS or KERNEL-OS (if any).
++# Here we must recognize all the valid KERNEL-OS combinations.
++maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
++case $maybe_os in
++  nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
++  uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
++  storm-chaos* | os2-emx* | rtmk-nova*)
++    os=-$maybe_os
++    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
++    ;;
++  *)
++    basic_machine=`echo $1 | sed 's/-[^-]*$//'`
++    if [ $basic_machine != $1 ]
++    then os=`echo $1 | sed 's/.*-/-/'`
++    else os=; fi
++    ;;
++esac
++
++### Let's recognize common machines as not being operating systems so
++### that things like config.sub decstation-3100 work.  We also
++### recognize some manufacturers as not being operating systems, so we
++### can provide default operating systems below.
++case $os in
++	-sun*os*)
++		# Prevent following clause from handling this invalid input.
++		;;
++	-dec* | -mips* | -sequent* | -encore* | -pc532* | -sgi* | -sony* | \
++	-att* | -7300* | -3300* | -delta* | -motorola* | -sun[234]* | \
++	-unicom* | -ibm* | -next | -hp | -isi* | -apollo | -altos* | \
++	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
++	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
++	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
++	-apple | -axis | -knuth | -cray)
++		os=
++		basic_machine=$1
++		;;
++	-sim | -cisco | -oki | -wec | -winbond)
++		os=
++		basic_machine=$1
++		;;
++	-scout)
++		;;
++	-wrs)
++		os=-vxworks
++		basic_machine=$1
++		;;
++	-chorusos*)
++		os=-chorusos
++		basic_machine=$1
++		;;
++ 	-chorusrdb)
++ 		os=-chorusrdb
++		basic_machine=$1
++ 		;;
++	-hiux*)
++		os=-hiuxwe2
++		;;
++	-sco6)
++		os=-sco5v6
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco5)
++		os=-sco3.2v5
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco4)
++		os=-sco3.2v4
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco3.2.[4-9]*)
++		os=`echo $os | sed -e 's/sco3.2./sco3.2v/'`
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco3.2v[4-9]*)
++		# Don't forget version if it is 3.2v4 or newer.
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco5v6*)
++		# Don't forget version if it is 3.2v4 or newer.
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-sco*)
++		os=-sco3.2v2
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-udk*)
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-isc)
++		os=-isc2.2
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-clix*)
++		basic_machine=clipper-intergraph
++		;;
++	-isc*)
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
++		;;
++	-lynx*)
++		os=-lynxos
++		;;
++	-ptx*)
++		basic_machine=`echo $1 | sed -e 's/86-.*/86-sequent/'`
++		;;
++	-windowsnt*)
++		os=`echo $os | sed -e 's/windowsnt/winnt/'`
++		;;
++	-psos*)
++		os=-psos
++		;;
++	-mint | -mint[0-9]*)
++		basic_machine=m68k-atari
++		os=-mint
++		;;
++esac
++
++# Decode aliases for certain CPU-COMPANY combinations.
++case $basic_machine in
++	# Recognize the basic CPU types without company name.
++	# Some are omitted here because they have special meanings below.
++	1750a | 580 \
++	| a29k \
++	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
++	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
++	| am33_2.0 \
++	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr | avr32 \
++	| bfin \
++	| c4x | clipper \
++	| d10v | d30v | dlx | dsp16xx \
++	| fr30 | frv \
++	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
++	| i370 | i860 | i960 | ia64 \
++	| ip2k | iq2000 \
++	| m32c | m32r | m32rle | m68000 | m68k | m88k \
++	| maxq | mb | microblaze | mcore \
++	| mips | mipsbe | mipseb | mipsel | mipsle \
++	| mips16 \
++	| mips64 | mips64el \
++	| mips64vr | mips64vrel \
++	| mips64orion | mips64orionel \
++	| mips64vr4100 | mips64vr4100el \
++	| mips64vr4300 | mips64vr4300el \
++	| mips64vr5000 | mips64vr5000el \
++	| mips64vr5900 | mips64vr5900el \
++	| mipsisa32 | mipsisa32el \
++	| mipsisa32r2 | mipsisa32r2el \
++	| mipsisa64 | mipsisa64el \
++	| mipsisa64r2 | mipsisa64r2el \
++	| mipsisa64sb1 | mipsisa64sb1el \
++	| mipsisa64sr71k | mipsisa64sr71kel \
++	| mipstx39 | mipstx39el \
++	| mn10200 | mn10300 \
++	| mt \
++	| msp430 \
++	| nios | nios2 \
++	| ns16k | ns32k \
++	| or32 \
++	| pdp10 | pdp11 | pj | pjl \
++	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
++	| pyramid \
++	| sh | sh[1234] | sh[24]a | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
++	| sh64 | sh64le \
++	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
++	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
++	| spu | strongarm \
++	| tahoe | thumb | tic4x | tic80 | tron \
++	| v850 | v850e \
++	| we32k \
++	| x86 | xscale | xscalee[bl] | xstormy16 | xtensa \
++	| z8k)
++		basic_machine=$basic_machine-unknown
++		;;
++	m6811 | m68hc11 | m6812 | m68hc12)
++		# Motorola 68HC11/12.
++		basic_machine=$basic_machine-unknown
++		os=-none
++		;;
++	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
++		;;
++	ms1)
++		basic_machine=mt-unknown
++		;;
++
++	# We use `pc' rather than `unknown'
++	# because (1) that's what they normally are, and
++	# (2) the word "unknown" tends to confuse beginning users.
++	i*86 | x86_64)
++	  basic_machine=$basic_machine-pc
++	  ;;
++	# Object if more than one company name word.
++	*-*-*)
++		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
++		exit 1
++		;;
++	# Recognize the basic CPU types with company name.
++	580-* \
++	| a29k-* \
++	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
++	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
++	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* \
++	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
++	| avr-* | avr32-* \
++	| bfin-* | bs2000-* \
++	| c[123]* | c30-* | [cjt]90-* | c4x-* | c54x-* | c55x-* | c6x-* \
++	| clipper-* | craynv-* | cydra-* \
++	| d10v-* | d30v-* | dlx-* \
++	| elxsi-* \
++	| f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
++	| h8300-* | h8500-* \
++	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
++	| i*86-* | i860-* | i960-* | ia64-* \
++	| ip2k-* | iq2000-* \
++	| m32c-* | m32r-* | m32rle-* \
++	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
++	| m88110-* | m88k-* | maxq-* | mcore-* \
++	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
++	| mips16-* \
++	| mips64-* | mips64el-* \
++	| mips64vr-* | mips64vrel-* \
++	| mips64orion-* | mips64orionel-* \
++	| mips64vr4100-* | mips64vr4100el-* \
++	| mips64vr4300-* | mips64vr4300el-* \
++	| mips64vr5000-* | mips64vr5000el-* \
++	| mips64vr5900-* | mips64vr5900el-* \
++	| mipsisa32-* | mipsisa32el-* \
++	| mipsisa32r2-* | mipsisa32r2el-* \
++	| mipsisa64-* | mipsisa64el-* \
++	| mipsisa64r2-* | mipsisa64r2el-* \
++	| mipsisa64sb1-* | mipsisa64sb1el-* \
++	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
++	| mipstx39-* | mipstx39el-* \
++	| mmix-* \
++	| mt-* \
++	| msp430-* \
++	| nios-* | nios2-* \
++	| none-* | np1-* | ns16k-* | ns32k-* \
++	| orion-* \
++	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
++	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
++	| pyramid-* \
++	| romp-* | rs6000-* \
++	| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
++	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
++	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
++	| sparclite-* \
++	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
++	| tahoe-* | thumb-* \
++	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
++	| tron-* \
++	| v850-* | v850e-* | vax-* \
++	| we32k-* \
++	| x86-* | x86_64-* | xps100-* | xscale-* | xscalee[bl]-* \
++	| xstormy16-* | xtensa-* \
++	| ymp-* \
++	| z8k-*)
++		;;
++	# Recognize the various machine names and aliases which stand
++	# for a CPU type and a company and sometimes even an OS.
++	386bsd)
++		basic_machine=i386-unknown
++		os=-bsd
++		;;
++	3b1 | 7300 | 7300-att | att-7300 | pc7300 | safari | unixpc)
++		basic_machine=m68000-att
++		;;
++	3b*)
++		basic_machine=we32k-att
++		;;
++	a29khif)
++		basic_machine=a29k-amd
++		os=-udi
++		;;
++    	abacus)
++		basic_machine=abacus-unknown
++		;;
++	adobe68k)
++		basic_machine=m68010-adobe
++		os=-scout
++		;;
++	alliant | fx80)
++		basic_machine=fx80-alliant
++		;;
++	altos | altos3068)
++		basic_machine=m68k-altos
++		;;
++	am29k)
++		basic_machine=a29k-none
++		os=-bsd
++		;;
++	amd64)
++		basic_machine=x86_64-pc
++		;;
++	amd64-*)
++		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	amdahl)
++		basic_machine=580-amdahl
++		os=-sysv
++		;;
++	amiga | amiga-*)
++		basic_machine=m68k-unknown
++		;;
++	amigaos | amigados)
++		basic_machine=m68k-unknown
++		os=-amigaos
++		;;
++	amigaunix | amix)
++		basic_machine=m68k-unknown
++		os=-sysv4
++		;;
++	apollo68)
++		basic_machine=m68k-apollo
++		os=-sysv
++		;;
++	apollo68bsd)
++		basic_machine=m68k-apollo
++		os=-bsd
++		;;
++	aux)
++		basic_machine=m68k-apple
++		os=-aux
++		;;
++	balance)
++		basic_machine=ns32k-sequent
++		os=-dynix
++		;;
++	c90)
++		basic_machine=c90-cray
++		os=-unicos
++		;;
++	convex-c1)
++		basic_machine=c1-convex
++		os=-bsd
++		;;
++	convex-c2)
++		basic_machine=c2-convex
++		os=-bsd
++		;;
++	convex-c32)
++		basic_machine=c32-convex
++		os=-bsd
++		;;
++	convex-c34)
++		basic_machine=c34-convex
++		os=-bsd
++		;;
++	convex-c38)
++		basic_machine=c38-convex
++		os=-bsd
++		;;
++	cray | j90)
++		basic_machine=j90-cray
++		os=-unicos
++		;;
++	craynv)
++		basic_machine=craynv-cray
++		os=-unicosmp
++		;;
++	cr16c)
++		basic_machine=cr16c-unknown
++		os=-elf
++		;;
++	crds | unos)
++		basic_machine=m68k-crds
++		;;
++	crisv32 | crisv32-* | etraxfs*)
++		basic_machine=crisv32-axis
++		;;
++	cris | cris-* | etrax*)
++		basic_machine=cris-axis
++		;;
++	crx)
++		basic_machine=crx-unknown
++		os=-elf
++		;;
++	da30 | da30-*)
++		basic_machine=m68k-da30
++		;;
++	decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn)
++		basic_machine=mips-dec
++		;;
++	decsystem10* | dec10*)
++		basic_machine=pdp10-dec
++		os=-tops10
++		;;
++	decsystem20* | dec20*)
++		basic_machine=pdp10-dec
++		os=-tops20
++		;;
++	delta | 3300 | motorola-3300 | motorola-delta \
++	      | 3300-motorola | delta-motorola)
++		basic_machine=m68k-motorola
++		;;
++	delta88)
++		basic_machine=m88k-motorola
++		os=-sysv3
++		;;
++	djgpp)
++		basic_machine=i586-pc
++		os=-msdosdjgpp
++		;;
++	dpx20 | dpx20-*)
++		basic_machine=rs6000-bull
++		os=-bosx
++		;;
++	dpx2* | dpx2*-bull)
++		basic_machine=m68k-bull
++		os=-sysv3
++		;;
++	ebmon29k)
++		basic_machine=a29k-amd
++		os=-ebmon
++		;;
++	elxsi)
++		basic_machine=elxsi-elxsi
++		os=-bsd
++		;;
++	encore | umax | mmax)
++		basic_machine=ns32k-encore
++		;;
++	es1800 | OSE68k | ose68k | ose | OSE)
++		basic_machine=m68k-ericsson
++		os=-ose
++		;;
++	fx2800)
++		basic_machine=i860-alliant
++		;;
++	genix)
++		basic_machine=ns32k-ns
++		;;
++	gmicro)
++		basic_machine=tron-gmicro
++		os=-sysv
++		;;
++	go32)
++		basic_machine=i386-pc
++		os=-go32
++		;;
++	h3050r* | hiux*)
++		basic_machine=hppa1.1-hitachi
++		os=-hiuxwe2
++		;;
++	h8300hms)
++		basic_machine=h8300-hitachi
++		os=-hms
++		;;
++	h8300xray)
++		basic_machine=h8300-hitachi
++		os=-xray
++		;;
++	h8500hms)
++		basic_machine=h8500-hitachi
++		os=-hms
++		;;
++	harris)
++		basic_machine=m88k-harris
++		os=-sysv3
++		;;
++	hp300-*)
++		basic_machine=m68k-hp
++		;;
++	hp300bsd)
++		basic_machine=m68k-hp
++		os=-bsd
++		;;
++	hp300hpux)
++		basic_machine=m68k-hp
++		os=-hpux
++		;;
++	hp3k9[0-9][0-9] | hp9[0-9][0-9])
++		basic_machine=hppa1.0-hp
++		;;
++	hp9k2[0-9][0-9] | hp9k31[0-9])
++		basic_machine=m68000-hp
++		;;
++	hp9k3[2-9][0-9])
++		basic_machine=m68k-hp
++		;;
++	hp9k6[0-9][0-9] | hp6[0-9][0-9])
++		basic_machine=hppa1.0-hp
++		;;
++	hp9k7[0-79][0-9] | hp7[0-79][0-9])
++		basic_machine=hppa1.1-hp
++		;;
++	hp9k78[0-9] | hp78[0-9])
++		# FIXME: really hppa2.0-hp
++		basic_machine=hppa1.1-hp
++		;;
++	hp9k8[67]1 | hp8[67]1 | hp9k80[24] | hp80[24] | hp9k8[78]9 | hp8[78]9 | hp9k893 | hp893)
++		# FIXME: really hppa2.0-hp
++		basic_machine=hppa1.1-hp
++		;;
++	hp9k8[0-9][13679] | hp8[0-9][13679])
++		basic_machine=hppa1.1-hp
++		;;
++	hp9k8[0-9][0-9] | hp8[0-9][0-9])
++		basic_machine=hppa1.0-hp
++		;;
++	hppa-next)
++		os=-nextstep3
++		;;
++	hppaosf)
++		basic_machine=hppa1.1-hp
++		os=-osf
++		;;
++	hppro)
++		basic_machine=hppa1.1-hp
++		os=-proelf
++		;;
++	i370-ibm* | ibm*)
++		basic_machine=i370-ibm
++		;;
++# I'm not sure what "Sysv32" means.  Should this be sysv3.2?
++	i*86v32)
++		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
++		os=-sysv32
++		;;
++	i*86v4*)
++		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
++		os=-sysv4
++		;;
++	i*86v)
++		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
++		os=-sysv
++		;;
++	i*86sol2)
++		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
++		os=-solaris2
++		;;
++	i386mach)
++		basic_machine=i386-mach
++		os=-mach
++		;;
++	i386-vsta | vsta)
++		basic_machine=i386-unknown
++		os=-vsta
++		;;
++	iris | iris4d)
++		basic_machine=mips-sgi
++		case $os in
++		    -irix*)
++			;;
++		    *)
++			os=-irix4
++			;;
++		esac
++		;;
++	isi68 | isi)
++		basic_machine=m68k-isi
++		os=-sysv
++		;;
++	m88k-omron*)
++		basic_machine=m88k-omron
++		;;
++	magnum | m3230)
++		basic_machine=mips-mips
++		os=-sysv
++		;;
++	merlin)
++		basic_machine=ns32k-utek
++		os=-sysv
++		;;
++	mingw32)
++		basic_machine=i386-pc
++		os=-mingw32
++		;;
++	miniframe)
++		basic_machine=m68000-convergent
++		;;
++	*mint | -mint[0-9]* | *MiNT | *MiNT[0-9]*)
++		basic_machine=m68k-atari
++		os=-mint
++		;;
++	mips3*-*)
++		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
++		;;
++	mips3*)
++		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
++		;;
++	monitor)
++		basic_machine=m68k-rom68k
++		os=-coff
++		;;
++	morphos)
++		basic_machine=powerpc-unknown
++		os=-morphos
++		;;
++	msdos)
++		basic_machine=i386-pc
++		os=-msdos
++		;;
++	ms1-*)
++		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
++		;;
++	mvs)
++		basic_machine=i370-ibm
++		os=-mvs
++		;;
++	ncr3000)
++		basic_machine=i486-ncr
++		os=-sysv4
++		;;
++	netbsd386)
++		basic_machine=i386-unknown
++		os=-netbsd
++		;;
++	netwinder)
++		basic_machine=armv4l-rebel
++		os=-linux
++		;;
++	news | news700 | news800 | news900)
++		basic_machine=m68k-sony
++		os=-newsos
++		;;
++	news1000)
++		basic_machine=m68030-sony
++		os=-newsos
++		;;
++	news-3600 | risc-news)
++		basic_machine=mips-sony
++		os=-newsos
++		;;
++	necv70)
++		basic_machine=v70-nec
++		os=-sysv
++		;;
++	next | m*-next )
++		basic_machine=m68k-next
++		case $os in
++		    -nextstep* )
++			;;
++		    -ns2*)
++		      os=-nextstep2
++			;;
++		    *)
++		      os=-nextstep3
++			;;
++		esac
++		;;
++	nh3000)
++		basic_machine=m68k-harris
++		os=-cxux
++		;;
++	nh[45]000)
++		basic_machine=m88k-harris
++		os=-cxux
++		;;
++	nindy960)
++		basic_machine=i960-intel
++		os=-nindy
++		;;
++	mon960)
++		basic_machine=i960-intel
++		os=-mon960
++		;;
++	nonstopux)
++		basic_machine=mips-compaq
++		os=-nonstopux
++		;;
++	np1)
++		basic_machine=np1-gould
++		;;
++	nsr-tandem)
++		basic_machine=nsr-tandem
++		;;
++	op50n-* | op60c-*)
++		basic_machine=hppa1.1-oki
++		os=-proelf
++		;;
++	openrisc | openrisc-*)
++		basic_machine=or32-unknown
++		;;
++	os400)
++		basic_machine=powerpc-ibm
++		os=-os400
++		;;
++	OSE68000 | ose68000)
++		basic_machine=m68000-ericsson
++		os=-ose
++		;;
++	os68k)
++		basic_machine=m68k-none
++		os=-os68k
++		;;
++	pa-hitachi)
++		basic_machine=hppa1.1-hitachi
++		os=-hiuxwe2
++		;;
++	paragon)
++		basic_machine=i860-intel
++		os=-osf
++		;;
++	pbd)
++		basic_machine=sparc-tti
++		;;
++	pbb)
++		basic_machine=m68k-tti
++		;;
++	pc532 | pc532-*)
++		basic_machine=ns32k-pc532
++		;;
++	pc98)
++		basic_machine=i386-pc
++		;;
++	pc98-*)
++		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	pentium | p5 | k5 | k6 | nexgen | viac3)
++		basic_machine=i586-pc
++		;;
++	pentiumpro | p6 | 6x86 | athlon | athlon_*)
++		basic_machine=i686-pc
++		;;
++	pentiumii | pentium2 | pentiumiii | pentium3)
++		basic_machine=i686-pc
++		;;
++	pentium4)
++		basic_machine=i786-pc
++		;;
++	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
++		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	pentiumpro-* | p6-* | 6x86-* | athlon-*)
++		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
++		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	pentium4-*)
++		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	pn)
++		basic_machine=pn-gould
++		;;
++	power)	basic_machine=power-ibm
++		;;
++	ppc)	basic_machine=powerpc-unknown
++		;;
++	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	ppcle | powerpclittle | ppc-le | powerpc-little)
++		basic_machine=powerpcle-unknown
++		;;
++	ppcle-* | powerpclittle-*)
++		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	ppc64)	basic_machine=powerpc64-unknown
++		;;
++	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
++		basic_machine=powerpc64le-unknown
++		;;
++	ppc64le-* | powerpc64little-*)
++		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
++		;;
++	ps2)
++		basic_machine=i386-ibm
++		;;
++	pw32)
++		basic_machine=i586-unknown
++		os=-pw32
++		;;
++	rdos)
++		basic_machine=i386-pc
++		os=-rdos
++		;;
++	rom68k)
++		basic_machine=m68k-rom68k
++		os=-coff
++		;;
++	rm[46]00)
++		basic_machine=mips-siemens
++		;;
++	rtpc | rtpc-*)
++		basic_machine=romp-ibm
++		;;
++	s390 | s390-*)
++		basic_machine=s390-ibm
++		;;
++	s390x | s390x-*)
++		basic_machine=s390x-ibm
++		;;
++	sa29200)
++		basic_machine=a29k-amd
++		os=-udi
++		;;
++	sb1)
++		basic_machine=mipsisa64sb1-unknown
++		;;
++	sb1el)
++		basic_machine=mipsisa64sb1el-unknown
++		;;
++	sei)
++		basic_machine=mips-sei
++		os=-seiux
++		;;
++	sequent)
++		basic_machine=i386-sequent
++		;;
++	sh)
++		basic_machine=sh-hitachi
++		os=-hms
++		;;
++	sh64)
++		basic_machine=sh64-unknown
++		;;
++	sparclite-wrs | simso-wrs)
++		basic_machine=sparclite-wrs
++		os=-vxworks
++		;;
++	sps7)
++		basic_machine=m68k-bull
++		os=-sysv2
++		;;
++	spur)
++		basic_machine=spur-unknown
++		;;
++	st2000)
++		basic_machine=m68k-tandem
++		;;
++	stratus)
++		basic_machine=i860-stratus
++		os=-sysv4
++		;;
++	sun2)
++		basic_machine=m68000-sun
++		;;
++	sun2os3)
++		basic_machine=m68000-sun
++		os=-sunos3
++		;;
++	sun2os4)
++		basic_machine=m68000-sun
++		os=-sunos4
++		;;
++	sun3os3)
++		basic_machine=m68k-sun
++		os=-sunos3
++		;;
++	sun3os4)
++		basic_machine=m68k-sun
++		os=-sunos4
++		;;
++	sun4os3)
++		basic_machine=sparc-sun
++		os=-sunos3
++		;;
++	sun4os4)
++		basic_machine=sparc-sun
++		os=-sunos4
++		;;
++	sun4sol2)
++		basic_machine=sparc-sun
++		os=-solaris2
++		;;
++	sun3 | sun3-*)
++		basic_machine=m68k-sun
++		;;
++	sun4)
++		basic_machine=sparc-sun
++		;;
++	sun386 | sun386i | roadrunner)
++		basic_machine=i386-sun
++		;;
++	sv1)
++		basic_machine=sv1-cray
++		os=-unicos
++		;;
++	symmetry)
++		basic_machine=i386-sequent
++		os=-dynix
++		;;
++	t3e)
++		basic_machine=alphaev5-cray
++		os=-unicos
++		;;
++	t90)
++		basic_machine=t90-cray
++		os=-unicos
++		;;
++	tic54x | c54x*)
++		basic_machine=tic54x-unknown
++		os=-coff
++		;;
++	tic55x | c55x*)
++		basic_machine=tic55x-unknown
++		os=-coff
++		;;
++	tic6x | c6x*)
++		basic_machine=tic6x-unknown
++		os=-coff
++		;;
++	tx39)
++		basic_machine=mipstx39-unknown
++		;;
++	tx39el)
++		basic_machine=mipstx39el-unknown
++		;;
++	toad1)
++		basic_machine=pdp10-xkl
++		os=-tops20
++		;;
++	tower | tower-32)
++		basic_machine=m68k-ncr
++		;;
++	tpf)
++		basic_machine=s390x-ibm
++		os=-tpf
++		;;
++	udi29k)
++		basic_machine=a29k-amd
++		os=-udi
++		;;
++	ultra3)
++		basic_machine=a29k-nyu
++		os=-sym1
++		;;
++	v810 | necv810)
++		basic_machine=v810-nec
++		os=-none
++		;;
++	vaxv)
++		basic_machine=vax-dec
++		os=-sysv
++		;;
++	vms)
++		basic_machine=vax-dec
++		os=-vms
++		;;
++	vpp*|vx|vx-*)
++		basic_machine=f301-fujitsu
++		;;
++	vxworks960)
++		basic_machine=i960-wrs
++		os=-vxworks
++		;;
++	vxworks68)
++		basic_machine=m68k-wrs
++		os=-vxworks
++		;;
++	vxworks29k)
++		basic_machine=a29k-wrs
++		os=-vxworks
++		;;
++	w65*)
++		basic_machine=w65-wdc
++		os=-none
++		;;
++	w89k-*)
++		basic_machine=hppa1.1-winbond
++		os=-proelf
++		;;
++	xbox)
++		basic_machine=i686-pc
++		os=-mingw32
++		;;
++	xps | xps100)
++		basic_machine=xps100-honeywell
++		;;
++	ymp)
++		basic_machine=ymp-cray
++		os=-unicos
++		;;
++	z8k-*-coff)
++		basic_machine=z8k-unknown
++		os=-sim
++		;;
++	none)
++		basic_machine=none-none
++		os=-none
++		;;
++
++# Here we handle the default manufacturer of certain CPU types.  It is in
++# some cases the only manufacturer, in others, it is the most popular.
++	w89k)
++		basic_machine=hppa1.1-winbond
++		;;
++	op50n)
++		basic_machine=hppa1.1-oki
++		;;
++	op60c)
++		basic_machine=hppa1.1-oki
++		;;
++	romp)
++		basic_machine=romp-ibm
++		;;
++	mmix)
++		basic_machine=mmix-knuth
++		;;
++	rs6000)
++		basic_machine=rs6000-ibm
++		;;
++	vax)
++		basic_machine=vax-dec
++		;;
++	pdp10)
++		# there are many clones, so DEC is not a safe bet
++		basic_machine=pdp10-unknown
++		;;
++	pdp11)
++		basic_machine=pdp11-dec
++		;;
++	we32k)
++		basic_machine=we32k-att
++		;;
++	sh[1234] | sh[24]a | sh[34]eb | sh[1234]le | sh[23]ele)
++		basic_machine=sh-unknown
++		;;
++	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
++		basic_machine=sparc-sun
++		;;
++	cydra)
++		basic_machine=cydra-cydrome
++		;;
++	orion)
++		basic_machine=orion-highlevel
++		;;
++	orion105)
++		basic_machine=clipper-highlevel
++		;;
++	mac | mpw | mac-mpw)
++		basic_machine=m68k-apple
++		;;
++	pmac | pmac-mpw)
++		basic_machine=powerpc-apple
++		;;
++	*-unknown)
++		# Make sure to match an already-canonicalized machine name.
++		;;
++	*)
++		echo Invalid configuration \`$1\': machine \`$basic_machine\' not recognized 1>&2
++		exit 1
++		;;
++esac
++
++# Here we canonicalize certain aliases for manufacturers.
++case $basic_machine in
++	*-digital*)
++		basic_machine=`echo $basic_machine | sed 's/digital.*/dec/'`
++		;;
++	*-commodore*)
++		basic_machine=`echo $basic_machine | sed 's/commodore.*/cbm/'`
++		;;
++	*)
++		;;
++esac
++
++# Decode manufacturer-specific aliases for certain operating systems.
++
++if [ x"$os" != x"" ]
++then
++case $os in
++        # First match some system type aliases
++        # that might get confused with valid system types.
++	# -solaris* is a basic system type, with this one exception.
++	-solaris1 | -solaris1.*)
++		os=`echo $os | sed -e 's|solaris1|sunos4|'`
++		;;
++	-solaris)
++		os=-solaris2
++		;;
++	-svr4*)
++		os=-sysv4
++		;;
++	-unixware*)
++		os=-sysv4.2uw
++		;;
++	-gnu/linux*)
++		os=`echo $os | sed -e 's|gnu/linux|linux-gnu|'`
++		;;
++	# First accept the basic system types.
++	# The portable systems comes first.
++	# Each alternative MUST END IN A *, to match a version number.
++	# -sysv* is not here because it comes later, after sysvr4.
++	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
++	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
++	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
++	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
++	      | -aos* \
++	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
++	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
++	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
++	      | -openbsd* | -solidbsd* \
++	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
++	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
++	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
++	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
++	      | -chorusos* | -chorusrdb* \
++	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
++	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
++	      | -uxpv* | -beos* | -mpeix* | -udk* \
++	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
++	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
++	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
++	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
++	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
++	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
++	      | -skyos* | -haiku* | -rdos* | -toppers*)
++	# Remember, each alternative MUST END IN *, to match a version number.
++		;;
++	-qnx*)
++		case $basic_machine in
++		    x86-* | i*86-*)
++			;;
++		    *)
++			os=-nto$os
++			;;
++		esac
++		;;
++	-nto-qnx*)
++		;;
++	-nto*)
++		os=`echo $os | sed -e 's|nto|nto-qnx|'`
++		;;
++	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
++	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
++	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
++		;;
++	-mac*)
++		os=`echo $os | sed -e 's|mac|macos|'`
++		;;
++	-linux-dietlibc)
++		os=-linux-dietlibc
++		;;
++	-linux*)
++		os=`echo $os | sed -e 's|linux|linux-gnu|'`
++		;;
++	-sunos5*)
++		os=`echo $os | sed -e 's|sunos5|solaris2|'`
++		;;
++	-sunos6*)
++		os=`echo $os | sed -e 's|sunos6|solaris3|'`
++		;;
++	-opened*)
++		os=-openedition
++		;;
++        -os400*)
++		os=-os400
++		;;
++	-wince*)
++		os=-wince
++		;;
++	-osfrose*)
++		os=-osfrose
++		;;
++	-osf*)
++		os=-osf
++		;;
++	-utek*)
++		os=-bsd
++		;;
++	-dynix*)
++		os=-bsd
++		;;
++	-acis*)
++		os=-aos
++		;;
++	-atheos*)
++		os=-atheos
++		;;
++	-syllable*)
++		os=-syllable
++		;;
++	-386bsd)
++		os=-bsd
++		;;
++	-ctix* | -uts*)
++		os=-sysv
++		;;
++	-nova*)
++		os=-rtmk-nova
++		;;
++	-ns2 )
++		os=-nextstep2
++		;;
++	-nsk*)
++		os=-nsk
++		;;
++	# Preserve the version number of sinix5.
++	-sinix5.*)
++		os=`echo $os | sed -e 's|sinix|sysv|'`
++		;;
++	-sinix*)
++		os=-sysv4
++		;;
++        -tpf*)
++		os=-tpf
++		;;
++	-triton*)
++		os=-sysv3
++		;;
++	-oss*)
++		os=-sysv3
++		;;
++	-svr4)
++		os=-sysv4
++		;;
++	-svr3)
++		os=-sysv3
++		;;
++	-sysvr4)
++		os=-sysv4
++		;;
++	# This must come after -sysvr4.
++	-sysv*)
++		;;
++	-ose*)
++		os=-ose
++		;;
++	-es1800*)
++		os=-ose
++		;;
++	-xenix)
++		os=-xenix
++		;;
++	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
++		os=-mint
++		;;
++	-aros*)
++		os=-aros
++		;;
++	-kaos*)
++		os=-kaos
++		;;
++	-zvmoe)
++		os=-zvmoe
++		;;
++	-none)
++		;;
++	*)
++		# Get rid of the `-' at the beginning of $os.
++		os=`echo $os | sed 's/[^-]*-//'`
++		echo Invalid configuration \`$1\': system \`$os\' not recognized 1>&2
++		exit 1
++		;;
++esac
++else
++
++# Here we handle the default operating systems that come with various machines.
++# The value should be what the vendor currently ships out the door with their
++# machine or put another way, the most popular os provided with the machine.
++
++# Note that if you're going to try to match "-MANUFACTURER" here (say,
++# "-sun"), then you have to tell the case statement up towards the top
++# that MANUFACTURER isn't an operating system.  Otherwise, code above
++# will signal an error saying that MANUFACTURER isn't an operating
++# system, and we'll never get to this point.
++
++case $basic_machine in
++        spu-*)
++		os=-elf
++		;;
++	*-acorn)
++		os=-riscix1.2
++		;;
++	arm*-rebel)
++		os=-linux
++		;;
++	arm*-semi)
++		os=-aout
++		;;
++        c4x-* | tic4x-*)
++        	os=-coff
++		;;
++	# This must come before the *-dec entry.
++	pdp10-*)
++		os=-tops20
++		;;
++	pdp11-*)
++		os=-none
++		;;
++	*-dec | vax-*)
++		os=-ultrix4.2
++		;;
++	m68*-apollo)
++		os=-domain
++		;;
++	i386-sun)
++		os=-sunos4.0.2
++		;;
++	m68000-sun)
++		os=-sunos3
++		# This also exists in the configure program, but was not the
++		# default.
++		# os=-sunos4
++		;;
++	m68*-cisco)
++		os=-aout
++		;;
++	mips*-cisco)
++		os=-elf
++		;;
++	mips*-*)
++		os=-elf
++		;;
++	or32-*)
++		os=-coff
++		;;
++	*-tti)	# must be before sparc entry or we get the wrong os.
++		os=-sysv3
++		;;
++	sparc-* | *-sun)
++		os=-sunos4.1.1
++		;;
++	*-be)
++		os=-beos
++		;;
++	*-haiku)
++		os=-haiku
++		;;
++	*-ibm)
++		os=-aix
++		;;
++    	*-knuth)
++		os=-mmixware
++		;;
++	*-wec)
++		os=-proelf
++		;;
++	*-winbond)
++		os=-proelf
++		;;
++	*-oki)
++		os=-proelf
++		;;
++	*-hp)
++		os=-hpux
++		;;
++	*-hitachi)
++		os=-hiux
++		;;
++	i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent)
++		os=-sysv
++		;;
++	*-cbm)
++		os=-amigaos
++		;;
++	*-dg)
++		os=-dgux
++		;;
++	*-dolphin)
++		os=-sysv3
++		;;
++	m68k-ccur)
++		os=-rtu
++		;;
++	m88k-omron*)
++		os=-luna
++		;;
++	*-next )
++		os=-nextstep
++		;;
++	*-sequent)
++		os=-ptx
++		;;
++	*-crds)
++		os=-unos
++		;;
++	*-ns)
++		os=-genix
++		;;
++	i370-*)
++		os=-mvs
++		;;
++	*-next)
++		os=-nextstep3
++		;;
++	*-gould)
++		os=-sysv
++		;;
++	*-highlevel)
++		os=-bsd
++		;;
++	*-encore)
++		os=-bsd
++		;;
++	*-sgi)
++		os=-irix
++		;;
++	*-siemens)
++		os=-sysv4
++		;;
++	*-masscomp)
++		os=-rtu
++		;;
++	f30[01]-fujitsu | f700-fujitsu)
++		os=-uxpv
++		;;
++	*-rom68k)
++		os=-coff
++		;;
++	*-*bug)
++		os=-coff
++		;;
++	*-apple)
++		os=-macos
++		;;
++	*-atari*)
++		os=-mint
++		;;
++	*)
++		os=-none
++		;;
++esac
++fi
++
++# Here we handle the case where we know the os, and the CPU type, but not the
++# manufacturer.  We pick the logical manufacturer.
++vendor=unknown
++case $basic_machine in
++	*-unknown)
++		case $os in
++			-riscix*)
++				vendor=acorn
++				;;
++			-sunos*)
++				vendor=sun
++				;;
++			-aix*)
++				vendor=ibm
++				;;
++			-beos*)
++				vendor=be
++				;;
++			-hpux*)
++				vendor=hp
++				;;
++			-mpeix*)
++				vendor=hp
++				;;
++			-hiux*)
++				vendor=hitachi
++				;;
++			-unos*)
++				vendor=crds
++				;;
++			-dgux*)
++				vendor=dg
++				;;
++			-luna*)
++				vendor=omron
++				;;
++			-genix*)
++				vendor=ns
++				;;
++			-mvs* | -opened*)
++				vendor=ibm
++				;;
++			-os400*)
++				vendor=ibm
++				;;
++			-ptx*)
++				vendor=sequent
++				;;
++			-tpf*)
++				vendor=ibm
++				;;
++			-vxsim* | -vxworks* | -windiss*)
++				vendor=wrs
++				;;
++			-aux*)
++				vendor=apple
++				;;
++			-hms*)
++				vendor=hitachi
++				;;
++			-mpw* | -macos*)
++				vendor=apple
++				;;
++			-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
++				vendor=atari
++				;;
++			-vos*)
++				vendor=stratus
++				;;
++		esac
++		basic_machine=`echo $basic_machine | sed "s/unknown/$vendor/"`
++		;;
++esac
++
++echo $basic_machine$os
++exit
++
++# Local variables:
++# eval: (add-hook 'write-file-hooks 'time-stamp)
++# time-stamp-start: "timestamp='"
++# time-stamp-format: "%:y-%02m-%02d"
++# time-stamp-end: "'"
++# End:
--- pe-httpd-2.2.29.orig/debian/patches/00list
+++ pe-httpd-2.2.29/debian/patches/00list
@@ -0,0 +1,28 @@
+001_branding
+004_usr_bin_perl_0wnz_j00
+008_make_include_safe
+009_apache2_has_dso
+032_suexec_is_shared
+033_dbm_read_hash_or_btree
+034_apxs2_libtool_fixtastic
+045_suexec_log_cloexec.dpatch
+052_logresolve_linelength.dpatch
+057_disablemods.dpatch
+058_suexec-CVE-2007-1742.dpatch
+067_fix_segfault_in_ab.dpatch
+069_no_deflate_for_HEAD.dpatch
+071_fix_cacheenable.dpatch
+073_mod_dav_trunk_fixes.dpatch
+074_link_support_progs_with_lcrypt.dpatch
+075_mod_rewrite_literal_ipv6_redirect.dpatch
+076_apxs2_a2enmod.dpatch
+077_CacheIgnoreURLSessionIdentifiers.dpatch
+079_polish_translation.dpatch
+082_ab_num_requests.dpatch
+099_config_guess_sub_update.dpatch
+200_cp_suexec.dpatch
+201_build_suexec-custom.dpatch
+202_suexec-custom.dpatch
+203_fix-ab-segfault.dpatch
+218_httpd-2.2.29-logjam.dpatch
+999_Puppet_layout.dpatch
--- pe-httpd-2.2.29.orig/debian/patches/11-CVE-2011-1176.patch
+++ pe-httpd-2.2.29/debian/patches/11-CVE-2011-1176.patch
@@ -0,0 +1,20 @@
+Origin: upstream, http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857
+Description: If NiceValue was set, the default with no
+  AssignUserID was to run as root:root instead of the default Apache
+  user and group, due to the configuration merger having an incorrect
+  default configuration.
+
+CVE-2011-1176
+
+diff -u httpd-2.2.11/server/mpm/experimental/itk/itk.c httpd-2.2.11/server/mpm/experimental/itk/itk.c
+--- httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-04-14 23:31:05.000000000 +0200
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-04-14 23:31:05.000000000 +0200
+@@ -1698,7 +1698,7 @@
+ static void *itk_merge_dir_config(apr_pool_t *p, void *parent_ptr, void *child_ptr)
+ {
+     itk_per_dir_conf *c = (itk_per_dir_conf *)
+-        apr_pcalloc(p, sizeof(itk_per_dir_conf));
++        itk_create_dir_config(p, NULL);
+     itk_per_dir_conf *parent = (itk_per_dir_conf *) parent_ptr;
+     itk_per_dir_conf *child = (itk_per_dir_conf *) child_ptr;
+ 
--- pe-httpd-2.2.29.orig/debian/patches/216_httpd-2.2.15-CVE-2014-0118.dpatch
+++ pe-httpd-2.2.29/debian/patches/216_httpd-2.2.15-CVE-2014-0118.dpatch
@@ -0,0 +1,283 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 216_httpd-2.2.15-CVE-2014-0118.dpatch by Ryan McKern <ryan.mckern@puppetlabs.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix for CVE-2014-0118 (mod_deflate denial of service)
+
+@DPATCH@
+
+Index: modules/filters/mod_deflate.c
+===================================================================
+--- a/modules/filters/mod_deflate.c	(revision 1610517)
++++ b/modules/filters/mod_deflate.c	(working copy)
+@@ -37,6 +37,7 @@
+ #include "httpd.h"
+ #include "http_config.h"
+ #include "http_log.h"
++#include "http_core.h"
+ #include "apr_lib.h"
+ #include "apr_strings.h"
+ #include "apr_general.h"
+@@ -51,6 +52,9 @@
+ static const char deflateFilterName[] = "DEFLATE";
+ module AP_MODULE_DECLARE_DATA deflate_module;
+ 
++#define AP_INFLATE_RATIO_LIMIT 200
++#define AP_INFLATE_RATIO_BURST 3
++
+ typedef struct deflate_filter_config_t
+ {
+     int windowSize;
+@@ -62,6 +66,12 @@
+     char *note_output_name;
+ } deflate_filter_config;
+ 
++typedef struct deflate_dirconf_t {
++    apr_off_t inflate_limit;
++    int ratio_limit,
++        ratio_burst;
++} deflate_dirconf_t;
++
+ /* RFC 1952 Section 2.3 defines the gzip header:
+  *
+  * +---+---+---+---+---+---+---+---+---+---+
+@@ -193,6 +203,14 @@
+     return c;
+ }
+ 
++static void *create_deflate_dirconf(apr_pool_t *p, char *dummy)
++{
++    deflate_dirconf_t *dc = apr_pcalloc(p, sizeof(*dc));
++    dc->ratio_limit = AP_INFLATE_RATIO_LIMIT;
++    dc->ratio_burst = AP_INFLATE_RATIO_BURST;
++    return dc;
++}
++
+ static const char *deflate_set_window_size(cmd_parms *cmd, void *dummy,
+                                            const char *arg)
+ {
+@@ -284,6 +302,55 @@
+     return NULL;
+ }
+ 
++
++static const char *deflate_set_inflate_limit(cmd_parms *cmd, void *dirconf,
++                                      const char *arg)
++{
++    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
++    char *errp;
++
++    if (APR_SUCCESS != apr_strtoff(&dc->inflate_limit, arg, &errp, 10)) {
++        return "DeflateInflateLimitRequestBody is not parsable.";
++    }
++    if (*errp || dc->inflate_limit < 0) {
++        return "DeflateInflateLimitRequestBody requires a non-negative integer.";
++    }
++
++    return NULL;
++}
++
++static const char *deflate_set_inflate_ratio_limit(cmd_parms *cmd,
++                                                   void *dirconf,
++                                                   const char *arg)
++{
++    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
++    int i;
++
++    i = atoi(arg);
++    if (i <= 0)
++        return "DeflateInflateRatioLimit must be positive";
++
++    dc->ratio_limit = i;
++
++    return NULL;
++}
++
++static const char *deflate_set_inflate_ratio_burst(cmd_parms *cmd,
++                                                   void *dirconf,
++                                                   const char *arg)
++{
++    deflate_dirconf_t *dc = (deflate_dirconf_t*) dirconf;
++    int i;
++
++    i = atoi(arg);
++    if (i <= 0)
++        return "DeflateInflateRatioBurst must be positive";
++
++    dc->ratio_burst = i;
++
++    return NULL;
++}
++
+ typedef struct deflate_ctx_t
+ {
+     z_stream stream;
+@@ -294,8 +361,26 @@
+     unsigned char *validation_buffer;
+     apr_size_t validation_buffer_length;
+     int inflate_init;
++    int ratio_hits;
++    apr_off_t inflate_total;
+ } deflate_ctx;
+ 
++/* Check whether the (inflate) ratio exceeds the configured limit/burst. */
++static int check_ratio(request_rec *r, deflate_ctx *ctx,
++                       const deflate_dirconf_t *dc)
++{
++    if (ctx->stream.total_in) {
++        int ratio = ctx->stream.total_out / ctx->stream.total_in;
++        if (ratio < dc->ratio_limit) {
++            ctx->ratio_hits = 0;
++        }
++        else if (++ctx->ratio_hits > dc->ratio_burst) {
++            return 0;
++        }
++    }
++    return 1;
++}
++
+ /* Number of validation bytes (CRC and length) after the compressed data */
+ #define VALIDATION_SIZE 8
+ /* Do not update ctx->crc, see comment in flush_libz_buffer */
+@@ -744,6 +829,8 @@
+     int zRC;
+     apr_status_t rv;
+     deflate_filter_config *c;
++    deflate_dirconf_t *dc;
++    apr_off_t inflate_limit;
+ 
+     /* just get out of the way of things we don't want. */
+     if (mode != AP_MODE_READBYTES) {
+@@ -751,6 +838,7 @@
+     }
+ 
+     c = ap_get_module_config(r->server->module_config, &deflate_module);
++    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
+ 
+     if (!ctx) {
+         char deflate_hdr[10];
+@@ -803,11 +891,13 @@
+         if (len != 10 ||
+             deflate_hdr[0] != deflate_magic[0] ||
+             deflate_hdr[1] != deflate_magic[1]) {
++            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Failed to inflate input: wrong/partial magic bytes");
+             return APR_EGENERAL;
+         }
+ 
+         /* We can't handle flags for now. */
+         if (deflate_hdr[3] != 0) {
++            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Failed to inflate input: cannot handle deflate flags");
+             return APR_EGENERAL;
+         }
+ 
+@@ -831,6 +921,12 @@
+         apr_brigade_cleanup(ctx->bb);
+     }
+ 
++    inflate_limit = dc->inflate_limit; 
++    if (inflate_limit == 0) { 
++        /* The core is checking the deflated body, we'll check the inflated */
++        inflate_limit = ap_get_limit_req_body(f->r);
++    }
++
+     if (APR_BRIGADE_EMPTY(ctx->proc_bb)) {
+         rv = ap_get_brigade(f->next, ctx->bb, mode, block, readbytes);
+ 
+@@ -863,6 +959,17 @@
+ 
+                 ctx->stream.next_out = ctx->buffer;
+                 len = c->bufferSize - ctx->stream.avail_out;
++ 
++                ctx->inflate_total += len;
++                if (inflate_limit && ctx->inflate_total > inflate_limit) { 
++                    inflateEnd(&ctx->stream);
++                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
++                            "Inflated content length of %" APR_OFF_T_FMT
++                            " is larger than the configured limit"
++                            " of %" APR_OFF_T_FMT, 
++                            ctx->inflate_total, inflate_limit);
++                    return APR_ENOSPC;
++                }
+ 
+                 ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
+                 tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
+@@ -891,6 +998,26 @@
+                     ctx->stream.next_out = ctx->buffer;
+                     len = c->bufferSize - ctx->stream.avail_out;
+ 
++                      ctx->inflate_total += len;
++                      if (inflate_limit && ctx->inflate_total > inflate_limit) { 
++                          inflateEnd(&ctx->stream);
++                          ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
++                                  "Inflated content length of %" APR_OFF_T_FMT
++                                  " is larger than the configured limit"
++                                  " of %" APR_OFF_T_FMT, 
++                                  ctx->inflate_total, inflate_limit);
++                          return APR_ENOSPC;
++                      }
++
++                      if (!check_ratio(r, ctx, dc)) {
++                          inflateEnd(&ctx->stream);
++                          ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
++                                  "Inflated content ratio is larger than the "
++                                  "configured limit %i by %i time(s)",
++                                  dc->ratio_limit, dc->ratio_burst);
++                          return APR_EINVAL;
++                      }
++
+                     ctx->crc = crc32(ctx->crc, (const Bytef *)ctx->buffer, len);
+                     tmp_heap = apr_bucket_heap_create((char *)ctx->buffer, len,
+                                                       NULL, f->c->bucket_alloc);
+@@ -1003,6 +1130,7 @@
+     int zRC;
+     apr_status_t rv;
+     deflate_filter_config *c;
++    deflate_dirconf_t *dc;
+ 
+     /* Do nothing if asked to filter nothing. */
+     if (APR_BRIGADE_EMPTY(bb)) {
+@@ -1010,6 +1138,7 @@
+     }
+ 
+     c = ap_get_module_config(r->server->module_config, &deflate_module);
++    dc = ap_get_module_config(r->per_dir_config, &deflate_module);
+ 
+     if (!ctx) {
+ 
+@@ -1272,6 +1401,14 @@
+         while (ctx->stream.avail_in != 0) {
+             if (ctx->stream.avail_out == 0) {
+ 
++                if (!check_ratio(r, ctx, dc)) {
++                    ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, 
++                            "Inflated content ratio is larger than the "
++                            "configured limit %i by %i time(s)",
++                            dc->ratio_limit, dc->ratio_burst);
++                    return APR_EINVAL;
++                }
++
+                 ctx->stream.next_out = ctx->buffer;
+                 len = c->bufferSize - ctx->stream.avail_out;
+ 
+@@ -1346,12 +1483,20 @@
+                   "Set the Deflate Memory Level (1-9)"),
+     AP_INIT_TAKE1("DeflateCompressionLevel", deflate_set_compressionlevel, NULL, RSRC_CONF,
+                   "Set the Deflate Compression Level (1-9)"),
++    AP_INIT_TAKE1("DeflateInflateLimitRequestBody", deflate_set_inflate_limit, NULL, OR_ALL,
++                  "Set a limit on size of inflated input"),
++    AP_INIT_TAKE1("DeflateInflateRatioLimit", deflate_set_inflate_ratio_limit, NULL, OR_ALL,
++                  "Set the inflate ratio limit above which inflation is "
++                  "aborted (default: " APR_STRINGIFY(AP_INFLATE_RATIO_LIMIT) ")"),
++    AP_INIT_TAKE1("DeflateInflateRatioBurst", deflate_set_inflate_ratio_burst, NULL, OR_ALL,
++                  "Set the maximum number of following inflate ratios above limit "
++                  "(default: " APR_STRINGIFY(AP_INFLATE_RATIO_BURST) ")"),
+     {NULL}
+ };
+ 
+ module AP_MODULE_DECLARE_DATA deflate_module = {
+     STANDARD20_MODULE_STUFF,
+-    NULL,                         /* dir config creater */
++    create_deflate_dirconf,       /* dir config creater */
+     NULL,                         /* dir merger --- default is to override */
+     create_deflate_server_config, /* server config */
+     NULL,                         /* merge server config */
--- pe-httpd-2.2.29.orig/debian/patches/004_usr_bin_perl_0wnz_j00
+++ pe-httpd-2.2.29/debian/patches/004_usr_bin_perl_0wnz_j00
@@ -0,0 +1,15 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 004_usr_bin_perl_0wnz_j00 by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Call /usr/bin/perl in printenv, not /usr/local/bin/perl
+
+@DPATCH@
+--- apache2/docs/cgi-examples/printenv.orig	Fri Sep 21 17:31:24 2001
++++ apache2/docs/cgi-examples/printenv	Fri Sep 21 17:31:29 2001
+@@ -1,4 +1,4 @@
+-#!/usr/local/bin/perl
++#!/usr/bin/perl
+ ##
+ ##  printenv -- demo CGI program which just prints its environment
+ ##
--- pe-httpd-2.2.29.orig/debian/patches/999_Puppet_layout.dpatch
+++ pe-httpd-2.2.29/debian/patches/999_Puppet_layout.dpatch
@@ -0,0 +1,42 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 999_Puppet_layout.dpatch by Jacob Helwig <jacob@puppetlabs.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Add Puppet Enterprise layout
+
+@DPATCH@
+
+diff --git i/config.layout w/config.layout
+index 03cb8f5..46fb870 100644
+--- i/config.layout
++++ w/config.layout
+@@ -322,3 +322,28 @@
+     installbuilddir: ${prefix}/etc/apache2/build
+     errordir:      ${datadir}/error
+ </Layout>
++
++# Puppet layout
++<Layout Puppet>
++    prefix:          /opt/puppet
++    exec_prefix:     ${prefix}
++    bindir:          ${exec_prefix}/bin
++    sbindir:         ${exec_prefix}/sbin
++    libdir:          ${exec_prefix}/lib
++    libexecdir:      ${exec_prefix}/lib/httpd/modules
++    mandir:          ${exec_prefix}/share/man
++    sysconfdir:      /etc/puppetlabs/httpd
++    datadir:         ${exec_prefix}/share/httpd
++    iconsdir:        ${datadir}/icons
++    htdocsdir:       ${prefix}/share/httpd/default-site/htdocs
++    manualdir:       ${htdocsdir}/manual
++    cgidir:          ${prefix}/lib/cgi-bin
++    includedir:      ${exec_prefix}/include/httpd
++    localstatedir:   /var/lock/pe-httpd
++    runtimedir:      /var/run/pe-httpd
++    logfiledir:      /var/log/pe-httpd
++    proxycachedir:   /var/cache/pe-httpd/proxy
++    infodir:         ${exec_prefix}/share/info
++    installbuilddir: ${prefix}/share/httpd/build
++    errordir:        ${datadir}/error
++</Layout>
+
--- pe-httpd-2.2.29.orig/debian/patches/033_dbm_read_hash_or_btree
+++ pe-httpd-2.2.29/debian/patches/033_dbm_read_hash_or_btree
@@ -0,0 +1,38 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 033_dbm_read_hash_or_btree by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Be more liberal in the sorts of DBM files we accept.
+
+@DPATCH@
+--- apache2/support/dbmmanage.in	2004-09-28 00:28:58.000000000 -0600
++++ apache2/support/dbmmanage.in	2004-09-28 00:29:33.000000000 -0600
+@@ -24,7 +24,7 @@
+ BEGIN { @AnyDBM_File::ISA = qw(DB_File NDBM_File GDBM_File SDBM_File) }
+ use strict;
+ use Fcntl;
+-use AnyDBM_File ();
++use DB_File ();
+ 
+ sub usage {
+     my $cmds = join "|", sort keys %dbmc::;
+@@ -154,7 +154,9 @@
+ my($mode, $flags) = $command =~
+     /^(?:view|check)$/ ? (0644, O_RDONLY) : (0644, O_RDWR|O_CREAT);
+ 
+-tie (%DB, "AnyDBM_File", $file, $flags, $mode) || die "Can't tie $file: $!";
++tie (%DB, "DB_File", $file, $flags, $mode, $DB_File::DB_HASH) ||
++    tie (%DB, "DB_File", $file, $flags, $mode, $DB_File::DB_BTREE) ||
++    die "Can't tie $file: $!";
+ dbmc->$command();
+ untie %DB;
+ 
+@@ -168,7 +168,7 @@
+         srand (time ^ $$ or time ^ ($$ + ($$ << 15)));
+     }
+     else {
+-        for (qw(-xlwwa -le)) {
++        for (qw(xlwwa -le)) {
+             `ps $_ 2>/dev/null`;
+             $psf = $_, last unless $?;
+         }
--- pe-httpd-2.2.29.orig/debian/patches/202_suexec-custom.dpatch
+++ pe-httpd-2.2.29/debian/patches/202_suexec-custom.dpatch
@@ -0,0 +1,201 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 202_suexec-custom.dpatch by Stefan Fritsch <sf@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: the actual patch to make suexec-custom read a config file
+
+@DPATCH@
+diff -urNad trunk~/support/suexec-custom.c trunk/support/suexec-custom.c
+--- trunk~/support/suexec-custom.c	2008-05-04 19:41:30.559379143 +0200
++++ trunk/support/suexec-custom.c	2008-05-04 19:42:30.817574842 +0200
+@@ -29,6 +29,7 @@
+  *
+  *
+  */
++#define SUEXEC_CONFIG_DIR "/etc/apache2/suexec/"
+ 
+ #include "apr.h"
+ #include "ap_config.h"
+@@ -39,6 +40,7 @@
+ #include <sys/types.h>
+ #include <string.h>
+ #include <time.h>
++#include <ctype.h>
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
+@@ -203,6 +205,26 @@
+     return;
+ }
+ 
++static int read_line(char *buf, FILE *file) {
++    char *p;
++    p = fgets(buf, AP_MAXPATH+1, file);
++    if (!p) return 0;
++    if (*p == '\0') return 1;
++
++    p = buf;
++    while (*p)
++        p++;
++    p--;
++
++    /* remove trailing space and slash */
++    while ( isspace(*p) && p >= buf )
++        *p-- = '\0';
++    while ( *p == '/' && p >= buf )
++        *p-- = '\0';
++
++    return 1;
++}
++
+ static void clean_env(void)
+ {
+     char pathbuf[512];
+@@ -266,6 +288,10 @@
+     struct stat dir_info;   /* directory info holder     */
+     struct stat prg_info;   /* program info holder       */
+     int cwdh;               /* handle to cwd             */
++    char *suexec_docroot        = NULL;
++    char *suexec_userdir_suffix = NULL;
++    char *filename              = NULL;
++    FILE *configfile;
+ 
+     /*
+      * Start with a "clean" environment
+@@ -296,15 +322,10 @@
+             || (! strcmp(AP_HTTPD_USER, pw->pw_name)))
+ #endif /* _OSD_POSIX */
+         ) {
+-#ifdef AP_DOC_ROOT
+-        fprintf(stderr, " -D AP_DOC_ROOT=\"%s\"\n", AP_DOC_ROOT);
+-#endif
++	fprintf(stderr, " -D SUEXEC_CONFIG_DIR=%s\n", SUEXEC_CONFIG_DIR);
+ #ifdef AP_GID_MIN
+         fprintf(stderr, " -D AP_GID_MIN=%d\n", AP_GID_MIN);
+ #endif
+-#ifdef AP_HTTPD_USER
+-        fprintf(stderr, " -D AP_HTTPD_USER=\"%s\"\n", AP_HTTPD_USER);
+-#endif
+ #ifdef AP_LOG_EXEC
+         fprintf(stderr, " -D AP_LOG_EXEC=\"%s\"\n", AP_LOG_EXEC);
+ #endif
+@@ -317,9 +338,6 @@
+ #ifdef AP_UID_MIN
+         fprintf(stderr, " -D AP_UID_MIN=%d\n", AP_UID_MIN);
+ #endif
+-#ifdef AP_USERDIR_SUFFIX
+-        fprintf(stderr, " -D AP_USERDIR_SUFFIX=\"%s\"\n", AP_USERDIR_SUFFIX);
+-#endif
+         exit(0);
+     }
+     /*
+@@ -334,23 +352,6 @@
+     target_gname = argv[2];
+     cmd = argv[3];
+ 
+-    /*
+-     * Check to see if the user running this program
+-     * is the user allowed to do so as defined in
+-     * suexec.h.  If not the allowed user, error out.
+-     */
+-#ifdef _OSD_POSIX
+-    /* User name comparisons are case insensitive on BS2000/OSD */
+-    if (strcasecmp(AP_HTTPD_USER, pw->pw_name)) {
+-        log_err("user mismatch (%s instead of %s)\n", pw->pw_name, AP_HTTPD_USER);
+-        exit(103);
+-    }
+-#else  /*_OSD_POSIX*/
+-    if (strcmp(AP_HTTPD_USER, pw->pw_name)) {
+-        log_err("user mismatch (%s instead of %s)\n", pw->pw_name, AP_HTTPD_USER);
+-        exit(103);
+-    }
+-#endif /*_OSD_POSIX*/
+ 
+     /*
+      * Check for a leading '/' (absolute path) in the command to be executed,
+@@ -375,6 +376,63 @@
+     }
+ 
+     /*
++     * Check to see if the user running this program
++     * is the user allowed to do so as defined in
++     * SUEXEC_CONFIG_DIR/username
++     * If not, error out.
++     */
++    filename = malloc(AP_MAXPATH+1);
++    suexec_docroot = malloc(AP_MAXPATH+1);
++    suexec_userdir_suffix = malloc(AP_MAXPATH+1);
++    if (!filename || !suexec_docroot || !suexec_userdir_suffix) {
++        log_err("malloc failed\n");
++	exit(120);
++    }
++
++    strncpy(filename, SUEXEC_CONFIG_DIR, AP_MAXPATH);
++    strncat(filename, pw->pw_name, AP_MAXPATH);
++    filename[AP_MAXPATH] = '\0';
++
++    configfile = fopen(filename, "r");
++    if (!configfile) {
++    	log_err("User %s not allowed: Could not open config file %s\n", pw->pw_name, filename);
++	exit(123);
++    }
++
++    if (!read_line(suexec_docroot, configfile)) {
++    	log_err("Could not read docroot from %s\n", filename);
++	exit(124);
++    }
++
++    if (!read_line(suexec_userdir_suffix, configfile)) {
++    	log_err("Could not read userdir suffix from %s\n", filename);
++	exit(125);
++    }
++
++    fclose(configfile);
++
++    if (userdir) {
++        if ( !isalnum(*suexec_userdir_suffix) && suexec_userdir_suffix[0] != '.') {
++		log_err("userdir suffix disabled in %s\n", filename);
++		exit(126);
++	}
++    }
++    else {
++    	if (suexec_docroot[0] != '/') {
++		log_err("docroot disabled in %s\n", filename);
++		exit(127);
++    	}
++
++    	if (suexec_docroot[1] == '/' ||
++	    suexec_docroot[1] == '.' ||
++	    suexec_docroot[1] == '\0' )
++	{
++		log_err("invalid docroot %s in %s\n", suexec_docroot, filename);
++		exit(128);
++    	}
++    }
++    
++    /*
+      * Error out if the target username is invalid.
+      */
+     if (strspn(target_uname, "1234567890") != strlen(target_uname)) {
+@@ -506,7 +564,7 @@
+ 
+     if (userdir) {
+         if (((chdir(target_homedir)) != 0) ||
+-            ((chdir(AP_USERDIR_SUFFIX)) != 0) ||
++            ((chdir(suexec_userdir_suffix)) != 0) ||
+             ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+             ((fchdir(cwdh)) != 0)) {
+             log_err("cannot get docroot information (%s)\n", target_homedir);
+@@ -514,10 +572,10 @@
+         }
+     }
+     else {
+-        if (((chdir(AP_DOC_ROOT)) != 0) ||
++        if (((chdir(suexec_docroot)) != 0) ||
+             ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+             ((fchdir(cwdh)) != 0)) {
+-            log_err("cannot get docroot information (%s)\n", AP_DOC_ROOT);
++            log_err("cannot get docroot information (%s)\n", suexec_docroot);
+             exit(113);
+         }
+     }
--- pe-httpd-2.2.29.orig/debian/patches/067_fix_segfault_in_ab.dpatch
+++ pe-httpd-2.2.29/debian/patches/067_fix_segfault_in_ab.dpatch
@@ -0,0 +1,20 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 067_fix_segfault_in_ab.dpatch by Ryan Niebur <ryanryan52@gmail.com>
+##
+## DP: Do not free what SSL_get_peer_cert_chain returns. It returns a
+## pointer to memory that is freed later on with the
+## session. (Bug#495982)
+## Forwarded: https://issues.apache.org/bugzilla/show_bug.cgi?id=46393
+
+@DPATCH@
+diff -urNad apache2-2.2.9~/support/ab.c apache2-2.2.9/support/ab.c
+--- apache2-2.2.9~/support/ab.c	2008-05-28 05:58:01.000000000 -0700
++++ apache2-2.2.9/support/ab.c	2008-11-29 15:47:41.000000000 -0800
+@@ -535,7 +535,6 @@
+         for (i=1; i<count; i++) {
+             cert = (X509 *)SK_VALUE(sk, i);
+             ssl_print_cert_info(bio_out, cert);
+-            X509_free(cert);
+     }
+     }
+     cert = SSL_get_peer_certificate(c->ssl);
--- pe-httpd-2.2.29.orig/debian/patches/071_fix_cacheenable.dpatch
+++ pe-httpd-2.2.29/debian/patches/071_fix_cacheenable.dpatch
@@ -0,0 +1,118 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Bug #442266
+## DP: r821333,r821538,r821539 from upstream svn
+
+@DPATCH@
+diff --git a/modules/cache/cache_util.c b/modules/cache/cache_util.c
+index ec2d749..aec7b09 100644
+--- a/modules/cache/cache_util.c
++++ b/modules/cache/cache_util.c
+@@ -27,41 +27,78 @@ extern module AP_MODULE_DECLARE_DATA cache_module;
+ /* Determine if "url" matches the hostname, scheme and port and path
+  * in "filter". All but the path comparisons are case-insensitive.
+  */
+-static int uri_meets_conditions(apr_uri_t filter, int pathlen, apr_uri_t url)
+-{
+-    /* Compare the hostnames */
+-    if(filter.hostname) {
+-        if (!url.hostname) {
+-            return 0;
+-        }
+-        else if (strcasecmp(filter.hostname, url.hostname)) {
+-            return 0;
+-        }
+-    }
++static int uri_meets_conditions(const apr_uri_t filter, const int pathlen,
++        const apr_uri_t url) {
++
++    /* Scheme, hostname port and local part. The filter URI and the
++     * URI we test may have the following shapes:
++     *   /<path>
++     *   <scheme>[:://<hostname>[:<port>][/<path>]]
++     * That is, if there is no scheme then there must be only the path,
++     * and we check only the path; if there is a scheme, we check the
++     * scheme for equality, and then if present we match the hostname,
++     * and then if present match the port, and finally the path if any.
++     *
++     * Note that this means that "/<path>" only matches local paths,
++     * and to match proxied paths one *must* specify the scheme.
++     */
+ 
+-    /* Compare the schemes */
+-    if(filter.scheme) {
+-        if (!url.scheme) {
+-            return 0;
+-        }
+-        else if (strcasecmp(filter.scheme, url.scheme)) {
++    /* Is the filter is just for a local path or a proxy URI? */
++    if (!filter.scheme) {
++        if (url.scheme || url.hostname) {
+             return 0;
+         }
+     }
+-
+-    /* Compare the ports */
+-    if(filter.port_str) {
+-        if (url.port_str && filter.port != url.port) {
++    else {
++        /* The URI scheme must be present and identical except for case. */
++        if (!url.scheme || strcasecmp(filter.scheme, url.scheme)) {
+             return 0;
+         }
+-        /* NOTE:  ap_port_of_scheme will return 0 if given NULL input */
+-        else if (filter.port != apr_uri_port_of_scheme(url.scheme)) {
+-            return 0;
++
++        /* If the filter hostname is null or empty it matches any hostname,
++         * if it begins with a "*" it matches the _end_ of the URI hostname
++         * excluding the "*", if it begins with a "." it matches the _end_
++         * of the URI * hostname including the ".", otherwise it must match
++         * the URI hostname exactly. */
++
++        if (filter.hostname && filter.hostname[0]) {
++            if (filter.hostname[0] == '.') {
++                const size_t fhostlen = strlen(filter.hostname);
++                const size_t uhostlen = url.hostname ? strlen(url.hostname) : 0;
++
++                if (fhostlen > uhostlen || strcasecmp(filter.hostname,
++                        url.hostname + uhostlen - fhostlen)) {
++                    return 0;
++                }
++            }
++            else if (filter.hostname[0] == '*') {
++                const size_t fhostlen = strlen(filter.hostname + 1);
++                const size_t uhostlen = url.hostname ? strlen(url.hostname) : 0;
++
++                if (fhostlen > uhostlen || strcasecmp(filter.hostname + 1,
++                        url.hostname + uhostlen - fhostlen)) {
++                    return 0;
++                }
++            }
++            else if (!url.hostname || strcasecmp(filter.hostname, url.hostname)) {
++                return 0;
++            }
+         }
+-    }
+-    else if(url.port_str && filter.scheme) {
+-        if (apr_uri_port_of_scheme(filter.scheme) == url.port) {
+-            return 0;
++
++        /* If the filter port is empty it matches any URL port.
++         * If the filter or URL port are missing, or the URL port is
++         * empty, they default to the port for their scheme. */
++
++        if (!(filter.port_str && !filter.port_str[0])) {
++            /* NOTE:  ap_port_of_scheme will return 0 if given NULL input */
++            const unsigned fport = filter.port_str ? filter.port
++                    : apr_uri_port_of_scheme(filter.scheme);
++            const unsigned uport = (url.port_str && url.port_str[0])
++                    ? url.port : apr_uri_port_of_scheme(url.scheme);
++
++            if (fport != uport) {
++                return 0;
++            }
+         }
+     }
+ 
--- pe-httpd-2.2.29.orig/debian/patches/008_make_include_safe
+++ pe-httpd-2.2.29/debian/patches/008_make_include_safe
@@ -0,0 +1,68 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 008_make_include_safe by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Avoid including dpkg droppings in globbed includes.
+
+@DPATCH@
+--- apache2-2.2.0/server/config.c	2005-11-17 13:39:15.000000000 +0000
++++ apache2-2.2.0/server/config.c	2006-01-27 17:06:19.000000000 +0000
+@@ -34,6 +34,7 @@
+ #include "apr_portable.h"
+ #include "apr_file_io.h"
+ #include "apr_fnmatch.h"
++#include "apr_lib.h"
+ 
+ #define APR_WANT_STDIO
+ #define APR_WANT_STRFUNC
+@@ -1521,6 +1522,30 @@
+     return strcmp(f1->fname,f2->fname);
+ }
+ 
++static int fname_valid(const char *fname) {
++    const unsigned char *c = fname;
++    unsigned char bad_dpkg[] = "*.dpkg*";
++
++    if (!apr_isalnum(*c)) {
++        return 0;
++    }
++    ++c;
++    
++    
++    while (*c) {
++        if (!apr_isalnum(*c) && *c!='_' && *c!='-' && *c!='.') {
++            return 0;
++        }
++        ++c;
++    }
++
++    if (!apr_fnmatch(bad_dpkg, fname, 0)) {
++        return 0;
++    }
++
++    return 1;
++}
++
+ static const char *process_resource_config_nofnmatch(server_rec *s,
+                                                      const char *fname,
+                                                      ap_directive_t **conftree,
+@@ -1564,7 +1589,8 @@
+         while (apr_dir_read(&dirent, APR_FINFO_DIRENT, dirp) == APR_SUCCESS) {
+             /* strip out '.' and '..' */
+             if (strcmp(dirent.name, ".")
+-                && strcmp(dirent.name, "..")) {
++                && strcmp(dirent.name, "..")
++                && fname_valid(dirent.name)) {
+                 fnew = (fnames *) apr_array_push(candidates);
+                 fnew->fname = ap_make_full_path(p, path, dirent.name);
+             }
+@@ -1692,7 +1718,8 @@
+             if (strcmp(dirent.name, ".")
+                 && strcmp(dirent.name, "..")
+                 && (apr_fnmatch(pattern, dirent.name,
+-                                APR_FNM_PERIOD) == APR_SUCCESS)) {
++                                APR_FNM_PERIOD) == APR_SUCCESS)
++                && fname_valid(dirent.name)) {
+                 fnew = (fnames *) apr_array_push(candidates);
+                 fnew->fname = ap_make_full_path(p, path, dirent.name);
+             }
--- pe-httpd-2.2.29.orig/debian/patches/217_httpd-2.2.15-CVE-2014-0226.dpatch
+++ pe-httpd-2.2.29/debian/patches/217_httpd-2.2.15-CVE-2014-0226.dpatch
@@ -0,0 +1,85 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 217_httpd-2.2.15-CVE-2014-0226.dpatch by Ryan McKern <ryan.mckern@puppetlabs.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix for CVE-2014-0226 (mod_status heap-based buffer overflow)
+
+@DPATCH@
+
+Index: server/scoreboard.c
+===================================================================
+--- a/server/scoreboard.c	(revision 1610514)
++++ b/server/scoreboard.c	(revision 1610515)
+@@ -510,6 +510,21 @@
+     return &ap_scoreboard_image->servers[x][y];
+ }
+ 
++AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest, 
++                                           int child_num,
++                                           int thread_num)
++{
++    worker_score *ws = ap_get_scoreboard_worker(child_num, thread_num);
++
++    memcpy(dest, ws, sizeof *ws);
++
++    /* For extra safety, NUL-terminate the strings returned, though it
++     * should be true those last bytes are always zero anyway. */
++    dest->client[sizeof(dest->client) - 1] = '\0';
++    dest->request[sizeof(dest->request) - 1] = '\0';
++    dest->vhost[sizeof(dest->vhost) - 1] = '\0';
++}
++
+ AP_DECLARE(process_score *) ap_get_scoreboard_process(int x)
+ {
+     if ((x < 0) || (server_limit < x)) {
+Index: modules/generators/mod_status.c
+===================================================================
+--- a/modules/generators/mod_status.c	(revision 1610514)
++++ b/modules/generators/mod_status.c	(revision 1610515)
+@@ -241,7 +241,7 @@
+ #endif
+     int short_report;
+     int no_table_report;
+-    worker_score *ws_record;
++    worker_score *ws_record = apr_palloc(r->pool, sizeof *ws_record);
+     process_score *ps_record;
+     char *stat_buffer;
+     pid_t *pid_buffer, worker_pid;
+@@ -333,7 +333,7 @@
+         for (j = 0; j < thread_limit; ++j) {
+             int indx = (i * thread_limit) + j;
+ 
+-            ws_record = ap_get_scoreboard_worker(i, j);
++            ap_copy_scoreboard_worker(ws_record, i, j);
+             res = ws_record->status;
+             stat_buffer[indx] = status_flags[res];
+ 
+Index: include/scoreboard.h
+===================================================================
+--- a/include/scoreboard.h	(revision 1610514)
++++ b/include/scoreboard.h	(revision 1610515)
+@@ -189,7 +189,24 @@
+                                                     int status, request_rec *r);
+ void ap_time_process_request(ap_sb_handle_t *sbh, int status);
+ 
++/** Return a pointer to the worker_score for a given child, thread pair.
++ * @param child_num The child number.
++ * @param thread_num The thread number.
++ * @return A pointer to the worker_score structure.
++ * @deprecated This function is deprecated, use ap_copy_scoreboard_worker instead. 
++ */
+ AP_DECLARE(worker_score *) ap_get_scoreboard_worker(int x, int y);
++
++/** Copy the contents of a worker's scoreboard entry.  The contents of
++ * the worker_score structure are copied verbatim into the dest
++ * structure.
++ * @param dest Output parameter.
++ * @param child_num The child number.
++ * @param thread_num The thread number.
++ */
++AP_DECLARE(void) ap_copy_scoreboard_worker(worker_score *dest,
++                                           int child_num, int thread_num);
++
+ AP_DECLARE(process_score *) ap_get_scoreboard_process(int x);
+ AP_DECLARE(global_score *) ap_get_scoreboard_global(void);
+ AP_DECLARE(lb_score *) ap_get_scoreboard_lb(int lb_num);
--- pe-httpd-2.2.29.orig/debian/patches/077_CacheIgnoreURLSessionIdentifiers.dpatch
+++ pe-httpd-2.2.29/debian/patches/077_CacheIgnoreURLSessionIdentifiers.dpatch
@@ -0,0 +1,86 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix CacheIgnoreURLSessionIdentifiers
+## DP: r892289, r897705 from upstream svn. Debian bug #556383
+
+@DPATCH@
+diff --git a/modules/cache/cache_storage.c b/modules/cache/cache_storage.c
+index c122bdd..a44b9e4 100644
+--- a/modules/cache/cache_storage.c
++++ b/modules/cache/cache_storage.c
+@@ -498,28 +498,60 @@ apr_status_t cache_generate_key_default(request_rec *r, apr_pool_t* p,
+                 && (*(param + len + 1) == '=')
+                 && !strchr(param + len + 2, '/')) {
+                 path = apr_pstrndup(p, path, param - path);
+-                break;
++                continue;
+             }
+             /*
+              * Check if the identifier is in the querystring and cut it out.
+              */
+-            if (querystring
+-                && (param = strstr(querystring, *identifier))
+-                && (*(param + len) == '=')
+-                ) {
+-                char *amp;
+-
+-                if (querystring != param) {
+-                    querystring = apr_pstrndup(p, querystring,
+-                                               param - querystring);
++            if (querystring) {
++                /*
++                 * First check if the identifier is at the beginning of the
++                 * querystring and followed by a '='
++                 */
++                if (!strncmp(querystring, *identifier, len)
++                    && (*(querystring + len) == '=')) {
++                    param = querystring;
+                 }
+                 else {
+-                    querystring = "";
++                    char *complete;
++
++                    /*
++                     * In order to avoid subkey matching (PR 48401) prepend
++                     * identifier with a '&' and append a '='
++                     */
++                    complete = apr_pstrcat(p, "&", *identifier, "=", NULL);
++                    param = strstr(querystring, complete);
++                    /* If we found something we are sitting on the '&' */
++                    if (param) {
++                        param++;
++                    }
+                 }
+-                if ((amp = strchr(param + len + 1, '&'))) {
+-                    querystring = apr_pstrcat(p, querystring, amp + 1, NULL);
++                if (param) {
++                    char *amp;
++
++                    if (querystring != param) {
++                        querystring = apr_pstrndup(p, querystring,
++                                               param - querystring);
++                    }
++                    else {
++                        querystring = "";
++                    }
++
++                    if ((amp = strchr(param + len + 1, '&'))) {
++                        querystring = apr_pstrcat(p, querystring, amp + 1, NULL);
++                    }
++                    else {
++                        /*
++                         * If querystring is not "", then we have the case
++                         * that the identifier parameter we removed was the
++                         * last one in the original querystring. Hence we have
++                         * a trailing '&' which needs to be removed.
++                         */
++                        if (*querystring) {
++                            querystring[strlen(querystring) - 1] = '\0';
++                        }
++                    }
+                 }
+-                break;
+             }
+         }
+     }
--- pe-httpd-2.2.29.orig/debian/patches/045_suexec_log_cloexec.dpatch
+++ pe-httpd-2.2.29/debian/patches/045_suexec_log_cloexec.dpatch
@@ -0,0 +1,46 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## suexec_log_cloexec.dpatch
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Patch to allow suexec to log after a cgi error (#312385)
+## DP: http://issues.apache.org/bugzilla/show_bug.cgi?id=10744
+
+@DPATCH@
+
+diff -ru apache2-2.2.3.orig/support/suexec.c apache2-2.2.3/support/suexec.c 
+--- apache2-2.2.3.orig/support/suexec.c	2006-07-12 05:38:44.000000000 +0200
++++ apache2-2.2.3/support/suexec.c	2007-05-24 18:37:04.000000000 +0200
+@@ -46,6 +46,7 @@
+ #include <stdio.h>
+ #include <stdarg.h>
+ #include <stdlib.h>
++#include <fcntl.h>
+ 
+ #ifdef HAVE_PWD_H
+ #include <pwd.h>
+@@ -596,17 +597,14 @@
+ #endif /* AP_SUEXEC_UMASK */
+ 
+     /*
+-     * Be sure to close the log file so the CGI can't
+-     * mess with it.  If the exec fails, it will be reopened
+-     * automatically when log_err is called.  Note that the log
+-     * might not actually be open if AP_LOG_EXEC isn't defined.
+-     * However, the "log" cell isn't ifdef'd so let's be defensive
+-     * and assume someone might have done something with it
+-     * outside an ifdef'd AP_LOG_EXEC block.
+-     */
+-    if (log != NULL) {
+-        fclose(log);
+-        log = NULL;
++     * ask fcntl(2) to set the FD_CLOEXEC flag on the log file,
++     * so it'll be automagically closed if the exec() call succeeds.
++     */
++    fflush(log);
++    setbuf(log,NULL);
++    if(fcntl(fileno(log),F_SETFD,FD_CLOEXEC)==-1) {
++      log_err("error: can't set close-on-exec flag");
++      exit(122);
+     }
+ 
+     /*
--- pe-httpd-2.2.29.orig/debian/patches/073_mod_dav_trunk_fixes.dpatch
+++ pe-httpd-2.2.29/debian/patches/073_mod_dav_trunk_fixes.dpatch
@@ -0,0 +1,520 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Various bug fixes for mod_dav/mod_dav_fs
+## DP: upstream svn revs 834018:835092 and 928403 in modules/dav
+## DP:
+## DP: *) mod_dav: Include uri when logging a PUT error due to connection abort.
+## DP:    PR 38149. [Stefan Fritsch]
+## DP:
+## DP: *) mod_dav: Return 409 instead of 500 for a LOCK request if the parent
+## DP:    resource does not exist or is not a collection. PR 43465. [Stefan Fritsch]
+## DP:
+## DP: *) mod_dav_fs: Return 409 instead of 500 for Litmus test case copy_nodestcoll
+## DP:    (a COPY request where the parent of the destination resource does not
+## DP:    exist). PR 39299. [Stefan Fritsch]
+## DP:
+## DP: *) mod_dav_fs: Don't delete the whole file if a PUT with content-range failed.
+## DP:    PR 42896. [Stefan Fritsch]
+## DP:
+## DP: *) mod_dav_fs: Make PUT create files atomically and no longer destroy the
+## DP:    old file if the transfer aborted. PR 39815. [Paul Querna, Stefan Fritsch]
+## DP:
+## DP: *) mod_dav_fs: Remove inode keyed locking as this conflicts with atomically
+## DP:    creating files. On systems with inode numbers, this is a format change of
+## DP:    the DavLockDB. The old DavLockDB must be deleted on upgrade.
+## DP:    [Stefan Fritsch]
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/modules/dav/fs/lock.c trunk/modules/dav/fs/lock.c
+--- trunk~/modules/dav/fs/lock.c	2010-03-29 21:46:51.000000000 +0200
++++ trunk/modules/dav/fs/lock.c	2010-03-29 21:49:00.970983302 +0200
+@@ -48,9 +48,8 @@
+ **
+ ** KEY
+ **
+-** The database is keyed by a key_type unsigned char (DAV_TYPE_INODE or
+-** DAV_TYPE_FNAME) followed by inode and device number if possible,
+-** otherwise full path (in the case of Win32 or lock-null resources).
++** The database is keyed by a key_type unsigned char (DAV_TYPE_FNAME)
++** followed by the full path. The key_type DAV_TYPE_INODE is not used anymore.
+ **
+ ** VALUE
+ **
+@@ -82,7 +81,10 @@
+ #define DAV_LOCK_DIRECT         1
+ #define DAV_LOCK_INDIRECT       2
+ 
+-#define DAV_TYPE_INODE          10
++/*
++ * not used anymore
++ * #define DAV_TYPE_INODE          10
++ */
+ #define DAV_TYPE_FNAME          11
+ 
+ 
+@@ -372,12 +374,13 @@
+ }
+ 
+ /*
+-** dav_fs_build_fname_key
+-**
+-** Given a pathname, build a DAV_TYPE_FNAME lock database key.
++** dav_fs_build_key:  Given a resource, return a apr_datum_t key
++**    to look up lock information for this file.
+ */
+-static apr_datum_t dav_fs_build_fname_key(apr_pool_t *p, const char *pathname)
++static apr_datum_t dav_fs_build_key(apr_pool_t *p,
++                                    const dav_resource *resource)
+ {
++    const char *pathname = dav_fs_pathname(resource);
+     apr_datum_t key;
+ 
+     /* ### does this allocation have a proper lifetime? need to check */
+@@ -394,46 +397,6 @@
+ }
+ 
+ /*
+-** dav_fs_build_key:  Given a resource, return a apr_datum_t key
+-**    to look up lock information for this file.
+-**
+-**    (inode/dev not supported or file is lock-null):
+-**       apr_datum_t->dvalue = full path
+-**
+-**    (inode/dev supported and file exists ):
+-**       apr_datum_t->dvalue = inode, dev
+-*/
+-static apr_datum_t dav_fs_build_key(apr_pool_t *p,
+-                                    const dav_resource *resource)
+-{
+-    const char *file = dav_fs_pathname(resource);
+-    apr_datum_t key;
+-    apr_finfo_t finfo;
+-    apr_status_t rv;
+-
+-    /* ### use lstat() ?? */
+-    /*
+-     * XXX: What for platforms with no IDENT (dev/inode)?
+-     */
+-    rv = apr_stat(&finfo, file, APR_FINFO_IDENT, p);
+-    if ((rv == APR_SUCCESS || rv == APR_INCOMPLETE)
+-        && ((finfo.valid & APR_FINFO_IDENT) == APR_FINFO_IDENT))
+-    {
+-        /* ### can we use a buffer for this? */
+-        key.dsize = 1 + sizeof(finfo.inode) + sizeof(finfo.device);
+-        key.dptr = apr_palloc(p, key.dsize);
+-        *key.dptr = DAV_TYPE_INODE;
+-        memcpy(key.dptr + 1, &finfo.inode, sizeof(finfo.inode));
+-        memcpy(key.dptr + 1 + sizeof(finfo.inode), &finfo.device,
+-               sizeof(finfo.device));
+-
+-        return key;
+-    }
+-
+-    return dav_fs_build_fname_key(p, file);
+-}
+-
+-/*
+ ** dav_fs_lock_expired:  return 1 (true) if the given timeout is in the past
+ **    or present (the lock has expired), or 0 (false) if in the future
+ **    (the lock has not yet expired).
+@@ -989,13 +952,8 @@
+ 
+ /*
+ ** dav_fs_remove_locknull_state:  Given a request, check to see if r->filename
+-**    is/was a lock-null resource.  If so, return it to an existant state.
+-**
+-**    ### this function is broken... it doesn't check!
+-**
+-**    In this implementation, this involves two things:
+-**    (a) remove it from the list in the appropriate .DAV/locknull file
+-**    (b) on *nix, convert the key from a filename to an inode.
++**    is/was a lock-null resource.  If so, return it to an existant state, i.e.
++**    remove it from the list in the appropriate .DAV/locknull file.
+ */
+ static dav_error * dav_fs_remove_locknull_state(
+     dav_lockdb *lockdb,
+@@ -1011,35 +969,6 @@
+         return err;
+     }
+ 
+-    {
+-        dav_lock_discovery *ld;
+-        dav_lock_indirect  *id;
+-        apr_datum_t key;
+-
+-        /*
+-        ** Fetch the lock(s) that made the resource lock-null. Remove
+-        ** them under the filename key. Obtain the new inode key, and
+-        ** save the same lock information under it.
+-        */
+-        key = dav_fs_build_fname_key(p, pathname);
+-        if ((err = dav_fs_load_lock_record(lockdb, key, DAV_CREATE_LIST,
+-                                           &ld, &id)) != NULL) {
+-            /* ### insert a higher-level error description */
+-            return err;
+-        }
+-
+-        if ((err = dav_fs_save_lock_record(lockdb, key, NULL, NULL)) != NULL) {
+-            /* ### insert a higher-level error description */
+-            return err;
+-        }
+-
+-        key = dav_fs_build_key(p, resource);
+-        if ((err = dav_fs_save_lock_record(lockdb, key, ld, id)) != NULL) {
+-            /* ### insert a higher-level error description */
+-            return err;
+-        }
+-    }
+-
+     return NULL;
+ }
+ 
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/modules/dav/fs/repos.c trunk/modules/dav/fs/repos.c
+--- trunk~/modules/dav/fs/repos.c	2010-03-29 21:46:51.000000000 +0200
++++ trunk/modules/dav/fs/repos.c	2010-03-29 21:49:08.031078314 +0200
+@@ -27,6 +27,10 @@
+ #include <stdio.h>              /* for sprintf() */
+ #endif
+ 
++#if APR_HAVE_UNISTD_H
++#include <unistd.h>             /* for getpid() */
++#endif
++
+ #include "httpd.h"
+ #include "http_log.h"
+ #include "http_protocol.h"      /* for ap_set_* (in dav_fs_set_headers) */
+@@ -139,6 +143,11 @@
+ */
+ #define DAV_PROPID_FS_executable        1
+ 
++/*
++ * prefix for temporary files
++ */
++#define DAV_FS_TMP_PREFIX ".davfs.tmp" 
++
+ static const dav_liveprop_spec dav_fs_props[] =
+ {
+     /* standard DAV properties */
+@@ -191,11 +200,14 @@
+     apr_pool_t *p;
+     apr_file_t *f;
+     const char *pathname;       /* we may need to remove it at close time */
++    char *temppath;
++    int unlink_on_error;
+ };
+ 
+ /* returns an appropriate HTTP status code given an APR status code for a
+  * failed I/O operation.  ### use something besides 500? */
+ #define MAP_IO2HTTP(e) (APR_STATUS_IS_ENOSPC(e) ? HTTP_INSUFFICIENT_STORAGE : \
++                        APR_STATUS_IS_ENOENT(e) ? HTTP_CONFLICT : \
+                         HTTP_INTERNAL_SERVER_ERROR)
+ 
+ /* forward declaration for internal treewalkers */
+@@ -414,11 +426,24 @@
+     apr_file_close(inf);
+     apr_file_close(outf);
+ 
+-    if (is_move && apr_file_remove(src, p) != APR_SUCCESS) {
++    if (is_move && (status = apr_file_remove(src, p)) != APR_SUCCESS) {
+         dav_error *err;
+         int save_errno = errno;   /* save the errno that got us here */
+ 
+-        if (apr_file_remove(dst, p) != APR_SUCCESS) {
++        if (APR_STATUS_IS_ENOENT(status)) {
++            /*
++             * Something is wrong here but the result is what we wanted.
++             * We definitely should not remove the destination file.
++             */
++             err = dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 0,
++                                 apr_psprintf(p, "Could not remove source "
++                                              "file %s after move to %s. The "
++                                              "server may be in an "
++                                              "inconsistent state.", src, dst));
++            err->save_errno = save_errno;
++            return err;
++        } 
++        else if (apr_file_remove(dst, p) != APR_SUCCESS) {
+             /* ### ACK. this creates an inconsistency. do more!? */
+ 
+             /* ### use something besides 500? */
+@@ -500,9 +525,13 @@
+     dst = apr_pstrcat(p, dst, "/", dst_file, NULL);
+ 
+     /* copy/move the file now */
+-    if (is_move && src_finfo.device == dst_state_finfo.device) {
+-        /* simple rename is possible since it is on the same device */
+-        if (apr_file_rename(src, dst, p) != APR_SUCCESS) {
++    if (is_move) {
++        /* try simple rename first */
++        rv = apr_file_rename(src, dst, p);
++        if (APR_STATUS_IS_EXDEV(rv)) {
++            return dav_fs_copymove_file(is_move, p, src, dst, NULL, NULL, pbuf);
++        }
++        if (rv != APR_SUCCESS) {
+             /* ### use something besides 500? */
+             return dav_new_error(p, HTTP_INTERNAL_SERVER_ERROR, 0,
+                                  "Could not move state file.");
+@@ -841,6 +870,34 @@
+             && ctx2->pathname[len1] == '/');
+ }
+ 
++static apr_status_t tmpfile_cleanup(void *data) {
++        dav_stream *ds = data;
++        if (ds->temppath) {
++                apr_file_remove(ds->temppath, ds->p);
++        }
++        return APR_SUCCESS;
++}
++
++/* custom mktemp that creates the file with APR_OS_DEFAULT permissions */
++static apr_status_t dav_fs_mktemp(apr_file_t **fp, char *templ, apr_pool_t *p)
++{
++    apr_status_t rv;
++    int num = ((getpid() << 7) + (int)templ % (1 << 16) ) % ( 1 << 23 ) ;
++    char *numstr = templ + strlen(templ) - 6;
++
++    ap_assert(numstr >= templ);
++
++    do {
++        num = (num + 1) % ( 1 << 23 );
++        snprintf(numstr, 7, "%06x", num);
++        rv = apr_file_open(fp, templ,
++                           APR_WRITE | APR_CREATE | APR_BINARY | APR_EXCL,
++                           APR_OS_DEFAULT, p);
++    } while (APR_STATUS_IS_EEXIST(rv));
++        
++    return rv;
++}
++
+ static dav_error * dav_fs_open_stream(const dav_resource *resource,
+                                       dav_stream_mode mode,
+                                       dav_stream **stream)
+@@ -865,7 +922,32 @@
+ 
+     ds->p = p;
+     ds->pathname = resource->info->pathname;
+-    rv = apr_file_open(&ds->f, ds->pathname, flags, APR_OS_DEFAULT, ds->p);
++    ds->temppath = NULL;
++    ds->unlink_on_error = 0;
++
++    if (mode == DAV_MODE_WRITE_TRUNC) {
++        ds->temppath = apr_pstrcat(p, ap_make_dirstr_parent(p, ds->pathname),
++                                   DAV_FS_TMP_PREFIX "XXXXXX", NULL);
++        rv = dav_fs_mktemp(&ds->f, ds->temppath, ds->p);
++        apr_pool_cleanup_register(p, ds, tmpfile_cleanup,
++                                  apr_pool_cleanup_null);
++    }
++    else if (mode == DAV_MODE_WRITE_SEEKABLE) {
++        rv = apr_file_open(&ds->f, ds->pathname, flags | APR_FOPEN_EXCL,
++                           APR_OS_DEFAULT, ds->p);
++        if (rv == APR_SUCCESS) {
++            /* we have created a new file */
++            ds->unlink_on_error = 1;
++        }
++        else if (APR_STATUS_IS_EEXIST(rv)) {
++            rv = apr_file_open(&ds->f, ds->pathname, flags, APR_OS_DEFAULT,
++                               ds->p);
++        }
++    }
++    else {
++        rv = apr_file_open(&ds->f, ds->pathname, flags, APR_OS_DEFAULT, ds->p);
++    }
++
+     if (rv != APR_SUCCESS) {
+         return dav_new_error(p, MAP_IO2HTTP(rv), 0,
+                              "An error occurred while opening a resource.");
+@@ -879,17 +961,33 @@
+ 
+ static dav_error * dav_fs_close_stream(dav_stream *stream, int commit)
+ {
++    apr_status_t rv;
++
+     apr_file_close(stream->f);
+ 
+     if (!commit) {
+-        if (apr_file_remove(stream->pathname, stream->p) != APR_SUCCESS) {
+-            /* ### use a better description? */
+-            return dav_new_error(stream->p, HTTP_INTERNAL_SERVER_ERROR, 0,
+-                                 "There was a problem removing (rolling "
+-                                 "back) the resource "
+-                                 "when it was being closed.");
++        if (stream->temppath) {
++            apr_pool_cleanup_run(stream->p, stream, tmpfile_cleanup);
++        }
++        else if (stream->unlink_on_error) {
++            if (apr_file_remove(stream->pathname, stream->p) != APR_SUCCESS) {
++                /* ### use a better description? */
++                return dav_new_error(stream->p, HTTP_INTERNAL_SERVER_ERROR, 0,
++                                     "There was a problem removing (rolling "
++                                     "back) the resource "
++                                     "when it was being closed.");
++            }
+         }
+     }
++    else if (stream->temppath) {
++        rv = apr_file_rename(stream->temppath, stream->pathname, stream->p);
++        if (rv) {
++            return dav_new_error(stream->p, HTTP_INTERNAL_SERVER_ERROR, rv,
++                                 "There was a problem writing the file "
++                                 "atomically after writes.");
++        }
++        apr_pool_cleanup_kill(stream->p, stream, tmpfile_cleanup);
++    }
+ 
+     return NULL;
+ }
+@@ -1201,7 +1299,7 @@
+     dav_resource_private *srcinfo = src->info;
+     dav_resource_private *dstinfo = dst->info;
+     dav_error *err;
+-    int can_rename = 0;
++    apr_status_t rv;
+ 
+ #if DAV_DEBUG
+     if (src->hooks != dst->hooks) {
+@@ -1215,39 +1313,12 @@
+     }
+ #endif
+ 
+-    /* determine whether a simple rename will work.
+-     * Assume source exists, else we wouldn't get called.
+-     */
+-    if (dstinfo->finfo.filetype != 0) {
+-        if (dstinfo->finfo.device == srcinfo->finfo.device) {
+-            /* target exists and is on the same device. */
+-            can_rename = 1;
+-        }
+-    }
+-    else {
+-        const char *dirpath;
+-        apr_finfo_t finfo;
+-        apr_status_t rv;
+ 
+-        /* destination does not exist, but the parent directory should,
+-         * so try it
+-         */
+-        dirpath = ap_make_dirstr_parent(dstinfo->pool, dstinfo->pathname);
+-        /*
+-         * XXX: If missing dev ... then what test?
+-         * Really need a try and failover for those platforms.
+-         *
+-         */
+-        rv = apr_stat(&finfo, dirpath, APR_FINFO_DEV, dstinfo->pool);
+-        if ((rv == APR_SUCCESS || rv == APR_INCOMPLETE)
+-            && (finfo.valid & srcinfo->finfo.valid & APR_FINFO_DEV)
+-            && (finfo.device == srcinfo->finfo.device)) {
+-            can_rename = 1;
+-        }
+-    }
++    /* try rename first */
++    rv = apr_file_rename(srcinfo->pathname, dstinfo->pathname, srcinfo->pool);
+ 
+     /* if we can't simply rename, then do it the hard way... */
+-    if (!can_rename) {
++    if (APR_STATUS_IS_EXDEV(rv)) {
+         if ((err = dav_fs_copymove_resource(1, src, dst, DAV_INFINITY,
+                                             response)) == NULL) {
+             /* update resource states */
+@@ -1260,20 +1331,16 @@
+         return err;
+     }
+ 
+-    /* a rename should work. do it, and move properties as well */
+-
+     /* no multistatus response */
+     *response = NULL;
+ 
+-    /* ### APR has no rename? */
+-    if (apr_file_rename(srcinfo->pathname, dstinfo->pathname,
+-                       srcinfo->pool) != APR_SUCCESS) {
++    if (rv != APR_SUCCESS) {
+         /* ### should have a better error than this. */
+         return dav_new_error(srcinfo->pool, HTTP_INTERNAL_SERVER_ERROR, 0,
+                              "Could not rename resource.");
+     }
+ 
+-    /* update resource states */
++    /* Rename did work. Update resource states and move properties as well */
+     dst->exists = 1;
+     dst->collection = src->collection;
+     src->exists = 0;
+@@ -1475,14 +1542,18 @@
+             /* ### need to authorize each file */
+             /* ### example: .htaccess is normally configured to fail auth */
+ 
+-            /* stuff in the state directory is never authorized! */
+-            if (!strcmp(dirent.name, DAV_FS_STATE_DIR)) {
++            /* stuff in the state directory and temp files are never authorized! */
++            if (!strcmp(dirent.name, DAV_FS_STATE_DIR) ||
++                !strncmp(dirent.name, DAV_FS_TMP_PREFIX,
++                         strlen(DAV_FS_TMP_PREFIX))) {
+                 continue;
+             }
+         }
+-        /* skip the state dir unless a HIDDEN is performed */
++        /* skip the state dir and temp files unless a HIDDEN is performed */
+         if (!(params->walk_type & DAV_WALKTYPE_HIDDEN)
+-            && !strcmp(dirent.name, DAV_FS_STATE_DIR)) {
++            && (!strcmp(dirent.name, DAV_FS_STATE_DIR) ||
++                !strncmp(dirent.name, DAV_FS_TMP_PREFIX,
++                         strlen(DAV_FS_TMP_PREFIX)))) {
+             continue;
+         }
+ 
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/modules/dav/main/mod_dav.c trunk/modules/dav/main/mod_dav.c
+--- trunk~/modules/dav/main/mod_dav.c	2010-03-29 21:46:51.000000000 +0200
++++ trunk/modules/dav/main/mod_dav.c	2010-03-29 21:49:00.966964568 +0200
+@@ -986,7 +986,10 @@
+ 
+             if (rc != APR_SUCCESS) {
+                 err = dav_new_error(r->pool, HTTP_INTERNAL_SERVER_ERROR, 0,
+-                                    "Could not get next bucket brigade");
++                                    apr_psprintf(r->pool,
++                                                 "Could not get next bucket "
++                                                 "brigade (URI: %s)",
++                                                 ap_escape_html(r->pool, r->uri)));
+                 break;
+             }
+ 
+@@ -1009,8 +1012,10 @@
+                 rc = apr_bucket_read(b, &data, &len, APR_BLOCK_READ);
+                 if (rc != APR_SUCCESS) {
+                     err = dav_new_error(r->pool, HTTP_BAD_REQUEST, 0,
+-                                        "An error occurred while reading "
+-                                        "the request body.");
++                                        apr_psprintf(r->pool,
++                                                    "An error occurred while reading"
++                                                    " the request body (URI: %s)",
++                                                    ap_escape_html(r->pool, r->uri)));
+                     break;
+                 }
+ 
+@@ -2966,6 +2971,7 @@
+ {
+     dav_error *err;
+     dav_resource *resource;
++    dav_resource *parent;
+     const dav_hooks_locks *locks_hooks;
+     int result;
+     int depth;
+@@ -2997,6 +3003,20 @@
+     if (err != NULL)
+         return dav_handle_err(r, err, NULL);
+ 
++    /* Check if parent collection exists */
++    if ((err = resource->hooks->get_parent_resource(resource, &parent)) != NULL) {
++        /* ### add a higher-level description? */
++        return dav_handle_err(r, err, NULL);
++    }
++    if (parent && (!parent->exists || parent->collection != 1)) {
++        err = dav_new_error(r->pool, HTTP_CONFLICT, 0,
++                           apr_psprintf(r->pool,
++                                        "The parent resource of %s does not "
++                                        "exist or is not a collection.", 
++                                        ap_escape_html(r->pool, r->uri)));
++        return dav_handle_err(r, err, NULL);
++    }
++
+     /*
+      * Open writable. Unless an error occurs, we'll be
+      * writing into the database.
--- pe-httpd-2.2.29.orig/debian/patches/058_suexec-CVE-2007-1742.dpatch
+++ pe-httpd-2.2.29/debian/patches/058_suexec-CVE-2007-1742.dpatch
@@ -0,0 +1,64 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix race condition with chdir
+## DP: Fix /var/www* being accepted as docroot instead of /var/www/*
+## DP: (the same for public_html* instead of public_html/* )
+
+@DPATCH@
+--- a/support/suexec.c	(revision 644465)
++++ b/support/suexec.c	(working copy)
+@@ -42,6 +42,7 @@
+ #if APR_HAVE_UNISTD_H
+ #include <unistd.h>
+ #endif
++#include <fcntl.h>
+ 
+ #include <stdio.h>
+ #include <stdarg.h>
+@@ -263,6 +264,7 @@
+     struct group *gr;       /* group entry holder        */
+     struct stat dir_info;   /* directory info holder     */
+     struct stat prg_info;   /* program info holder       */
++    int cwdh;               /* handle to cwd             */
+ 
+     /*
+      * Start with a "clean" environment
+@@ -496,11 +498,16 @@
+         exit(111);
+     }
+ 
++    if ( (cwdh = open(".", O_RDONLY)) == -1 ) {
++        log_err("cannot open current working directory\n");
++	exit(111);
++    }
++
+     if (userdir) {
+         if (((chdir(target_homedir)) != 0) ||
+             ((chdir(AP_USERDIR_SUFFIX)) != 0) ||
+             ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+-            ((chdir(cwd)) != 0)) {
++            ((fchdir(cwdh)) != 0)) {
+             log_err("cannot get docroot information (%s)\n", target_homedir);
+             exit(112);
+         }
+@@ -508,12 +515,18 @@
+     else {
+         if (((chdir(AP_DOC_ROOT)) != 0) ||
+             ((getcwd(dwd, AP_MAXPATH)) == NULL) ||
+-            ((chdir(cwd)) != 0)) {
++            ((fchdir(cwdh)) != 0)) {
+             log_err("cannot get docroot information (%s)\n", AP_DOC_ROOT);
+             exit(113);
+         }
+     }
+ 
++    close(cwdh);
++
++    if (strlen(cwd) > strlen(dwd)) {
++        strncat(dwd, "/", AP_MAXPATH);
++        dwd[AP_MAXPATH-1] = '\0';
++    }
+     if ((strncmp(cwd, dwd, strlen(dwd))) != 0) {
+         log_err("command not in docroot (%s/%s)\n", cwd, cmd);
+         exit(114);
--- pe-httpd-2.2.29.orig/debian/patches/200_cp_suexec.dpatch
+++ pe-httpd-2.2.29/debian/patches/200_cp_suexec.dpatch
@@ -0,0 +1,11 @@
+#!/bin/sh -e
+
+## DP: copy suexec to suexec-custom
+
+WORKDIR=${2:-.}
+
+if [ "$1" = -patch ]; then
+	cp $WORKDIR/support/suexec.c $WORKDIR/support/suexec-custom.c
+elif [ "$1" = -unpatch ]; then
+	rm $WORKDIR/support/suexec-custom.c
+fi
--- pe-httpd-2.2.29.orig/debian/patches/009_apache2_has_dso
+++ pe-httpd-2.2.29/debian/patches/009_apache2_has_dso
@@ -0,0 +1,41 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 009_apache2_has_dso by Adam Conrad <adconrad@0c3.net>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Make apxs usable without having apache2 installed.
+
+@DPATCH@
+--- apache2/support/apxs.in	2003-04-05 11:07:55.000000000 +0200
++++ apache2/support/apxs.in	2003-04-05 11:25:19.000000000 +0200
+@@ -237,18 +237,19 @@
+     ($httpd = $0) =~ s:support/apxs$::;
+ }
+ 
+-unless (-x "$httpd") {
+-	error("$httpd not found or not executable");
+-	exit 1;
+-}
+-
+-unless (grep /mod_so/, `. $envvars && $httpd -l`) {
+-    error("Sorry, no shared object support for Apache");
+-    error("available under your platform. Make sure");
+-    error("the Apache module mod_so is compiled into");
+-    error("your server binary `$httpd'.");
+-    exit 1;
+-}
++#commented out for Debian GNU/Linux. We know that apache2 has dso support
++#unless (-x "$httpd") {
++#	error("$httpd not found or not executable");
++#	exit 1;
++#}
++
++#unless (grep /mod_so/, `. $envvars && $httpd -l`) {
++#    error("Sorry, no shared object support for Apache");
++#    error("available under your platform. Make sure");
++#    error("the Apache module mod_so is compiled into");
++#    error("your server binary `$httpd'.");
++#    exit 1;
++#}
+ 
+ sub get_config_vars{
+     my ($file, $rh_config) = @_;
--- pe-httpd-2.2.29.orig/debian/mpm-itk/CHANGES
+++ pe-httpd-2.2.29/debian/mpm-itk/CHANGES
@@ -0,0 +1,44 @@
+apache2.2-mpm-itk 2.2.11-02, released 2009-04-14:
+
+  * Really fix the waitpid() code; thanks to Dave Cundiff for spotting the typo.
+  * Add CAP_DAC_READ_SEARCH to the list of capabilities, so Apache can read
+    .htaccess files that are not world readable. This should fix some of the
+    "permission denied" problems that cropped up in 2.2.11-01, although you
+    will still see the problem if you use root-squashed NFS.
+
+apache2.2-mpm-itk 2.2.11-01, released 2009-03-21:
+
+  * NOTE: This release contains major new functionality. As with mpm-itk in
+    general, you may want to consider closely whether you actually want to
+    put it in production. Also note that Apache 2.0 is no longer supported.
+  * Updated for Apache 2.2.11 (in particular, prefork had a few minor changes
+    that are now incorporated).
+  * Allow uid/gid and nice value to be set per-directory (actually per-location)
+    in addition to per-vhost. Adapted from patch by Knut Auvor Grythe.
+  * Some minor code cleanups.
+  * If waitpid() is interrupted by a signal (returning EINTR), try again.
+    This fixes a race condition where a graceful restart could fail and hang
+    the child forever. Adapted from patch by Jan Boysen, who also diagnosed and
+    reported the bug.
+  * As a side effect of the per-directory patches doing proper config merging,
+    you can now set default values for all options outside the vhost definitions
+    and have them get properly overridden by settings in more specific scopes.
+  * Fix a small memory leak on reload by using apr_pstrdup() instead of
+    strdup().
+
+apache2.2-mpm-itk 2.2.6-02, released 2008-07-27:
+
+  * Fix a typo in the autoconf snippet that would prevent building with
+    capability dropping support. Note that you'll need to run autoheader before
+    autoconf to get -lcap detected (the Debian/Ubuntu packages was missing
+    this, so others might as well).
+
+apache2.2-mpm-itk 2.2.6-01, released 2008-01-05:
+
+  * Updated 01-copy-prefork.patch to let prefork.c come from Apache 2.2.6
+    instead of 2.2.3. Updated all the patches so they apply cleanly
+    afterwards. In other words, there is no mpm-itk-specific functionality
+    in this release, it's only a maintenance release against the latest
+    Apache.
+  * Removed a few instances of trailing whitespace in the patches.
+  * Added this changelog.
--- pe-httpd-2.2.29.orig/debian/mpm-itk/README
+++ pe-httpd-2.2.29/debian/mpm-itk/README
@@ -0,0 +1,121 @@
+This is a copy of the documentation available at http://mpm-itk.sesse.net/,
+dumped with the Lynx web browser and edited briefly.
+
+                              The Apache 2 ITK MPM
+
+   apache2-mpm-itk (just mpm-itk for short) is an MPM (Multi-Processing
+   Module) for the [1]Apache web server. mpm-itk allows you to run each of
+   your vhost under a separate uid and gid -- in short, the scripts and
+   configuration files for one vhost no longer have to be readable for all
+   the other vhosts.
+
+   There are already MPMs available that do this; however, I am not aware
+   of any besides mpm-itk that are actively developed. (If you only run
+   CGI scripts, suexec will probably solve most of your problems with any
+   MPM.)
+
+   mpm-itk is based on the traditional prefork MPM, which means it's
+   non-threaded; in short, this means you can run non-thread-aware code
+   (like many [2]PHP extensions) without problems. On the other hand, you
+   lose out to any performance benefit you'd get with threads, of course;
+   you'd have to decide for yourself if that's worth it or not. You will
+   also take an additional performance hit over prefork, since there's an
+   extra fork per request.
+
+Installation
+
+   If you can't apply a patch, you probably should not be using this. :-)
+   However, several distributions now include mpm-itk as a choice
+   alongside the other MPMs; in alphabetical order:
+     * [3]Arch Linux
+     * [4]Debian GNU/Linux
+     * [5]FreeBSD ports
+     * [6]Gentoo Linux
+     * [7]Mandriva
+     * [8]Ubuntu
+
+   If you know of any I missed, or if you have included mpm-itk in your
+   favourite distribution, please drop me a note (see below). I'd always
+   be happy to expand this list :-)
+
+Configuration
+
+   The new configuration settings compared to the prefork MPM are:
+     * AssignUserID: Takes two parameters, uid and gid (or really, user
+       name and group name); specifies what uid and gid the vhost will run
+       as (after parsing the request etc., of course). Note that if you do
+       not assign a user ID, the default one from Apache will be used.
+     * MaxClientsVHost: A separate MaxClients for the vhost. This can be
+       useful if, say, half of your vhosts depend on some NFS server (like
+       on our setup); if the NFS server goes down, you do not want the
+       children waiting forever on NFS to take the non-NFS-dependent hosts
+       down. This can thus act as a safety measure, giving "server too
+       busy" on the NFS-dependent vhosts while keeping the other ones
+       happily running. (Of course, you could use it to simply keep one
+       site from eating way too much resources, but there are probably
+       better ways of doing that.)
+     * NiceValue: Lets you nice some requests down, to give them less CPU
+       time.
+
+   AssignUserID and NiceValue can be set wherever you'd like in the Apache
+   configuration, except in .htaccess. MaxClientsVHost can only be set
+   inside a VirtualHost directive.
+
+Quirks and warnings
+
+   Since mpm-itk has to be able to setuid(), it runs as root (although
+   restricted with POSIX capabilities where possible) until the request is
+   parsed and the vhost determined. This means that any security hole
+   before the request is parsed will be a root security hole. (The most
+   likely place is probably in mod_ssl.) This is not going to change in
+   the near future, as the most likely alternative solution (socket
+   passing and its variants) is very hard to get to work properly in a
+   number of common use cases, like SSL.
+
+   The lack of socket passing also leads to another minor quirk: if you
+   connect to httpd, make a request and then make a request on the same
+   connection that gets handled by a different uid, mpm-itk simply shuts
+   down the connection. This is perfectly legal according to RFC2616, and
+   all major clients seem to handle it well; the web server simply
+   simulates a timeout, and the client just opens a new connection and
+   retries the request. However, there is a small performance hit, and
+   thus you should avoid including content from multiple uids in the same
+   page.
+
+   Note that mpm-itk is experimental software; and we've done a fair
+   amount of stress testing, but it's nowhere as tested as, say, prefork.
+   That being said, it's being run in production at several sites in the
+   world, both hobbyist and commercial, some as large as ~10 million hits
+   a day.
+
+   People have reported issues with mpm-itk and mod_python, mod_ruby and
+   FastCGI. I believe the mod_python and FastCGI problems have been
+   largely solved by updates to those packages, but as I use neither, I
+   can't really guarantee anything. YMMV, test before use.
+
+Licensing
+
+   mpm-itk is licensed under the Apache License, version 2.0, like the
+   rest of Apache.
+
+Contact
+
+   mpm-itk is developed by Steinar H. Gunderson; e-mail address is at my
+   [9]home page.
+
+   There is a user mailing list at mpm-itk [at] lists.err.no. Visit the
+   [10]mailing list page to subscribe, or send a blank e-mail to
+   mpm-itk-subscribe [at] lists.err.no.
+
+References
+
+   1. http://www.apache.org/
+   2. http://www.php.net/
+   3. http://www.archlinux.org/
+   4. http://www.debian.org/
+   5. http://www.freebsd.org/
+   6. http://www.gentoo.org/
+   7. http://www.mandriva.com/
+   8. http://www.ubuntu.com/
+   9. http://www.sesse.net/
+  10. http://lists.err.no/mailman/listinfo/mpm-itk
--- pe-httpd-2.2.29.orig/debian/mpm-itk/COPYRIGHT
+++ pe-httpd-2.2.29/debian/mpm-itk/COPYRIGHT
@@ -0,0 +1,686 @@
+apache2-mpm-itk is copyright Steinar H. Gunderson <sgunderson@bigfoot.com>
+and Knut Auvor Grythe <knut@auvor.no>, and is provided under the same license
+as the Apache web server.
+
+Get the latest version at http://mpm-itk.sesse.net/ .
+
+The entire license text for Apache is:
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+
+APACHE HTTP SERVER SUBCOMPONENTS: 
+
+The Apache HTTP Server includes a number of subcomponents with
+separate copyright notices and license terms. Your use of the source
+code for the these subcomponents is subject to the terms and
+conditions of the following licenses. 
+
+For the mod_mime_magic component:
+
+/*
+ * mod_mime_magic: MIME type lookup via file magic numbers
+ * Copyright (c) 1996-1997 Cisco Systems, Inc.
+ *
+ * This software was submitted by Cisco Systems to the Apache Group in July
+ * 1997.  Future revisions and derivatives of this source code must
+ * acknowledge Cisco Systems as the original contributor of this module.
+ * All other licensing and usage conditions are those of the Apache Group.
+ *
+ * Some of this code is derived from the free version of the file command
+ * originally posted to comp.sources.unix.  Copyright info for that program
+ * is included below as required.
+ * ---------------------------------------------------------------------------
+ * - Copyright (c) Ian F. Darwin, 1987. Written by Ian F. Darwin.
+ *
+ * This software is not subject to any license of the American Telephone and
+ * Telegraph Company or of the Regents of the University of California.
+ *
+ * Permission is granted to anyone to use this software for any purpose on any
+ * computer system, and to alter it and redistribute it freely, subject to
+ * the following restrictions:
+ *
+ * 1. The author is not responsible for the consequences of use of this
+ * software, no matter how awful, even if they arise from flaws in it.
+ *
+ * 2. The origin of this software must not be misrepresented, either by
+ * explicit claim or by omission.  Since few users ever read sources, credits
+ * must appear in the documentation.
+ *
+ * 3. Altered versions must be plainly marked as such, and must not be
+ * misrepresented as being the original software.  Since few users ever read
+ * sources, credits must appear in the documentation.
+ *
+ * 4. This notice may not be removed or altered.
+ * -------------------------------------------------------------------------
+ *
+ */
+
+
+For the  modules\mappers\mod_imap.c component:
+
+  "macmartinized" polygon code copyright 1992 by Eric Haines, erich@eye.com
+
+For the  server\util_md5.c component:
+
+/************************************************************************
+ * NCSA HTTPd Server
+ * Software Development Group
+ * National Center for Supercomputing Applications
+ * University of Illinois at Urbana-Champaign
+ * 605 E. Springfield, Champaign, IL 61820
+ * httpd@ncsa.uiuc.edu
+ *
+ * Copyright  (C)  1995, Board of Trustees of the University of Illinois
+ *
+ ************************************************************************
+ *
+ * md5.c: NCSA HTTPd code which uses the md5c.c RSA Code
+ *
+ *  Original Code Copyright (C) 1994, Jeff Hostetler, Spyglass, Inc.
+ *  Portions of Content-MD5 code Copyright (C) 1993, 1994 by Carnegie Mellon
+ *     University (see Copyright below).
+ *  Portions of Content-MD5 code Copyright (C) 1991 Bell Communications 
+ *     Research, Inc. (Bellcore) (see Copyright below).
+ *  Portions extracted from mpack, John G. Myers - jgm+@cmu.edu
+ *  Content-MD5 Code contributed by Martin Hamilton (martin@net.lut.ac.uk)
+ *
+ */
+
+
+/* these portions extracted from mpack, John G. Myers - jgm+@cmu.edu */
+/* (C) Copyright 1993,1994 by Carnegie Mellon University
+ * All Rights Reserved.
+ *
+ * Permission to use, copy, modify, distribute, and sell this software
+ * and its documentation for any purpose is hereby granted without
+ * fee, provided that the above copyright notice appear in all copies
+ * and that both that copyright notice and this permission notice
+ * appear in supporting documentation, and that the name of Carnegie
+ * Mellon University not be used in advertising or publicity
+ * pertaining to distribution of the software without specific,
+ * written prior permission.  Carnegie Mellon University makes no
+ * representations about the suitability of this software for any
+ * purpose.  It is provided "as is" without express or implied
+ * warranty.
+ *
+ * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
+ * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
+ * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+ * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Copyright (c) 1991 Bell Communications Research, Inc. (Bellcore)
+ *
+ * Permission to use, copy, modify, and distribute this material
+ * for any purpose and without fee is hereby granted, provided
+ * that the above copyright notice and this permission notice
+ * appear in all copies, and that the name of Bellcore not be
+ * used in advertising or publicity pertaining to this
+ * material without the specific, prior written permission
+ * of an authorized representative of Bellcore.  BELLCORE
+ * MAKES NO REPRESENTATIONS ABOUT THE ACCURACY OR SUITABILITY
+ * OF THIS MATERIAL FOR ANY PURPOSE.  IT IS PROVIDED "AS IS",
+ * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES.  
+ */
+
+For the  srclib\apr\include\apr_md5.h component: 
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+
+For the  srclib\apr\passwd\apr_md5.c component:
+
+/*
+ * This is work is derived from material Copyright RSA Data Security, Inc.
+ *
+ * The RSA copyright statement and Licence for that original material is
+ * included below. This is followed by the Apache copyright statement and
+ * licence for the modifications made to that material.
+ */
+
+/* MD5C.C - RSA Data Security, Inc., MD5 message-digest algorithm
+ */
+
+/* Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+   rights reserved.
+
+   License to copy and use this software is granted provided that it
+   is identified as the "RSA Data Security, Inc. MD5 Message-Digest
+   Algorithm" in all material mentioning or referencing this software
+   or this function.
+
+   License is also granted to make and use derivative works provided
+   that such works are identified as "derived from the RSA Data
+   Security, Inc. MD5 Message-Digest Algorithm" in all material
+   mentioning or referencing the derived work.
+
+   RSA Data Security, Inc. makes no representations concerning either
+   the merchantability of this software or the suitability of this
+   software for any particular purpose. It is provided "as is"
+   without express or implied warranty of any kind.
+
+   These notices must be retained in any copies of any part of this
+   documentation and/or software.
+ */
+/*
+ * The apr_md5_encode() routine uses much code obtained from the FreeBSD 3.0
+ * MD5 crypt() function, which is licenced as follows:
+ * ----------------------------------------------------------------------------
+ * "THE BEER-WARE LICENSE" (Revision 42):
+ * <phk@login.dknet.dk> wrote this file.  As long as you retain this notice you
+ * can do whatever you want with this stuff. If we meet some day, and you think
+ * this stuff is worth it, you can buy me a beer in return.  Poul-Henning Kamp
+ * ----------------------------------------------------------------------------
+ */
+
+For the srclib\apr-util\crypto\apr_md4.c component:
+
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the srclib\apr-util\include\apr_md4.h component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1991-2, RSA Data Security, Inc. Created 1991. All
+ * rights reserved.
+ *
+ * License to copy and use this software is granted provided that it
+ * is identified as the "RSA Data Security, Inc. MD4 Message-Digest
+ * Algorithm" in all material mentioning or referencing this software
+ * or this function.
+ *
+ * License is also granted to make and use derivative works provided
+ * that such works are identified as "derived from the RSA Data
+ * Security, Inc. MD4 Message-Digest Algorithm" in all material
+ * mentioning or referencing the derived work.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+
+For the srclib\apr-util\test\testdbm.c component:
+
+/* ====================================================================
+ * The Apache Software License, Version 1.1
+ *
+ * Copyright (c) 2000-2002 The Apache Software Foundation.  All rights
+ * reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. The end-user documentation included with the redistribution,
+ *    if any, must include the following acknowledgment:
+ *       "This product includes software developed by the
+ *        Apache Software Foundation (http://www.apache.org/)."
+ *    Alternately, this acknowledgment may appear in the software itself,
+ *    if and wherever such third-party acknowledgments normally appear.
+ *
+ * 4. The names "Apache" and "Apache Software Foundation" must
+ *    not be used to endorse or promote products derived from this
+ *    software without prior written permission. For written
+ *    permission, please contact apache@apache.org.
+ *
+ * 5. Products derived from this software may not be called "Apache",
+ *    nor may "Apache" appear in their name, without prior written
+ *    permission of the Apache Software Foundation.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ * This file came from the SDBM package (written by oz@nexus.yorku.ca).
+ * That package was under public domain. This file has been ported to
+ * APR, updated to ANSI C and other, newer idioms, and added to the Apache
+ * codebase under the above copyright and license.
+ */
+
+
+For the srclib\apr-util\test\testmd4.c component:
+
+ *
+ * This is derived from material copyright RSA Data Security, Inc.
+ * Their notice is reproduced below in its entirety.
+ *
+ * Copyright (C) 1990-2, RSA Data Security, Inc. Created 1990. All
+ * rights reserved.
+ *
+ * RSA Data Security, Inc. makes no representations concerning either
+ * the merchantability of this software or the suitability of this
+ * software for any particular purpose. It is provided "as is"
+ * without express or implied warranty of any kind.
+ *
+ * These notices must be retained in any copies of any part of this
+ * documentation and/or software.
+ */
+
+For the srclib\apr-util\xml\expat\conftools\install-sh component:
+
+#
+# install - install a program, script, or datafile
+# This comes from X11R5 (mit/util/scripts/install.sh).
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+#
+
+For the srclib\pcre\install-sh component:
+
+#
+# Copyright 1991 by the Massachusetts Institute of Technology
+#
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
+
+For the pcre component:
+
+PCRE LICENCE
+------------
+
+PCRE is a library of functions to support regular expressions whose syntax
+and semantics are as close as possible to those of the Perl 5 language.
+
+Written by: Philip Hazel <ph10@cam.ac.uk>
+
+University of Cambridge Computing Service,
+Cambridge, England. Phone: +44 1223 334714.
+
+Copyright (c) 1997-2001 University of Cambridge
+
+Permission is granted to anyone to use this software for any purpose on any
+computer system, and to redistribute it freely, subject to the following
+restrictions:
+
+1. This software is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+
+2. The origin of this software must not be misrepresented, either by
+   explicit claim or by omission. In practice, this means that if you use
+   PCRE in software which you distribute to others, commercially or
+   otherwise, you must put a sentence like this
+
+     Regular expression support is provided by the PCRE library package,
+     which is open source software, written by Philip Hazel, and copyright
+     by the University of Cambridge, England.
+
+   somewhere reasonably visible in your documentation and in any relevant
+   files or online help data or similar. A reference to the ftp site for
+   the source, that is, to
+
+     ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/
+
+   should also be given in the documentation.
+
+3. Altered versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+
+4. If PCRE is embedded in any software that is released under the GNU
+   General Purpose Licence (GPL), or Lesser General Purpose Licence (LGPL),
+   then the terms of that licence shall supersede any condition above with
+   which it is incompatible.
+
+The documentation for PCRE, supplied in the "doc" directory, is distributed
+under the same terms as the software itself.
+
+End PCRE LICENCE
+
+
+For the test\zb.c component:
+
+/*                          ZeusBench V1.01
+			    ===============
+
+This program is Copyright (C) Zeus Technology Limited 1996.
+
+This program may be used and copied freely providing this copyright notice
+is not removed.
+
+This software is provided "as is" and any express or implied waranties, 
+including but not limited to, the implied warranties of merchantability and
+fitness for a particular purpose are disclaimed.  In no event shall 
+Zeus Technology Ltd. be liable for any direct, indirect, incidental, special, 
+exemplary, or consequential damaged (including, but not limited to, 
+procurement of substitute good or services; loss of use, data, or profits;
+or business interruption) however caused and on theory of liability.  Whether
+in contract, strict liability or tort (including negligence or otherwise) 
+arising in any way out of the use of this software, even if advised of the
+possibility of such damage.
+
+     Written by Adam Twiss (adam@zeus.co.uk).  March 1996
+
+Thanks to the following people for their input:
+  Mike Belshe (mbelshe@netscape.com) 
+  Michael Campanella (campanella@stevms.enet.dec.com)
+
+*/
+
+For the expat xml parser component:
+
+Copyright (c) 1998, 1999, 2000 Thai Open Source Software Center Ltd
+                               and Clark Cooper
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+	
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+	
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+====================================================================
--- pe-httpd-2.2.29.orig/debian/mpm-itk/debian/changelog
+++ pe-httpd-2.2.29/debian/mpm-itk/debian/changelog
@@ -0,0 +1,117 @@
+apache2-mpm-itk has been merged into the apache2 source package. For newer
+changes, see the apache2 changelog.
+
+apache2-mpm-itk (2.2.11-02-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Tue, 14 Apr 2009 23:47:36 +0200
+
+apache2-mpm-itk (2.2.11-01-1) unstable; urgency=low
+
+  * New upstream release.
+    * Updated debian/copyright file with COPYRIGHT from the tarball.
+    * Updated apache2-src build-dependency to make sure we build against Apache
+      2.2.11. (The patch set itself will work just fine for 2.2.9, although
+      not without some fuzz.)
+  * Updated Standards-Version to 3.8.1 (no changes needed).
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sun, 22 Mar 2009 15:39:39 +0100
+
+apache2-mpm-itk (2.2.6-02-1) unstable; urgency=medium
+
+  * New upstream release.
+    * Fixes a configure test for libcap.
+  * Update Debian package to fix fine-grained capability dropping support.
+    Together with the upstream fixes, this enables capability dropping,
+    which was previously broken. (Closes: #492614)
+    * Run autoheader before autoconf, so HAVE_LIBCAP gets into the right .h
+      file.
+    * Change build-dependency from libcap-dev to libcap2-dev, as libcap-dev is
+      deprecated.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sun, 27 Jul 2008 22:18:26 +0200
+
+apache2-mpm-itk (2.2.6-01-3.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Correctly determine the dependency on apache2.2-common. (Closes: #477772)
+
+ -- Stefan Fritsch <sf@debian.org>  Wed, 18 Jun 2008 23:09:34 +0200
+
+apache2-mpm-itk (2.2.6-01-3) unstable; urgency=low
+
+  * Use config.nice from apache2-src. This allows us to drop the
+    build-dependency on apache2-prefork-dev.
+    * Bump versioned build-dependency on apache2-src to 2.2.9.
+    * Build-depend on libaprutil1-dev, since we no lenger get it in
+      transitively from apache2-prefork-dev.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sun, 15 Jun 2008 10:11:49 -0700
+
+apache2-mpm-itk (2.2.6-01-2) unstable; urgency=low
+
+  * Update the long description to better reflect the status of the package
+    (it can hardly be called â€œhighly experimentalâ€� anymore).
+  * Lintian fixes:
+    * Build-depend on apache2-src (>= 2.2.6) instead of apache2-src
+      (>= 2.2.6-1).
+    * Update to Standards-Version 3.7.3 (no changes needed).
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Tue, 29 Apr 2008 00:55:41 +0200
+
+apache2-mpm-itk (2.2.6-01-1) unstable; urgency=high
+
+  * New upstream release, with patches updated for Apache 2.2.6. Should fix
+    FTBFS (but that FTBFS was silently ignored, see next item).
+    * Update the apache2-src build dependency to at least 2.2.6-1, as I'm
+      unsure of the effects of building with this patch set against older
+      versions.
+  * Use "set -e" in the patch target so failing hunks are not ignored during
+    building.
+  * Updated the homepage URL in debian/copyright, and added
+    licensing/copyright/tarball information.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sat, 05 Jan 2008 12:27:08 +0100
+
+apache2-mpm-itk (2.2.3-04-3) unstable; urgency=medium
+
+  * Provide and conflict with apache2-mpm, in line with new practice from
+    the main Apache package. This replaces the old conflict lines, as well as
+    the Provides: apache2-modules.
+  * apache2-src now contains a top-level directory; adjust debian/rules
+    accordingly so we just unpack the tarball instead of making an apache2.2
+    directory and untarring within that. Fixes FTBFS with newer apache2-src.
+    (Closes: #428919)
+    * Build-depend on apache2-src (>= 2.2.3-5), as this will now FTBFS with
+      older apache2-src versions.
+  * Remove an obsolete comment from the debian/rules source target.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Fri, 15 Jun 2007 13:19:51 +0200
+
+apache2-mpm-itk (2.2.3-04-2) unstable; urgency=low
+
+  * Don't build-depend on libcap-dev for non-Linux architectures, which
+    prevents building on those; patch from Cyril Brulebois.
+    (Closes: #416460)
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sat, 19 May 2007 01:48:11 +0200
+
+apache2-mpm-itk (2.2.3-04-1) unstable; urgency=low
+
+  * New upstream release; now with split patches in a tarball (with license
+    and all) instead of one monolithic patch.
+    * Adjust debian/rules accordingly.
+    * Make a "source" target that uses quilt instead of manual patching.
+  * Remove workaround for old apache2-src.
+  * Drop dh_testroot from the clean target, as we do not really need root for
+    it, and it's convenient to be able to just do "debian/rules source" without
+    using fakeroot.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Wed, 25 Apr 2007 14:13:33 +0200
+
+apache2-mpm-itk (2.2.3-01-1) unstable; urgency=low
+
+  * Initial port to Apache 2.2, and upload to Debian.
+
+ -- Steinar H. Gunderson <sesse@debian.org>  Sun, 29 Oct 2006 23:05:36 +0100
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/07-base-functionality.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/07-base-functionality.patch
@@ -0,0 +1,218 @@
+Add the base functionality of mpm_itk over prefork; parse the new configuration
+options, fork on each new connection, and setuid() as required.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-03-21 23:52:01.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-04-14 23:27:51.000000000 +0200
+@@ -26,6 +26,11 @@
+ #include "apr_thread_proc.h"
+ #include "apr_signal.h"
+ 
++# define _DBG(text,par...) \
++    ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, \
++                "(itkmpm: pid=%d uid=%d, gid=%d) %s(): " text, \
++                getpid(), getuid(), getgid(), __FUNCTION__, par)
++
+ #define APR_WANT_STDIO
+ #define APR_WANT_STRFUNC
+ #include "apr_want.h"
+@@ -47,6 +52,7 @@
+ #include "http_config.h"
+ #include "http_core.h"          /* for get_remote_host */
+ #include "http_connection.h"
++#include "http_request.h"       /* for ap_hook_post_perdir_config */
+ #include "scoreboard.h"
+ #include "ap_mpm.h"
+ #include "unixd.h"
+@@ -146,6 +152,15 @@
+ 
+ static volatile int die_now = 0;
+ 
++typedef struct
++{
++    uid_t uid;
++    gid_t gid;
++    char *username;
++} itk_per_dir_conf;
++
++module AP_MODULE_DECLARE_DATA mpm_itk_module;
++
+ #ifdef GPROF
+ /*
+  * change directory for gprof to plop the gmon.out file
+@@ -512,10 +527,6 @@
+         clean_child_exit(APEXIT_CHILDFATAL);
+     }
+ 
+-    if (unixd_setup_child()) {
+-        clean_child_exit(APEXIT_CHILDFATAL);
+-    }
+-
+     ap_run_child_init(pchild, ap_server_conf);
+ 
+     ap_create_sb_handle(&sbh, pchild, my_child_num, 0);
+@@ -651,10 +662,38 @@
+          * socket options, file descriptors, and read/write buffers.
+          */
+ 
+-        current_conn = ap_run_create_connection(ptrans, ap_server_conf, csd, my_child_num, sbh, bucket_alloc);
+-        if (current_conn) {
+-            ap_process_connection(current_conn, csd);
+-            ap_lingering_close(current_conn);
++        {
++            pid_t pid = fork(), child_pid;
++            int status;
++            switch (pid) {
++            case -1:
++                ap_log_error(APLOG_MARK, APLOG_ERR, errno, NULL, "fork: Unable to fork new process");
++                break;
++            case 0: /* child */
++                apr_proc_mutex_child_init(&accept_mutex, ap_lock_fname, pchild);
++                current_conn = ap_run_create_connection(ptrans, ap_server_conf, csd, my_child_num, sbh, bucket_alloc);
++                if (current_conn) {
++                    ap_process_connection(current_conn, csd);
++                    ap_lingering_close(current_conn);
++                }
++                exit(0);
++            default: /* parent; just wait for child to be done */
++                do {
++                    child_pid = waitpid(pid, &status, 0);
++                } while (child_pid == -1 && errno == EINTR);
++
++                if (child_pid != pid || !WIFEXITED(status)) {
++                    if (WIFSIGNALED(status)) {
++                        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, "child died with signal %u", WTERMSIG(status));
++                    } else if (WEXITSTATUS(status) != 0) {
++                        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf, "child exited with non-zero exit status %u", WEXITSTATUS(status));
++                    } else {
++                        ap_log_error(APLOG_MARK, APLOG_ERR, errno, NULL, "waitpid() failed");
++                    }
++                    clean_child_exit(1);
++                }
++                break;
++            }
+         }
+ 
+         /* Check the pod and the generation number after processing a
+@@ -672,6 +711,10 @@
+              */
+             die_now = 1;
+         }
++
++        /* if we have already setuid(), die (we can't be used anyhow) */
++        if (getuid())
++            die_now = 1;
+     }
+     clean_child_exit(0);
+ }
+@@ -1334,6 +1377,56 @@
+     return OK;
+ }
+ 
++static int itk_post_perdir_config(request_rec *r)
++{
++    uid_t wanted_uid;
++    gid_t wanted_gid;
++    const char *wanted_username;
++    int err = 0;
++
++    itk_per_dir_conf *dconf =
++        (itk_per_dir_conf *) ap_get_module_config(r->per_dir_config, &mpm_itk_module);
++
++    strncpy(ap_scoreboard_image->servers[my_child_num][0].vhost, r->server->server_hostname, 31);
++    ap_scoreboard_image->servers[my_child_num][0].vhost[31] = 0;
++
++    wanted_uid = dconf->uid;
++    wanted_gid = dconf->gid;
++    wanted_username = dconf->username;
++
++    if (wanted_uid == -1 || wanted_gid == -1) {
++        wanted_uid = unixd_config.user_id;
++        wanted_gid = unixd_config.group_id;
++        wanted_username = unixd_config.user_name;
++    }
++
++    if (wanted_uid != -1 && wanted_gid != -1 && (getuid() != wanted_uid || getgid() != wanted_gid)) {
++        if (setgid(wanted_gid)) {
++            _DBG("setgid(%d): %s", wanted_gid, strerror(errno));
++            err = 1;
++        } else if (initgroups(wanted_username, wanted_gid)) {
++            _DBG("initgroups(%s, %d): %s", wanted_username, wanted_gid, strerror(errno));
++            err = 1;
++        } else if (setuid(wanted_uid)) {
++            _DBG("setuid(%d): %s", wanted_uid, strerror(errno));
++            err = 1;
++        }
++    }
++
++    /*
++     * Most likely a case of switching uid/gid within a persistent
++     * connection; the RFCs allow us to just close the connection
++     * at anytime, so we excercise our right. :-)
++     */
++    if (err) {
++        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, \
++            "Couldn't set uid/gid, closing connection.");
++        ap_lingering_close(r->connection);
++        exit(0);
++    }
++    return OK;
++}
++
+ static void itk_hooks(apr_pool_t *p)
+ {
+     /* The itk open_logs phase must run before the core's, or stderr
+@@ -1351,6 +1444,9 @@
+      * to retrieve it, so register as REALLY_FIRST
+      */
+     ap_hook_pre_config(itk_pre_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
++
++    /* set the uid as fast as possible, but not before merging per-dit config */
++    ap_hook_header_parser(itk_post_perdir_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
+ }
+ 
+ static const char *set_daemons_to_start(cmd_parms *cmd, void *dummy, const char *arg)
+@@ -1463,6 +1559,15 @@
+     return NULL;
+ }
+ 
++static const char *assign_user_id (cmd_parms *cmd, void *ptr, const char *user_name, const char *group_name)
++{
++    itk_per_dir_conf *dconf = (itk_per_dir_conf *) ptr;
++    dconf->username = apr_pstrdup(cmd->pool, user_name);
++    dconf->uid = ap_uname2id(user_name);
++    dconf->gid = ap_gname2id(group_name);
++    return NULL;
++}
++
+ static const command_rec itk_cmds[] = {
+ UNIX_DAEMON_COMMANDS,
+ LISTEN_COMMANDS,
+@@ -1476,14 +1581,25 @@
+               "Maximum number of children alive at the same time"),
+ AP_INIT_TAKE1("ServerLimit", set_server_limit, NULL, RSRC_CONF,
+               "Maximum value of MaxClients for this run of Apache"),
++AP_INIT_TAKE2("AssignUserID", assign_user_id, NULL, RSRC_CONF|ACCESS_CONF,
++              "Tie a virtual host to a specific child process."),
+ AP_GRACEFUL_SHUTDOWN_TIMEOUT_COMMAND,
+ { NULL }
+ };
+ 
++/* == allocate a private per-dir config structure == */
++static void *itk_create_dir_config(apr_pool_t *p, char *dummy)
++{
++    itk_per_dir_conf *c = (itk_per_dir_conf *)
++        apr_pcalloc(p, sizeof(itk_per_dir_conf));
++    c->uid = c->gid = -1;
++    return c;
++}
++
+ module AP_MODULE_DECLARE_DATA mpm_itk_module = {
+     MPM20_MODULE_STUFF,
+     ap_mpm_rewrite_args,        /* hook to run before apache parses args */
+-    NULL,                       /* create per-directory config structure */
++    itk_create_dir_config,      /* create per-directory config structure */
+     NULL,                       /* merge per-directory config structures */
+     NULL,                       /* create per-server config structure */
+     NULL,                       /* merge per-server config structures */
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/08-max-clients-per-vhost.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/08-max-clients-per-vhost.patch
@@ -0,0 +1,94 @@
+Enforce the per-vhost server limit. Note that this is per-vhost, not
+per-directory (since it works by reading the scoreboard), so we need to add
+per-server configuration data.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-03-21 13:03:45.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-03-21 13:03:50.000000000 +0100
+@@ -159,6 +159,11 @@
+     char *username;
+ } itk_per_dir_conf;
+ 
++typedef struct
++{
++    int max_clients_vhost;
++} itk_server_conf;
++
+ module AP_MODULE_DECLARE_DATA mpm_itk_module;
+ 
+ #ifdef GPROF
+@@ -1383,6 +1388,26 @@
+     gid_t wanted_gid;
+     const char *wanted_username;
+     int err = 0;
++    
++    itk_server_conf *sconf =
++        (itk_server_conf *) ap_get_module_config(r->server->module_config, &mpm_itk_module);
++
++    /* Enforce MaxClientsVhost. */
++    if (sconf->max_clients_vhost > 0) {
++        int i, num_other_servers = 0;
++        for (i = 0; i < ap_daemons_limit; ++i) {
++            worker_score *ws = &ap_scoreboard_image->servers[i][0];
++            if (ws->status >= SERVER_BUSY_READ && strncmp(ws->vhost, r->server->server_hostname, 31) == 0)
++                ++num_other_servers;
++        }
++
++        if (num_other_servers > sconf->max_clients_vhost) {
++            ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, \
++                "MaxClientsVhost reached for %s, refusing client.",
++                r->server->server_hostname);
++            return HTTP_SERVICE_UNAVAILABLE;
++        }
++    }
+ 
+     itk_per_dir_conf *dconf =
+         (itk_per_dir_conf *) ap_get_module_config(r->per_dir_config, &mpm_itk_module);
+@@ -1568,6 +1593,14 @@
+     return NULL;
+ }
+ 
++static const char *set_max_clients_vhost (cmd_parms *cmd, void *dummy, const char *arg)   
++{
++    itk_server_conf *sconf =
++        (itk_server_conf *) ap_get_module_config(cmd->server->module_config, &mpm_itk_module);
++    sconf->max_clients_vhost = atoi(arg);
++    return NULL;
++}
++
+ static const command_rec itk_cmds[] = {
+ UNIX_DAEMON_COMMANDS,
+ LISTEN_COMMANDS,
+@@ -1583,6 +1616,8 @@
+               "Maximum value of MaxClients for this run of Apache"),
+ AP_INIT_TAKE2("AssignUserID", assign_user_id, NULL, RSRC_CONF|ACCESS_CONF,
+               "Tie a virtual host to a specific child process."),
++AP_INIT_TAKE1("MaxClientsVHost", set_max_clients_vhost, NULL, RSRC_CONF,
++              "Maximum number of children alive at the same time for this virtual host."),
+ AP_GRACEFUL_SHUTDOWN_TIMEOUT_COMMAND,
+ { NULL }
+ };
+@@ -1596,12 +1631,21 @@
+     return c;
+ }
+ 
++/* == allocate a private server config structure == */
++static void *itk_create_server_config(apr_pool_t *p, server_rec *s)
++{
++    itk_server_conf *c = (itk_server_conf *)
++        apr_pcalloc(p, sizeof(itk_server_conf));
++    c->max_clients_vhost = -1;
++    return c;
++}
++
+ module AP_MODULE_DECLARE_DATA mpm_itk_module = {
+     MPM20_MODULE_STUFF,
+     ap_mpm_rewrite_args,        /* hook to run before apache parses args */
+     itk_create_dir_config,      /* create per-directory config structure */
+     NULL,                       /* merge per-directory config structures */
+-    NULL,                       /* create per-server config structure */
++    itk_create_server_config,   /* create per-server config structure */
+     NULL,                       /* merge per-server config structures */
+     itk_cmds,                   /* command apr_table_t */
+     itk_hooks,                  /* register hooks */
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/03-add-mpm-to-build-system.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/03-add-mpm-to-build-system.patch
@@ -0,0 +1,25 @@
+Add the new MPM to the build system as an alternative to the other MPMs,
+and mark it as experimental.
+
+Index: apache2.2/server/mpm/config.m4
+===================================================================
+--- apache2.2.orig/server/mpm/config.m4	2007-01-29 21:30:26.000000000 +0100
++++ apache2.2/server/mpm/config.m4	2007-01-29 21:30:35.000000000 +0100
+@@ -1,7 +1,7 @@
+ AC_MSG_CHECKING(which MPM to use)
+ AC_ARG_WITH(mpm,
+ APACHE_HELP_STRING(--with-mpm=MPM,Choose the process model for Apache to use.
+-                          MPM={beos|event|worker|prefork|mpmt_os2|winnt}),[
++                          MPM={beos|event|worker|prefork|mpmt_os2|winnt|itk}),[
+   APACHE_MPM=$withval
+ ],[
+   if test "x$APACHE_MPM" = "x"; then
+@@ -23,7 +23,7 @@
+ 
+ ap_mpm_is_experimental ()
+ {
+-    if test "$apache_cv_mpm" = "event" ; then
++    if test "$apache_cv_mpm" = "event" -o "$apache_cv_mpm" = "itk" ; then
+         return 0
+     else
+         return 1
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/05-add-copyright.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/05-add-copyright.patch
@@ -0,0 +1,87 @@
+Add copyright notices, as the next patches are going to add code.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-03-21 13:02:18.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-03-21 13:02:33.000000000 +0100
+@@ -12,6 +12,12 @@
+  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
++ * 
++ * Portions copyright 2005-2009 Steinar H. Gunderson <sgunderson@bigfoot.com>.
++ * Licensed under the same terms as the rest of Apache.
++ *
++ * Portions copyright 2008 Knut Auvor Grythe <knut@auvor.no>.
++ * Licensed under the same terms as the rest of Apache.
+  */
+ 
+ #include "apr.h"
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm.h
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/mpm.h	2009-03-21 13:02:18.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm.h	2009-03-21 13:02:33.000000000 +0100
+@@ -12,6 +12,12 @@
+  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
++ *
++ * Portions copyright 2005-2009 Steinar H. Gunderson <sgunderson@bigfoot.com>.
++ * Licensed under the same terms as the rest of Apache.
++ *
++ * Portions copyright 2008 Knut Auvor Grythe <knut@auvor.no>.
++ * Licensed under the same terms as the rest of Apache.
+  */
+ 
+ /**
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/mpm_default.h	2009-03-21 13:02:18.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h	2009-03-21 13:02:33.000000000 +0100
+@@ -12,6 +12,12 @@
+  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
++ * 
++ * Portions copyright 2005-2009 Steinar H. Gunderson <sgunderson@bigfoot.com>.
++ * Licensed under the same terms as the rest of Apache.
++ * 
++ * Portions copyright 2008 Knut Auvor Grythe <knut@auvor.no>.
++ * Licensed under the same terms as the rest of Apache.
+  */
+ 
+ /**
+Index: httpd-2.2.11/include/http_request.h
+===================================================================
+--- httpd-2.2.11.orig/include/http_request.h	2009-03-21 13:03:19.000000000 +0100
++++ httpd-2.2.11/include/http_request.h	2009-03-21 13:03:31.000000000 +0100
+@@ -12,6 +12,12 @@
+  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
++ * 
++ * Portions copyright 2005-2009 Steinar H. Gunderson <sgunderson@bigfoot.com>.
++ * Licensed under the same terms as the rest of Apache.
++ * 
++ * Portions copyright 2008 Knut Auvor Grythe <knut@auvor.no>.
++ * Licensed under the same terms as the rest of Apache.
+  */
+ 
+ /**
+Index: httpd-2.2.11/server/request.c
+===================================================================
+--- httpd-2.2.11.orig/server/request.c	2009-03-21 13:03:04.000000000 +0100
++++ httpd-2.2.11/server/request.c	2009-03-21 13:03:13.000000000 +0100
+@@ -12,6 +12,12 @@
+  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  * See the License for the specific language governing permissions and
+  * limitations under the License.
++ * 
++ * Portions copyright 2005-2009 Steinar H. Gunderson <sgunderson@bigfoot.com>.
++ * Licensed under the same terms as the rest of Apache.
++ * 
++ * Portions copyright 2008 Knut Auvor Grythe <knut@auvor.no>.
++ * Licensed under the same terms as the rest of Apache.
+  */
+ 
+ /*
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/01-copy-prefork.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/01-copy-prefork.patch
@@ -0,0 +1,1662 @@
+Just copies server/mpm/prefork/* to server/mpm/experimental/itk/, with prefork.c
+copied to itk.c. Basically the patch equivalent of
+
+  mkdir server/mpm/experimental/itk/
+  cp server/mpm/prefork/* server/mpm/experimental/itk/
+  mv server/mpm/experimental/itk/prefork.c server/mpm/experimental/itk/itk.c
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/Makefile.in
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ httpd-2.2.11/server/mpm/experimental/itk/Makefile.in	2009-03-17 21:38:54.000000000 +0100
+@@ -0,0 +1,5 @@
++
++LTLIBRARY_NAME    = libprefork.la
++LTLIBRARY_SOURCES = prefork.c
++
++include $(top_srcdir)/build/ltlib.mk
+Index: httpd-2.2.11/server/mpm/experimental/itk/config.m4
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ httpd-2.2.11/server/mpm/experimental/itk/config.m4	2009-03-17 21:38:53.000000000 +0100
+@@ -0,0 +1,3 @@
++if test "$MPM_NAME" = "prefork" ; then
++    APACHE_FAST_OUTPUT(server/mpm/$MPM_NAME/Makefile)
++fi
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-03-17 21:38:54.000000000 +0100
+@@ -0,0 +1,1486 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++#include "apr.h"
++#include "apr_portable.h"
++#include "apr_strings.h"
++#include "apr_thread_proc.h"
++#include "apr_signal.h"
++
++#define APR_WANT_STDIO
++#define APR_WANT_STRFUNC
++#include "apr_want.h"
++
++#if APR_HAVE_UNISTD_H
++#include <unistd.h>
++#endif
++#if APR_HAVE_SYS_TYPES_H
++#include <sys/types.h>
++#endif
++
++#define CORE_PRIVATE
++
++#include "ap_config.h"
++#include "httpd.h"
++#include "mpm_default.h"
++#include "http_main.h"
++#include "http_log.h"
++#include "http_config.h"
++#include "http_core.h"          /* for get_remote_host */
++#include "http_connection.h"
++#include "scoreboard.h"
++#include "ap_mpm.h"
++#include "unixd.h"
++#include "mpm_common.h"
++#include "ap_listen.h"
++#include "ap_mmn.h"
++#include "apr_poll.h"
++
++#ifdef HAVE_BSTRING_H
++#include <bstring.h>            /* for IRIX, FD_SET calls bzero() */
++#endif
++#ifdef HAVE_TIME_H
++#include <time.h>
++#endif
++#ifdef HAVE_SYS_PROCESSOR_H
++#include <sys/processor.h> /* for bindprocessor() */
++#endif
++
++#include <signal.h>
++#include <sys/times.h>
++
++/* Limit on the total --- clients will be locked out if more servers than
++ * this are needed.  It is intended solely to keep the server from crashing
++ * when things get out of hand.
++ *
++ * We keep a hard maximum number of servers, for two reasons --- first off,
++ * in case something goes seriously wrong, we want to stop the fork bomb
++ * short of actually crashing the machine we're running on by filling some
++ * kernel table.  Secondly, it keeps the size of the scoreboard file small
++ * enough that we can read the whole thing without worrying too much about
++ * the overhead.
++ */
++#ifndef DEFAULT_SERVER_LIMIT
++#define DEFAULT_SERVER_LIMIT 256
++#endif
++
++/* Admin can't tune ServerLimit beyond MAX_SERVER_LIMIT.  We want
++ * some sort of compile-time limit to help catch typos.
++ */
++#ifndef MAX_SERVER_LIMIT
++#define MAX_SERVER_LIMIT 200000
++#endif
++
++#ifndef HARD_THREAD_LIMIT
++#define HARD_THREAD_LIMIT 1
++#endif
++
++/* config globals */
++
++int ap_threads_per_child=0;         /* Worker threads per child */
++static apr_proc_mutex_t *accept_mutex;
++static int ap_daemons_to_start=0;
++static int ap_daemons_min_free=0;
++static int ap_daemons_max_free=0;
++static int ap_daemons_limit=0;      /* MaxClients */
++static int server_limit = DEFAULT_SERVER_LIMIT;
++static int first_server_limit = 0;
++static int changed_limit_at_restart;
++static int mpm_state = AP_MPMQ_STARTING;
++static ap_pod_t *pod;
++
++/*
++ * The max child slot ever assigned, preserved across restarts.  Necessary
++ * to deal with MaxClients changes across AP_SIG_GRACEFUL restarts.  We
++ * use this value to optimize routines that have to scan the entire scoreboard.
++ */
++int ap_max_daemons_limit = -1;
++server_rec *ap_server_conf;
++
++/* one_process --- debugging mode variable; can be set from the command line
++ * with the -X flag.  If set, this gets you the child_main loop running
++ * in the process which originally started up (no detach, no make_child),
++ * which is a pretty nice debugging environment.  (You'll get a SIGHUP
++ * early in standalone_main; just continue through.  This is the server
++ * trying to kill off any child processes which it might have lying
++ * around --- Apache doesn't keep track of their pids, it just sends
++ * SIGHUP to the process group, ignoring it in the root process.
++ * Continue through and you'll be fine.).
++ */
++
++static int one_process = 0;
++
++static apr_pool_t *pconf;               /* Pool for config stuff */
++static apr_pool_t *pchild;              /* Pool for httpd child stuff */
++
++static pid_t ap_my_pid; /* it seems silly to call getpid all the time */
++static pid_t parent_pid;
++#ifndef MULTITHREAD
++static int my_child_num;
++#endif
++ap_generation_t volatile ap_my_generation=0;
++
++#ifdef TPF
++int tpf_child = 0;
++char tpf_server_name[INETD_SERVNAME_LENGTH+1];
++#endif /* TPF */
++
++static volatile int die_now = 0;
++
++#ifdef GPROF
++/*
++ * change directory for gprof to plop the gmon.out file
++ * configure in httpd.conf:
++ * GprofDir $RuntimeDir/   -> $ServerRoot/$RuntimeDir/gmon.out
++ * GprofDir $RuntimeDir/%  -> $ServerRoot/$RuntimeDir/gprof.$pid/gmon.out
++ */
++static void chdir_for_gprof(void)
++{
++    core_server_config *sconf =
++        ap_get_module_config(ap_server_conf->module_config, &core_module);
++    char *dir = sconf->gprof_dir;
++    const char *use_dir;
++
++    if(dir) {
++        apr_status_t res;
++        char *buf = NULL ;
++        int len = strlen(sconf->gprof_dir) - 1;
++        if(*(dir + len) == '%') {
++            dir[len] = '\0';
++            buf = ap_append_pid(pconf, dir, "gprof.");
++        }
++        use_dir = ap_server_root_relative(pconf, buf ? buf : dir);
++        res = apr_dir_make(use_dir,
++                           APR_UREAD | APR_UWRITE | APR_UEXECUTE |
++                           APR_GREAD | APR_GEXECUTE |
++                           APR_WREAD | APR_WEXECUTE, pconf);
++        if(res != APR_SUCCESS && !APR_STATUS_IS_EEXIST(res)) {
++            ap_log_error(APLOG_MARK, APLOG_ERR, res, ap_server_conf,
++                         "gprof: error creating directory %s", dir);
++        }
++    }
++    else {
++        use_dir = ap_server_root_relative(pconf, DEFAULT_REL_RUNTIMEDIR);
++    }
++
++    chdir(use_dir);
++}
++#else
++#define chdir_for_gprof()
++#endif
++
++/* XXX - I don't know if TPF will ever use this module or not, so leave
++ * the ap_check_signals calls in but disable them - manoj */
++#define ap_check_signals()
++
++/* a clean exit from a child with proper cleanup */
++static void clean_child_exit(int code) __attribute__ ((noreturn));
++static void clean_child_exit(int code)
++{
++    mpm_state = AP_MPMQ_STOPPING;
++
++    if (pchild) {
++        apr_pool_destroy(pchild);
++    }
++    ap_mpm_pod_close(pod);
++    chdir_for_gprof();
++    exit(code);
++}
++
++static void accept_mutex_on(void)
++{
++    apr_status_t rv = apr_proc_mutex_lock(accept_mutex);
++    if (rv != APR_SUCCESS) {
++        const char *msg = "couldn't grab the accept mutex";
++
++        if (ap_my_generation !=
++            ap_scoreboard_image->global->running_generation) {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, NULL, "%s", msg);
++            clean_child_exit(0);
++        }
++        else {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, rv, NULL, "%s", msg);
++            exit(APEXIT_CHILDFATAL);
++        }
++    }
++}
++
++static void accept_mutex_off(void)
++{
++    apr_status_t rv = apr_proc_mutex_unlock(accept_mutex);
++    if (rv != APR_SUCCESS) {
++        const char *msg = "couldn't release the accept mutex";
++
++        if (ap_my_generation !=
++            ap_scoreboard_image->global->running_generation) {
++            ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, NULL, "%s", msg);
++            /* don't exit here... we have a connection to
++             * process, after which point we'll see that the
++             * generation changed and we'll exit cleanly
++             */
++        }
++        else {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, rv, NULL, "%s", msg);
++            exit(APEXIT_CHILDFATAL);
++        }
++    }
++}
++
++/* On some architectures it's safe to do unserialized accept()s in the single
++ * Listen case.  But it's never safe to do it in the case where there's
++ * multiple Listen statements.  Define SINGLE_LISTEN_UNSERIALIZED_ACCEPT
++ * when it's safe in the single Listen case.
++ */
++#ifdef SINGLE_LISTEN_UNSERIALIZED_ACCEPT
++#define SAFE_ACCEPT(stmt) do {if (ap_listeners->next) {stmt;}} while(0)
++#else
++#define SAFE_ACCEPT(stmt) do {stmt;} while(0)
++#endif
++
++AP_DECLARE(apr_status_t) ap_mpm_query(int query_code, int *result)
++{
++    switch(query_code){
++    case AP_MPMQ_MAX_DAEMON_USED:
++        *result = ap_daemons_limit;
++        return APR_SUCCESS;
++    case AP_MPMQ_IS_THREADED:
++        *result = AP_MPMQ_NOT_SUPPORTED;
++        return APR_SUCCESS;
++    case AP_MPMQ_IS_FORKED:
++        *result = AP_MPMQ_DYNAMIC;
++        return APR_SUCCESS;
++    case AP_MPMQ_HARD_LIMIT_DAEMONS:
++        *result = server_limit;
++        return APR_SUCCESS;
++    case AP_MPMQ_HARD_LIMIT_THREADS:
++        *result = HARD_THREAD_LIMIT;
++        return APR_SUCCESS;
++    case AP_MPMQ_MAX_THREADS:
++        *result = 0;
++        return APR_SUCCESS;
++    case AP_MPMQ_MIN_SPARE_DAEMONS:
++        *result = ap_daemons_min_free;
++        return APR_SUCCESS;
++    case AP_MPMQ_MIN_SPARE_THREADS:
++        *result = 0;
++        return APR_SUCCESS;
++    case AP_MPMQ_MAX_SPARE_DAEMONS:
++        *result = ap_daemons_max_free;
++        return APR_SUCCESS;
++    case AP_MPMQ_MAX_SPARE_THREADS:
++        *result = 0;
++        return APR_SUCCESS;
++    case AP_MPMQ_MAX_REQUESTS_DAEMON:
++        *result = ap_max_requests_per_child;
++        return APR_SUCCESS;
++    case AP_MPMQ_MAX_DAEMONS:
++        *result = server_limit;
++        return APR_SUCCESS;
++    case AP_MPMQ_MPM_STATE:
++        *result = mpm_state;
++        return APR_SUCCESS;
++    }
++    return APR_ENOTIMPL;
++}
++
++#if defined(NEED_WAITPID)
++/*
++   Systems without a real waitpid sometimes lose a child's exit while waiting
++   for another.  Search through the scoreboard for missing children.
++ */
++int reap_children(int *exitcode, apr_exit_why_e *status)
++{
++    int n, pid;
++
++    for (n = 0; n < ap_max_daemons_limit; ++n) {
++        if (ap_scoreboard_image->servers[n][0].status != SERVER_DEAD &&
++                kill((pid = ap_scoreboard_image->parent[n].pid), 0) == -1) {
++            ap_update_child_status_from_indexes(n, 0, SERVER_DEAD, NULL);
++            /* just mark it as having a successful exit status */
++            *status = APR_PROC_EXIT;
++            *exitcode = 0;
++            return(pid);
++        }
++    }
++    return 0;
++}
++#endif
++
++/*****************************************************************
++ * Connection structures and accounting...
++ */
++
++static void just_die(int sig)
++{
++    clean_child_exit(0);
++}
++
++static void stop_listening(int sig)
++{
++    ap_close_listeners();
++
++    /* For a graceful stop, we want the child to exit when done */
++    die_now = 1;
++}
++
++/* volatile just in case */
++static int volatile shutdown_pending;
++static int volatile restart_pending;
++static int volatile is_graceful;
++
++static void sig_term(int sig)
++{
++    if (shutdown_pending == 1) {
++        /* Um, is this _probably_ not an error, if the user has
++         * tried to do a shutdown twice quickly, so we won't
++         * worry about reporting it.
++         */
++        return;
++    }
++    shutdown_pending = 1;
++    is_graceful = (sig == AP_SIG_GRACEFUL_STOP);
++}
++
++/* restart() is the signal handler for SIGHUP and AP_SIG_GRACEFUL
++ * in the parent process, unless running in ONE_PROCESS mode
++ */
++static void restart(int sig)
++{
++    if (restart_pending == 1) {
++        /* Probably not an error - don't bother reporting it */
++        return;
++    }
++    restart_pending = 1;
++    is_graceful = (sig == AP_SIG_GRACEFUL);
++}
++
++static void set_signals(void)
++{
++#ifndef NO_USE_SIGACTION
++    struct sigaction sa;
++#endif
++
++    if (!one_process) {
++        ap_fatal_signal_setup(ap_server_conf, pconf);
++    }
++
++#ifndef NO_USE_SIGACTION
++    sigemptyset(&sa.sa_mask);
++    sa.sa_flags = 0;
++
++    sa.sa_handler = sig_term;
++    if (sigaction(SIGTERM, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGTERM)");
++#ifdef AP_SIG_GRACEFUL_STOP
++    if (sigaction(AP_SIG_GRACEFUL_STOP, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf,
++                     "sigaction(" AP_SIG_GRACEFUL_STOP_STRING ")");
++#endif
++#ifdef SIGINT
++    if (sigaction(SIGINT, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGINT)");
++#endif
++#ifdef SIGXCPU
++    sa.sa_handler = SIG_DFL;
++    if (sigaction(SIGXCPU, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGXCPU)");
++#endif
++#ifdef SIGXFSZ
++    sa.sa_handler = SIG_DFL;
++    if (sigaction(SIGXFSZ, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGXFSZ)");
++#endif
++#ifdef SIGPIPE
++    sa.sa_handler = SIG_IGN;
++    if (sigaction(SIGPIPE, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGPIPE)");
++#endif
++
++    /* we want to ignore HUPs and AP_SIG_GRACEFUL while we're busy
++     * processing one
++     */
++    sigaddset(&sa.sa_mask, SIGHUP);
++    sigaddset(&sa.sa_mask, AP_SIG_GRACEFUL);
++    sa.sa_handler = restart;
++    if (sigaction(SIGHUP, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(SIGHUP)");
++    if (sigaction(AP_SIG_GRACEFUL, &sa, NULL) < 0)
++        ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "sigaction(" AP_SIG_GRACEFUL_STRING ")");
++#else
++    if (!one_process) {
++#ifdef SIGXCPU
++        apr_signal(SIGXCPU, SIG_DFL);
++#endif /* SIGXCPU */
++#ifdef SIGXFSZ
++        apr_signal(SIGXFSZ, SIG_DFL);
++#endif /* SIGXFSZ */
++    }
++
++    apr_signal(SIGTERM, sig_term);
++#ifdef SIGHUP
++    apr_signal(SIGHUP, restart);
++#endif /* SIGHUP */
++#ifdef AP_SIG_GRACEFUL
++    apr_signal(AP_SIG_GRACEFUL, restart);
++#endif /* AP_SIG_GRACEFUL */
++#ifdef AP_SIG_GRACEFUL_STOP
++    apr_signal(AP_SIG_GRACEFUL_STOP, sig_term);
++#endif /* AP_SIG_GRACEFUL */
++#ifdef SIGPIPE
++    apr_signal(SIGPIPE, SIG_IGN);
++#endif /* SIGPIPE */
++
++#endif
++}
++
++/*****************************************************************
++ * Child process main loop.
++ * The following vars are static to avoid getting clobbered by longjmp();
++ * they are really private to child_main.
++ */
++
++static int requests_this_child;
++static int num_listensocks = 0;
++
++
++int ap_graceful_stop_signalled(void)
++{
++    /* not ever called anymore... */
++    return 0;
++}
++
++
++static void child_main(int child_num_arg)
++{
++    apr_pool_t *ptrans;
++    apr_allocator_t *allocator;
++    apr_status_t status;
++    int i;
++    ap_listen_rec *lr;
++    apr_pollset_t *pollset;
++    ap_sb_handle_t *sbh;
++    apr_bucket_alloc_t *bucket_alloc;
++    int last_poll_idx = 0;
++
++    mpm_state = AP_MPMQ_STARTING; /* for benefit of any hooks that run as this
++                                   * child initializes
++                                   */
++
++    my_child_num = child_num_arg;
++    ap_my_pid = getpid();
++    requests_this_child = 0;
++
++    ap_fatal_signal_child_setup(ap_server_conf);
++
++    /* Get a sub context for global allocations in this child, so that
++     * we can have cleanups occur when the child exits.
++     */
++    apr_allocator_create(&allocator);
++    apr_allocator_max_free_set(allocator, ap_max_mem_free);
++    apr_pool_create_ex(&pchild, pconf, NULL, allocator);
++    apr_allocator_owner_set(allocator, pchild);
++
++    apr_pool_create(&ptrans, pchild);
++    apr_pool_tag(ptrans, "transaction");
++
++    /* needs to be done before we switch UIDs so we have permissions */
++    ap_reopen_scoreboard(pchild, NULL, 0);
++    status = apr_proc_mutex_child_init(&accept_mutex, ap_lock_fname, pchild);
++    if (status != APR_SUCCESS) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, status, ap_server_conf,
++                     "Couldn't initialize cross-process lock in child "
++                     "(%s) (%d)", ap_lock_fname, ap_accept_lock_mech);
++        clean_child_exit(APEXIT_CHILDFATAL);
++    }
++
++    if (unixd_setup_child()) {
++        clean_child_exit(APEXIT_CHILDFATAL);
++    }
++
++    ap_run_child_init(pchild, ap_server_conf);
++
++    ap_create_sb_handle(&sbh, pchild, my_child_num, 0);
++
++    (void) ap_update_child_status(sbh, SERVER_READY, (request_rec *) NULL);
++
++    /* Set up the pollfd array */
++    /* ### check the status */
++    (void) apr_pollset_create(&pollset, num_listensocks, pchild, 0);
++
++    for (lr = ap_listeners, i = num_listensocks; i--; lr = lr->next) {
++        apr_pollfd_t pfd = { 0 };
++
++        pfd.desc_type = APR_POLL_SOCKET;
++        pfd.desc.s = lr->sd;
++        pfd.reqevents = APR_POLLIN;
++        pfd.client_data = lr;
++
++        /* ### check the status */
++        (void) apr_pollset_add(pollset, &pfd);
++    }
++
++    mpm_state = AP_MPMQ_RUNNING;
++
++    bucket_alloc = apr_bucket_alloc_create(pchild);
++
++    /* die_now is set when AP_SIG_GRACEFUL is received in the child;
++     * shutdown_pending is set when SIGTERM is received when running
++     * in single process mode.  */
++    while (!die_now && !shutdown_pending) {
++        conn_rec *current_conn;
++        void *csd;
++
++        /*
++         * (Re)initialize this child to a pre-connection state.
++         */
++
++        apr_pool_clear(ptrans);
++
++        if ((ap_max_requests_per_child > 0
++             && requests_this_child++ >= ap_max_requests_per_child)) {
++            clean_child_exit(0);
++        }
++
++        (void) ap_update_child_status(sbh, SERVER_READY, (request_rec *) NULL);
++
++        /*
++         * Wait for an acceptable connection to arrive.
++         */
++
++        /* Lock around "accept", if necessary */
++        SAFE_ACCEPT(accept_mutex_on());
++
++        if (num_listensocks == 1) {
++            /* There is only one listener record, so refer to that one. */
++            lr = ap_listeners;
++        }
++        else {
++            /* multiple listening sockets - need to poll */
++            for (;;) {
++                apr_int32_t numdesc;
++                const apr_pollfd_t *pdesc;
++
++                /* timeout == -1 == wait forever */
++                status = apr_pollset_poll(pollset, -1, &numdesc, &pdesc);
++                if (status != APR_SUCCESS) {
++                    if (APR_STATUS_IS_EINTR(status)) {
++                        if (one_process && shutdown_pending) {
++                            return;
++                        }
++                        else if (die_now) {
++                            /* In graceful stop/restart; drop the mutex
++                             * and terminate the child. */
++                            SAFE_ACCEPT(accept_mutex_off());
++                            clean_child_exit(0);
++                        }
++                        continue;
++                    }
++                    /* Single Unix documents select as returning errnos
++                     * EBADF, EINTR, and EINVAL... and in none of those
++                     * cases does it make sense to continue.  In fact
++                     * on Linux 2.0.x we seem to end up with EFAULT
++                     * occasionally, and we'd loop forever due to it.
++                     */
++                    ap_log_error(APLOG_MARK, APLOG_ERR, status,
++                                 ap_server_conf, "apr_pollset_poll: (listen)");
++                    SAFE_ACCEPT(accept_mutex_off());
++                    clean_child_exit(1);
++                }
++
++                /* We can always use pdesc[0], but sockets at position N
++                 * could end up completely starved of attention in a very
++                 * busy server. Therefore, we round-robin across the
++                 * returned set of descriptors. While it is possible that
++                 * the returned set of descriptors might flip around and
++                 * continue to starve some sockets, we happen to know the
++                 * internal pollset implementation retains ordering
++                 * stability of the sockets. Thus, the round-robin should
++                 * ensure that a socket will eventually be serviced.
++                 */
++                if (last_poll_idx >= numdesc)
++                    last_poll_idx = 0;
++
++                /* Grab a listener record from the client_data of the poll
++                 * descriptor, and advance our saved index to round-robin
++                 * the next fetch.
++                 *
++                 * ### hmm... this descriptor might have POLLERR rather
++                 * ### than POLLIN
++                 */
++                lr = pdesc[last_poll_idx++].client_data;
++                goto got_fd;
++            }
++        }
++    got_fd:
++        /* if we accept() something we don't want to die, so we have to
++         * defer the exit
++         */
++        status = lr->accept_func(&csd, lr, ptrans);
++
++        SAFE_ACCEPT(accept_mutex_off());      /* unlock after "accept" */
++
++        if (status == APR_EGENERAL) {
++            /* resource shortage or should-not-occur occured */
++            clean_child_exit(1);
++        }
++        else if (status != APR_SUCCESS) {
++            continue;
++        }
++
++        /*
++         * We now have a connection, so set it up with the appropriate
++         * socket options, file descriptors, and read/write buffers.
++         */
++
++        current_conn = ap_run_create_connection(ptrans, ap_server_conf, csd, my_child_num, sbh, bucket_alloc);
++        if (current_conn) {
++            ap_process_connection(current_conn, csd);
++            ap_lingering_close(current_conn);
++        }
++
++        /* Check the pod and the generation number after processing a
++         * connection so that we'll go away if a graceful restart occurred
++         * while we were processing the connection or we are the lucky
++         * idle server process that gets to die.
++         */
++        if (ap_mpm_pod_check(pod) == APR_SUCCESS) { /* selected as idle? */
++            die_now = 1;
++        }
++        else if (ap_my_generation !=
++                 ap_scoreboard_image->global->running_generation) { /* restart? */
++            /* yeah, this could be non-graceful restart, in which case the
++             * parent will kill us soon enough, but why bother checking?
++             */
++            die_now = 1;
++        }
++    }
++    clean_child_exit(0);
++}
++
++
++static int make_child(server_rec *s, int slot)
++{
++    int pid;
++
++    if (slot + 1 > ap_max_daemons_limit) {
++        ap_max_daemons_limit = slot + 1;
++    }
++
++    if (one_process) {
++        apr_signal(SIGHUP, sig_term);
++        /* Don't catch AP_SIG_GRACEFUL in ONE_PROCESS mode :) */
++        apr_signal(SIGINT, sig_term);
++#ifdef SIGQUIT
++        apr_signal(SIGQUIT, SIG_DFL);
++#endif
++        apr_signal(SIGTERM, sig_term);
++        child_main(slot);
++        return 0;
++    }
++
++    (void) ap_update_child_status_from_indexes(slot, 0, SERVER_STARTING,
++                                               (request_rec *) NULL);
++
++
++#ifdef _OSD_POSIX
++    /* BS2000 requires a "special" version of fork() before a setuid() call */
++    if ((pid = os_fork(unixd_config.user_name)) == -1) {
++#elif defined(TPF)
++    if ((pid = os_fork(s, slot)) == -1) {
++#else
++    if ((pid = fork()) == -1) {
++#endif
++        ap_log_error(APLOG_MARK, APLOG_ERR, errno, s, "fork: Unable to fork new process");
++
++        /* fork didn't succeed. Fix the scoreboard or else
++         * it will say SERVER_STARTING forever and ever
++         */
++        (void) ap_update_child_status_from_indexes(slot, 0, SERVER_DEAD,
++                                                   (request_rec *) NULL);
++
++        /* In case system resources are maxxed out, we don't want
++         * Apache running away with the CPU trying to fork over and
++         * over and over again.
++         */
++        sleep(10);
++
++        return -1;
++    }
++
++    if (!pid) {
++#ifdef HAVE_BINDPROCESSOR
++        /* by default AIX binds to a single processor
++         * this bit unbinds children which will then bind to another cpu
++         */
++        int status = bindprocessor(BINDPROCESS, (int)getpid(),
++                                   PROCESSOR_CLASS_ANY);
++        if (status != OK) {
++            ap_log_error(APLOG_MARK, APLOG_WARNING, errno,
++                         ap_server_conf, "processor unbind failed %d", status);
++        }
++#endif
++        RAISE_SIGSTOP(MAKE_CHILD);
++        AP_MONCONTROL(1);
++        /* Disable the parent's signal handlers and set up proper handling in
++         * the child.
++         */
++        apr_signal(SIGHUP, just_die);
++        apr_signal(SIGTERM, just_die);
++        /* The child process just closes listeners on AP_SIG_GRACEFUL.
++         * The pod is used for signalling the graceful restart.
++         */
++        apr_signal(AP_SIG_GRACEFUL, stop_listening);
++        child_main(slot);
++    }
++
++    ap_scoreboard_image->parent[slot].pid = pid;
++
++    return 0;
++}
++
++
++/* start up a bunch of children */
++static void startup_children(int number_to_start)
++{
++    int i;
++
++    for (i = 0; number_to_start && i < ap_daemons_limit; ++i) {
++        if (ap_scoreboard_image->servers[i][0].status != SERVER_DEAD) {
++            continue;
++        }
++        if (make_child(ap_server_conf, i) < 0) {
++            break;
++        }
++        --number_to_start;
++    }
++}
++
++
++/*
++ * idle_spawn_rate is the number of children that will be spawned on the
++ * next maintenance cycle if there aren't enough idle servers.  It is
++ * doubled up to MAX_SPAWN_RATE, and reset only when a cycle goes by
++ * without the need to spawn.
++ */
++static int idle_spawn_rate = 1;
++#ifndef MAX_SPAWN_RATE
++#define MAX_SPAWN_RATE  (32)
++#endif
++static int hold_off_on_exponential_spawning;
++
++static void perform_idle_server_maintenance(apr_pool_t *p)
++{
++    int i;
++    int to_kill;
++    int idle_count;
++    worker_score *ws;
++    int free_length;
++    int free_slots[MAX_SPAWN_RATE];
++    int last_non_dead;
++    int total_non_dead;
++
++    /* initialize the free_list */
++    free_length = 0;
++
++    to_kill = -1;
++    idle_count = 0;
++    last_non_dead = -1;
++    total_non_dead = 0;
++
++    for (i = 0; i < ap_daemons_limit; ++i) {
++        int status;
++
++        if (i >= ap_max_daemons_limit && free_length == idle_spawn_rate)
++            break;
++        ws = &ap_scoreboard_image->servers[i][0];
++        status = ws->status;
++        if (status == SERVER_DEAD) {
++            /* try to keep children numbers as low as possible */
++            if (free_length < idle_spawn_rate) {
++                free_slots[free_length] = i;
++                ++free_length;
++            }
++        }
++        else {
++            /* We consider a starting server as idle because we started it
++             * at least a cycle ago, and if it still hasn't finished starting
++             * then we're just going to swamp things worse by forking more.
++             * So we hopefully won't need to fork more if we count it.
++             * This depends on the ordering of SERVER_READY and SERVER_STARTING.
++             */
++            if (status <= SERVER_READY) {
++                ++ idle_count;
++                /* always kill the highest numbered child if we have to...
++                 * no really well thought out reason ... other than observing
++                 * the server behaviour under linux where lower numbered children
++                 * tend to service more hits (and hence are more likely to have
++                 * their data in cpu caches).
++                 */
++                to_kill = i;
++            }
++
++            ++total_non_dead;
++            last_non_dead = i;
++        }
++    }
++    ap_max_daemons_limit = last_non_dead + 1;
++    if (idle_count > ap_daemons_max_free) {
++        /* kill off one child... we use the pod because that'll cause it to
++         * shut down gracefully, in case it happened to pick up a request
++         * while we were counting
++         */
++        ap_mpm_pod_signal(pod);
++        idle_spawn_rate = 1;
++    }
++    else if (idle_count < ap_daemons_min_free) {
++        /* terminate the free list */
++        if (free_length == 0) {
++            /* only report this condition once */
++            static int reported = 0;
++
++            if (!reported) {
++                ap_log_error(APLOG_MARK, APLOG_ERR, 0, ap_server_conf,
++                            "server reached MaxClients setting, consider"
++                            " raising the MaxClients setting");
++                reported = 1;
++            }
++            idle_spawn_rate = 1;
++        }
++        else {
++            if (idle_spawn_rate >= 8) {
++                ap_log_error(APLOG_MARK, APLOG_INFO, 0, ap_server_conf,
++                    "server seems busy, (you may need "
++                    "to increase StartServers, or Min/MaxSpareServers), "
++                    "spawning %d children, there are %d idle, and "
++                    "%d total children", idle_spawn_rate,
++                    idle_count, total_non_dead);
++            }
++            for (i = 0; i < free_length; ++i) {
++#ifdef TPF
++                if (make_child(ap_server_conf, free_slots[i]) == -1) {
++                    if(free_length == 1) {
++                        shutdown_pending = 1;
++                        ap_log_error(APLOG_MARK, APLOG_EMERG, 0, ap_server_conf,
++                                    "No active child processes: shutting down");
++                    }
++                }
++#else
++                make_child(ap_server_conf, free_slots[i]);
++#endif /* TPF */
++            }
++            /* the next time around we want to spawn twice as many if this
++             * wasn't good enough, but not if we've just done a graceful
++             */
++            if (hold_off_on_exponential_spawning) {
++                --hold_off_on_exponential_spawning;
++            }
++            else if (idle_spawn_rate < MAX_SPAWN_RATE) {
++                idle_spawn_rate *= 2;
++            }
++        }
++    }
++    else {
++        idle_spawn_rate = 1;
++    }
++}
++
++/*****************************************************************
++ * Executive routines.
++ */
++
++int ap_mpm_run(apr_pool_t *_pconf, apr_pool_t *plog, server_rec *s)
++{
++    int index;
++    int remaining_children_to_start;
++    apr_status_t rv;
++
++    ap_log_pid(pconf, ap_pid_fname);
++
++    first_server_limit = server_limit;
++    if (changed_limit_at_restart) {
++        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
++                     "WARNING: Attempt to change ServerLimit "
++                     "ignored during restart");
++        changed_limit_at_restart = 0;
++    }
++
++    /* Initialize cross-process accept lock */
++    ap_lock_fname = apr_psprintf(_pconf, "%s.%" APR_PID_T_FMT,
++                                 ap_server_root_relative(_pconf, ap_lock_fname),
++                                 ap_my_pid);
++
++    rv = apr_proc_mutex_create(&accept_mutex, ap_lock_fname,
++                               ap_accept_lock_mech, _pconf);
++    if (rv != APR_SUCCESS) {
++        ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
++                     "Couldn't create accept lock (%s) (%d)",
++                     ap_lock_fname, ap_accept_lock_mech);
++        mpm_state = AP_MPMQ_STOPPING;
++        return 1;
++    }
++
++#if APR_USE_SYSVSEM_SERIALIZE
++    if (ap_accept_lock_mech == APR_LOCK_DEFAULT ||
++        ap_accept_lock_mech == APR_LOCK_SYSVSEM) {
++#else
++    if (ap_accept_lock_mech == APR_LOCK_SYSVSEM) {
++#endif
++        rv = unixd_set_proc_mutex_perms(accept_mutex);
++        if (rv != APR_SUCCESS) {
++            ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
++                         "Couldn't set permissions on cross-process lock; "
++                         "check User and Group directives");
++            mpm_state = AP_MPMQ_STOPPING;
++            return 1;
++        }
++    }
++
++    if (!is_graceful) {
++        if (ap_run_pre_mpm(s->process->pool, SB_SHARED) != OK) {
++            mpm_state = AP_MPMQ_STOPPING;
++            return 1;
++        }
++        /* fix the generation number in the global score; we just got a new,
++         * cleared scoreboard
++         */
++        ap_scoreboard_image->global->running_generation = ap_my_generation;
++    }
++
++    set_signals();
++
++    if (one_process) {
++        AP_MONCONTROL(1);
++        make_child(ap_server_conf, 0);
++    }
++    else {
++    if (ap_daemons_max_free < ap_daemons_min_free + 1)  /* Don't thrash... */
++        ap_daemons_max_free = ap_daemons_min_free + 1;
++
++    /* If we're doing a graceful_restart then we're going to see a lot
++     * of children exiting immediately when we get into the main loop
++     * below (because we just sent them AP_SIG_GRACEFUL).  This happens pretty
++     * rapidly... and for each one that exits we'll start a new one until
++     * we reach at least daemons_min_free.  But we may be permitted to
++     * start more than that, so we'll just keep track of how many we're
++     * supposed to start up without the 1 second penalty between each fork.
++     */
++    remaining_children_to_start = ap_daemons_to_start;
++    if (remaining_children_to_start > ap_daemons_limit) {
++        remaining_children_to_start = ap_daemons_limit;
++    }
++    if (!is_graceful) {
++        startup_children(remaining_children_to_start);
++        remaining_children_to_start = 0;
++    }
++    else {
++        /* give the system some time to recover before kicking into
++         * exponential mode
++         */
++        hold_off_on_exponential_spawning = 10;
++    }
++
++    ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf,
++                "%s configured -- resuming normal operations",
++                ap_get_server_description());
++    ap_log_error(APLOG_MARK, APLOG_INFO, 0, ap_server_conf,
++                "Server built: %s", ap_get_server_built());
++#ifdef AP_MPM_WANT_SET_ACCEPT_LOCK_MECH
++    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, ap_server_conf,
++                "AcceptMutex: %s (default: %s)",
++                apr_proc_mutex_name(accept_mutex),
++                apr_proc_mutex_defname());
++#endif
++    restart_pending = shutdown_pending = 0;
++
++    mpm_state = AP_MPMQ_RUNNING;
++
++    while (!restart_pending && !shutdown_pending) {
++        int child_slot;
++        apr_exit_why_e exitwhy;
++        int status, processed_status;
++        /* this is a memory leak, but I'll fix it later. */
++        apr_proc_t pid;
++
++        ap_wait_or_timeout(&exitwhy, &status, &pid, pconf);
++
++        /* XXX: if it takes longer than 1 second for all our children
++         * to start up and get into IDLE state then we may spawn an
++         * extra child
++         */
++        if (pid.pid != -1) {
++            processed_status = ap_process_child_status(&pid, exitwhy, status);
++            if (processed_status == APEXIT_CHILDFATAL) {
++                mpm_state = AP_MPMQ_STOPPING;
++                return 1;
++            }
++
++            /* non-fatal death... note that it's gone in the scoreboard. */
++            child_slot = find_child_by_pid(&pid);
++            if (child_slot >= 0) {
++                (void) ap_update_child_status_from_indexes(child_slot, 0, SERVER_DEAD,
++                                                           (request_rec *) NULL);
++                if (processed_status == APEXIT_CHILDSICK) {
++                    /* child detected a resource shortage (E[NM]FILE, ENOBUFS, etc)
++                     * cut the fork rate to the minimum
++                     */
++                    idle_spawn_rate = 1;
++                }
++                else if (remaining_children_to_start
++                    && child_slot < ap_daemons_limit) {
++                    /* we're still doing a 1-for-1 replacement of dead
++                     * children with new children
++                     */
++                    make_child(ap_server_conf, child_slot);
++                    --remaining_children_to_start;
++                }
++#if APR_HAS_OTHER_CHILD
++            }
++            else if (apr_proc_other_child_alert(&pid, APR_OC_REASON_DEATH, status) == APR_SUCCESS) {
++                /* handled */
++#endif
++            }
++            else if (is_graceful) {
++                /* Great, we've probably just lost a slot in the
++                 * scoreboard.  Somehow we don't know about this
++                 * child.
++                 */
++                ap_log_error(APLOG_MARK, APLOG_WARNING,
++                            0, ap_server_conf,
++                            "long lost child came home! (pid %ld)", (long)pid.pid);
++            }
++            /* Don't perform idle maintenance when a child dies,
++             * only do it when there's a timeout.  Remember only a
++             * finite number of children can die, and it's pretty
++             * pathological for a lot to die suddenly.
++             */
++            continue;
++        }
++        else if (remaining_children_to_start) {
++            /* we hit a 1 second timeout in which none of the previous
++             * generation of children needed to be reaped... so assume
++             * they're all done, and pick up the slack if any is left.
++             */
++            startup_children(remaining_children_to_start);
++            remaining_children_to_start = 0;
++            /* In any event we really shouldn't do the code below because
++             * few of the servers we just started are in the IDLE state
++             * yet, so we'd mistakenly create an extra server.
++             */
++            continue;
++        }
++
++        perform_idle_server_maintenance(pconf);
++#ifdef TPF
++        shutdown_pending = os_check_server(tpf_server_name);
++        ap_check_signals();
++        sleep(1);
++#endif /*TPF */
++    }
++    } /* one_process */
++
++    mpm_state = AP_MPMQ_STOPPING;
++
++    if (shutdown_pending && !is_graceful) {
++        /* Time to shut down:
++         * Kill child processes, tell them to call child_exit, etc...
++         */
++        if (unixd_killpg(getpgrp(), SIGTERM) < 0) {
++            ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "killpg SIGTERM");
++        }
++        ap_reclaim_child_processes(1);          /* Start with SIGTERM */
++
++        /* cleanup pid file on normal shutdown */
++        {
++            const char *pidfile = NULL;
++            pidfile = ap_server_root_relative (pconf, ap_pid_fname);
++            if ( pidfile != NULL && unlink(pidfile) == 0)
++                ap_log_error(APLOG_MARK, APLOG_INFO,
++                                0, ap_server_conf,
++                                "removed PID file %s (pid=%ld)",
++                                pidfile, (long)getpid());
++        }
++
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf,
++                    "caught SIGTERM, shutting down");
++
++        return 1;
++    } else if (shutdown_pending) {
++        /* Time to perform a graceful shut down:
++         * Reap the inactive children, and ask the active ones
++         * to close their listeners, then wait until they are
++         * all done to exit.
++         */
++        int active_children;
++        apr_time_t cutoff = 0;
++
++        /* Stop listening */
++        ap_close_listeners();
++
++        /* kill off the idle ones */
++        ap_mpm_pod_killpg(pod, ap_max_daemons_limit);
++
++        /* Send SIGUSR1 to the active children */
++        active_children = 0;
++        for (index = 0; index < ap_daemons_limit; ++index) {
++            if (ap_scoreboard_image->servers[index][0].status != SERVER_DEAD) {
++                /* Ask each child to close its listeners. */
++                ap_mpm_safe_kill(MPM_CHILD_PID(index), AP_SIG_GRACEFUL);
++                active_children++;
++            }
++        }
++
++        /* Allow each child which actually finished to exit */
++        ap_relieve_child_processes();
++
++        /* cleanup pid file */
++        {
++            const char *pidfile = NULL;
++            pidfile = ap_server_root_relative (pconf, ap_pid_fname);
++            if ( pidfile != NULL && unlink(pidfile) == 0)
++                ap_log_error(APLOG_MARK, APLOG_INFO,
++                                0, ap_server_conf,
++                                "removed PID file %s (pid=%ld)",
++                                pidfile, (long)getpid());
++        }
++
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf,
++           "caught " AP_SIG_GRACEFUL_STOP_STRING ", shutting down gracefully");
++
++        if (ap_graceful_shutdown_timeout) {
++            cutoff = apr_time_now() +
++                     apr_time_from_sec(ap_graceful_shutdown_timeout);
++        }
++
++        /* Don't really exit until each child has finished */
++        shutdown_pending = 0;
++        do {
++            /* Pause for a second */
++            sleep(1);
++
++            /* Relieve any children which have now exited */
++            ap_relieve_child_processes();
++
++            active_children = 0;
++            for (index = 0; index < ap_daemons_limit; ++index) {
++                if (ap_mpm_safe_kill(MPM_CHILD_PID(index), 0) == APR_SUCCESS) {
++                    active_children = 1;
++                    /* Having just one child is enough to stay around */
++                    break;
++                }
++            }
++        } while (!shutdown_pending && active_children &&
++                 (!ap_graceful_shutdown_timeout || apr_time_now() < cutoff));
++
++        /* We might be here because we received SIGTERM, either
++         * way, try and make sure that all of our processes are
++         * really dead.
++         */
++        unixd_killpg(getpgrp(), SIGTERM);
++
++        return 1;
++    }
++
++    /* we've been told to restart */
++    apr_signal(SIGHUP, SIG_IGN);
++    apr_signal(AP_SIG_GRACEFUL, SIG_IGN);
++    if (one_process) {
++        /* not worth thinking about */
++        return 1;
++    }
++
++    /* advance to the next generation */
++    /* XXX: we really need to make sure this new generation number isn't in
++     * use by any of the children.
++     */
++    ++ap_my_generation;
++    ap_scoreboard_image->global->running_generation = ap_my_generation;
++
++    if (is_graceful) {
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf,
++                    "Graceful restart requested, doing restart");
++
++        /* kill off the idle ones */
++        ap_mpm_pod_killpg(pod, ap_max_daemons_limit);
++
++        /* This is mostly for debugging... so that we know what is still
++         * gracefully dealing with existing request.  This will break
++         * in a very nasty way if we ever have the scoreboard totally
++         * file-based (no shared memory)
++         */
++        for (index = 0; index < ap_daemons_limit; ++index) {
++            if (ap_scoreboard_image->servers[index][0].status != SERVER_DEAD) {
++                ap_scoreboard_image->servers[index][0].status = SERVER_GRACEFUL;
++                /* Ask each child to close its listeners.
++                 *
++                 * NOTE: we use the scoreboard, because if we send SIGUSR1
++                 * to every process in the group, this may include CGI's,
++                 * piped loggers, etc. They almost certainly won't handle
++                 * it gracefully.
++                 */
++                ap_mpm_safe_kill(ap_scoreboard_image->parent[index].pid, AP_SIG_GRACEFUL);
++            }
++        }
++    }
++    else {
++        /* Kill 'em off */
++        if (unixd_killpg(getpgrp(), SIGHUP) < 0) {
++            ap_log_error(APLOG_MARK, APLOG_WARNING, errno, ap_server_conf, "killpg SIGHUP");
++        }
++        ap_reclaim_child_processes(0);          /* Not when just starting up */
++        ap_log_error(APLOG_MARK, APLOG_NOTICE, 0, ap_server_conf,
++                    "SIGHUP received.  Attempting to restart");
++    }
++
++    return 0;
++}
++
++/* This really should be a post_config hook, but the error log is already
++ * redirected by that point, so we need to do this in the open_logs phase.
++ */
++static int prefork_open_logs(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
++{
++    apr_status_t rv;
++
++    pconf = p;
++    ap_server_conf = s;
++
++    if ((num_listensocks = ap_setup_listeners(ap_server_conf)) < 1) {
++        ap_log_error(APLOG_MARK, APLOG_ALERT|APLOG_STARTUP, 0,
++                     NULL, "no listening sockets available, shutting down");
++        return DONE;
++    }
++
++    if ((rv = ap_mpm_pod_open(pconf, &pod))) {
++        ap_log_error(APLOG_MARK, APLOG_CRIT|APLOG_STARTUP, rv, NULL,
++                "Could not open pipe-of-death.");
++        return DONE;
++    }
++    return OK;
++}
++
++static int prefork_pre_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp)
++{
++    static int restart_num = 0;
++    int no_detach, debug, foreground;
++    apr_status_t rv;
++
++    mpm_state = AP_MPMQ_STARTING;
++
++    debug = ap_exists_config_define("DEBUG");
++
++    if (debug) {
++        foreground = one_process = 1;
++        no_detach = 0;
++    }
++    else
++    {
++        no_detach = ap_exists_config_define("NO_DETACH");
++        one_process = ap_exists_config_define("ONE_PROCESS");
++        foreground = ap_exists_config_define("FOREGROUND");
++    }
++
++    /* sigh, want this only the second time around */
++    if (restart_num++ == 1) {
++        is_graceful = 0;
++
++        if (!one_process && !foreground) {
++            rv = apr_proc_detach(no_detach ? APR_PROC_DETACH_FOREGROUND
++                                           : APR_PROC_DETACH_DAEMONIZE);
++            if (rv != APR_SUCCESS) {
++                ap_log_error(APLOG_MARK, APLOG_CRIT, rv, NULL,
++                             "apr_proc_detach failed");
++                return HTTP_INTERNAL_SERVER_ERROR;
++            }
++        }
++
++        parent_pid = ap_my_pid = getpid();
++    }
++
++    unixd_pre_config(ptemp);
++    ap_listen_pre_config();
++    ap_daemons_to_start = DEFAULT_START_DAEMON;
++    ap_daemons_min_free = DEFAULT_MIN_FREE_DAEMON;
++    ap_daemons_max_free = DEFAULT_MAX_FREE_DAEMON;
++    ap_daemons_limit = server_limit;
++    ap_pid_fname = DEFAULT_PIDLOG;
++    ap_lock_fname = DEFAULT_LOCKFILE;
++    ap_max_requests_per_child = DEFAULT_MAX_REQUESTS_PER_CHILD;
++    ap_extended_status = 0;
++#ifdef AP_MPM_WANT_SET_MAX_MEM_FREE
++    ap_max_mem_free = APR_ALLOCATOR_MAX_FREE_UNLIMITED;
++#endif
++
++    apr_cpystrn(ap_coredump_dir, ap_server_root, sizeof(ap_coredump_dir));
++
++    return OK;
++}
++
++static void prefork_hooks(apr_pool_t *p)
++{
++    /* The prefork open_logs phase must run before the core's, or stderr
++     * will be redirected to a file, and the messages won't print to the
++     * console.
++     */
++    static const char *const aszSucc[] = {"core.c", NULL};
++
++#ifdef AUX3
++    (void) set42sig();
++#endif
++
++    ap_hook_open_logs(prefork_open_logs, NULL, aszSucc, APR_HOOK_MIDDLE);
++    /* we need to set the MPM state before other pre-config hooks use MPM query
++     * to retrieve it, so register as REALLY_FIRST
++     */
++    ap_hook_pre_config(prefork_pre_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
++}
++
++static const char *set_daemons_to_start(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    ap_daemons_to_start = atoi(arg);
++    return NULL;
++}
++
++static const char *set_min_free_servers(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    ap_daemons_min_free = atoi(arg);
++    if (ap_daemons_min_free <= 0) {
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    "WARNING: detected MinSpareServers set to non-positive.");
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    "Resetting to 1 to avoid almost certain Apache failure.");
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    "Please read the documentation.");
++       ap_daemons_min_free = 1;
++    }
++
++    return NULL;
++}
++
++static const char *set_max_free_servers(cmd_parms *cmd, void *dummy, const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    ap_daemons_max_free = atoi(arg);
++    return NULL;
++}
++
++static const char *set_max_clients (cmd_parms *cmd, void *dummy, const char *arg)
++{
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    ap_daemons_limit = atoi(arg);
++    if (ap_daemons_limit > server_limit) {
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    "WARNING: MaxClients of %d exceeds ServerLimit value "
++                    "of %d servers,", ap_daemons_limit, server_limit);
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    " lowering MaxClients to %d.  To increase, please "
++                    "see the ServerLimit", server_limit);
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    " directive.");
++       ap_daemons_limit = server_limit;
++    }
++    else if (ap_daemons_limit < 1) {
++        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                     "WARNING: Require MaxClients > 0, setting to 1");
++        ap_daemons_limit = 1;
++    }
++    return NULL;
++}
++
++static const char *set_server_limit (cmd_parms *cmd, void *dummy, const char *arg)
++{
++    int tmp_server_limit;
++
++    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
++    if (err != NULL) {
++        return err;
++    }
++
++    tmp_server_limit = atoi(arg);
++    /* you cannot change ServerLimit across a restart; ignore
++     * any such attempts
++     */
++    if (first_server_limit &&
++        tmp_server_limit != server_limit) {
++        /* how do we log a message?  the error log is a bit bucket at this
++         * point; we'll just have to set a flag so that ap_mpm_run()
++         * logs a warning later
++         */
++        changed_limit_at_restart = 1;
++        return NULL;
++    }
++    server_limit = tmp_server_limit;
++
++    if (server_limit > MAX_SERVER_LIMIT) {
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    "WARNING: ServerLimit of %d exceeds compile time limit "
++                    "of %d servers,", server_limit, MAX_SERVER_LIMIT);
++       ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                    " lowering ServerLimit to %d.", MAX_SERVER_LIMIT);
++       server_limit = MAX_SERVER_LIMIT;
++    }
++    else if (server_limit < 1) {
++        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                     "WARNING: Require ServerLimit > 0, setting to 1");
++        server_limit = 1;
++    }
++    return NULL;
++}
++
++static const command_rec prefork_cmds[] = {
++UNIX_DAEMON_COMMANDS,
++LISTEN_COMMANDS,
++AP_INIT_TAKE1("StartServers", set_daemons_to_start, NULL, RSRC_CONF,
++              "Number of child processes launched at server startup"),
++AP_INIT_TAKE1("MinSpareServers", set_min_free_servers, NULL, RSRC_CONF,
++              "Minimum number of idle children, to handle request spikes"),
++AP_INIT_TAKE1("MaxSpareServers", set_max_free_servers, NULL, RSRC_CONF,
++              "Maximum number of idle children"),
++AP_INIT_TAKE1("MaxClients", set_max_clients, NULL, RSRC_CONF,
++              "Maximum number of children alive at the same time"),
++AP_INIT_TAKE1("ServerLimit", set_server_limit, NULL, RSRC_CONF,
++              "Maximum value of MaxClients for this run of Apache"),
++AP_GRACEFUL_SHUTDOWN_TIMEOUT_COMMAND,
++{ NULL }
++};
++
++module AP_MODULE_DECLARE_DATA mpm_prefork_module = {
++    MPM20_MODULE_STUFF,
++    ap_mpm_rewrite_args,        /* hook to run before apache parses args */
++    NULL,                       /* create per-directory config structure */
++    NULL,                       /* merge per-directory config structures */
++    NULL,                       /* create per-server config structure */
++    NULL,                       /* merge per-server config structures */
++    prefork_cmds,               /* command apr_table_t */
++    prefork_hooks,              /* register hooks */
++};
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm.h	2009-03-17 21:38:54.000000000 +0100
+@@ -0,0 +1,62 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++/**
++ * @file prefork/mpm.h
++ * @brief Unix Prefork MPM (default for Uinx systems)
++ *
++ * @defgroup APACHE_MPM_PREFORK Unix Prefork
++ * @ingroup  APACHE_MPM APACHE_OS_UNIX
++ * @{
++ */
++
++#include "httpd.h"
++#include "mpm_default.h"
++#include "scoreboard.h"
++#include "unixd.h"
++
++#ifndef APACHE_MPM_PREFORK_H
++#define APACHE_MPM_PREFORK_H
++
++#define PREFORK_MPM
++
++#define MPM_NAME "Prefork"
++
++#define AP_MPM_WANT_RECLAIM_CHILD_PROCESSES
++#define AP_MPM_WANT_WAIT_OR_TIMEOUT
++#define AP_MPM_WANT_PROCESS_CHILD_STATUS
++#define AP_MPM_WANT_SET_PIDFILE
++#define AP_MPM_WANT_SET_SCOREBOARD
++#define AP_MPM_WANT_SET_LOCKFILE
++#define AP_MPM_WANT_SET_MAX_REQUESTS
++#define AP_MPM_WANT_SET_COREDUMPDIR
++#define AP_MPM_WANT_SET_ACCEPT_LOCK_MECH
++#define AP_MPM_WANT_SIGNAL_SERVER
++#define AP_MPM_WANT_SET_MAX_MEM_FREE
++#define AP_MPM_WANT_FATAL_SIGNAL_HANDLER
++#define AP_MPM_WANT_SET_GRACEFUL_SHUTDOWN
++#define AP_MPM_DISABLE_NAGLE_ACCEPTED_SOCK
++
++#define AP_MPM_USES_POD 1
++#define MPM_CHILD_PID(i) (ap_scoreboard_image->parent[i].pid)
++#define MPM_NOTE_CHILD_KILLED(i) (MPM_CHILD_PID(i) = 0)
++#define MPM_ACCEPT_FUNC unixd_accept
++
++extern int ap_threads_per_child;
++extern int ap_max_daemons_limit;
++extern server_rec *ap_server_conf;
++#endif /* APACHE_MPM_PREFORK_H */
++/** @} */
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h
+===================================================================
+--- /dev/null	1970-01-01 00:00:00.000000000 +0000
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h	2009-03-17 21:38:54.000000000 +0100
+@@ -0,0 +1,74 @@
++/* Licensed to the Apache Software Foundation (ASF) under one or more
++ * contributor license agreements.  See the NOTICE file distributed with
++ * this work for additional information regarding copyright ownership.
++ * The ASF licenses this file to You under the Apache License, Version 2.0
++ * (the "License"); you may not use this file except in compliance with
++ * the License.  You may obtain a copy of the License at
++ *
++ *     http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++/**
++ * @file  prefork/mpm_default.h
++ * @brief Prefork MPM defaults
++ *
++ * @addtogroup APACHE_MPM_PREFORK
++ * @{
++ */
++
++#ifndef APACHE_MPM_DEFAULT_H
++#define APACHE_MPM_DEFAULT_H
++
++/* Number of servers to spawn off by default --- also, if fewer than
++ * this free when the caretaker checks, it will spawn more.
++ */
++#ifndef DEFAULT_START_DAEMON
++#define DEFAULT_START_DAEMON 5
++#endif
++
++/* Maximum number of *free* server processes --- more than this, and
++ * they will die off.
++ */
++
++#ifndef DEFAULT_MAX_FREE_DAEMON
++#define DEFAULT_MAX_FREE_DAEMON 10
++#endif
++
++/* Minimum --- fewer than this, and more will be created */
++
++#ifndef DEFAULT_MIN_FREE_DAEMON
++#define DEFAULT_MIN_FREE_DAEMON 5
++#endif
++
++/* File used for accept locking, when we use a file */
++#ifndef DEFAULT_LOCKFILE
++#define DEFAULT_LOCKFILE DEFAULT_REL_RUNTIMEDIR "/accept.lock"
++#endif
++
++/* Where the main/parent process's pid is logged */
++#ifndef DEFAULT_PIDLOG
++#define DEFAULT_PIDLOG DEFAULT_REL_RUNTIMEDIR "/httpd.pid"
++#endif
++
++/*
++ * Interval, in microseconds, between scoreboard maintenance.
++ */
++#ifndef SCOREBOARD_MAINTENANCE_INTERVAL
++#define SCOREBOARD_MAINTENANCE_INTERVAL 1000000
++#endif
++
++/* Number of requests to try to handle in a single process.  If <= 0,
++ * the children don't die off.
++ */
++#ifndef DEFAULT_MAX_REQUESTS_PER_CHILD
++#define DEFAULT_MAX_REQUESTS_PER_CHILD 10000
++#endif
++
++#endif /* AP_MPM_DEFAULT_H */
++/** @} */
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/series
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/series
@@ -0,0 +1,10 @@
+01-copy-prefork.patch
+02-rename-prefork-to-itk.patch
+03-add-mpm-to-build-system.patch
+04-correct-output-makefile-location.patch
+05-add-copyright.patch
+06-hook-just-after-merging-perdir-config.patch
+07-base-functionality.patch
+08-max-clients-per-vhost.patch
+09-capabilities.patch
+10-nice.patch
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/09-capabilities.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/09-capabilities.patch
@@ -0,0 +1,75 @@
+Use Linux' capability system to run as a sort of "lesser root"; we drop nearly
+all root privilegies except the ability to setuid. An attacker capable of injecting
+code will still be able to run as any (normal) user on the system, but at least
+he/she cannot directly load kernel code etc.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-04-14 23:28:02.000000000 +0200
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-04-14 23:29:16.000000000 +0200
+@@ -71,6 +71,10 @@
+ #include <sys/processor.h> /* for bindprocessor() */
+ #endif
+ 
++#if HAVE_LIBCAP
++#include <sys/capability.h>
++#endif
++
+ #include <signal.h>
+ #include <sys/times.h>
+ 
+@@ -501,6 +505,15 @@
+     apr_bucket_alloc_t *bucket_alloc;
+     int last_poll_idx = 0;
+ 
++#if HAVE_LIBCAP
++    cap_t caps;
++    cap_value_t suidcaps[] = {
++        CAP_SETUID,
++        CAP_SETGID,
++	CAP_DAC_READ_SEARCH,
++    };
++#endif    
++
+     mpm_state = AP_MPMQ_STARTING; /* for benefit of any hooks that run as this
+                                    * child initializes
+                                    */
+@@ -554,6 +567,22 @@
+         (void) apr_pollset_add(pollset, &pfd);
+     }
+ 
++#if HAVE_LIBCAP
++    /* Drop as many privileges as we can. We'll still
++     * access files with uid=0, and we can setuid() to anything, but
++     * at least there's tons of other evilness (like loading kernel
++     * modules) we can't do directly.  (The setuid() capability will
++     * go away automatically when we setuid() or exec() -- the former
++     * is likely to come first.)
++     */
++    caps = cap_init();
++    cap_clear(caps);
++    cap_set_flag(caps, CAP_PERMITTED, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET);
++    cap_set_flag(caps, CAP_EFFECTIVE, sizeof(suidcaps)/sizeof(cap_value_t), suidcaps, CAP_SET);
++    cap_set_proc(caps);
++    cap_free(caps);
++#endif    
++
+     mpm_state = AP_MPMQ_RUNNING;
+ 
+     bucket_alloc = apr_bucket_alloc_create(pchild);
+Index: httpd-2.2.11/server/mpm/config.m4
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/config.m4	2009-04-14 23:26:41.000000000 +0200
++++ httpd-2.2.11/server/mpm/config.m4	2009-04-14 23:28:03.000000000 +0200
+@@ -66,6 +66,11 @@
+ else
+   MPM_SUBDIR_NAME=$MPM_NAME
+ fi
++
++if test "$apache_cv_mpm" = "itk" ; then
++  AC_CHECK_LIB(cap, cap_init)
++fi
++
+ MPM_DIR=server/mpm/$MPM_SUBDIR_NAME
+ MPM_LIB=$MPM_DIR/lib${MPM_NAME}.la
+ 
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/06-hook-just-after-merging-perdir-config.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/06-hook-just-after-merging-perdir-config.patch
@@ -0,0 +1,60 @@
+Add an extra hook right after merging per-directory configuration.
+This makes sure we are able to setuid() as early as possible (that
+is, as soon as know what uid/gid to use for this location), so we
+won't run all sorts of subrequests and other stuff as root.
+
+Index: httpd-2.2.11/include/http_request.h
+===================================================================
+--- httpd-2.2.11.orig/include/http_request.h	2009-03-21 13:03:31.000000000 +0100
++++ httpd-2.2.11/include/http_request.h	2009-03-21 13:03:41.000000000 +0100
+@@ -356,6 +356,15 @@
+  */
+ AP_DECLARE_HOOK(void,insert_filter,(request_rec *r))
+ 
++/**
++ * This hook allows modules to affect the request immediately after the
++ * per-directory configuration for the request has been generated. This allows
++ * modules to make decisions based upon the current directory configuration
++ * @param r The current request
++ * @return OK or DECLINED
++ */
++AP_DECLARE_HOOK(int,post_perdir_config,(request_rec *r))
++ 
+ AP_DECLARE(int) ap_location_walk(request_rec *r);
+ AP_DECLARE(int) ap_directory_walk(request_rec *r);
+ AP_DECLARE(int) ap_file_walk(request_rec *r);
+Index: httpd-2.2.11/server/request.c
+===================================================================
+--- httpd-2.2.11.orig/server/request.c	2009-03-21 13:03:13.000000000 +0100
++++ httpd-2.2.11/server/request.c	2009-03-21 13:03:41.000000000 +0100
+@@ -67,6 +67,7 @@
+     APR_HOOK_LINK(auth_checker)
+     APR_HOOK_LINK(insert_filter)
+     APR_HOOK_LINK(create_request)
++    APR_HOOK_LINK(post_perdir_config)
+ )
+ 
+ AP_IMPLEMENT_HOOK_RUN_FIRST(int,translate_name,
+@@ -86,6 +87,8 @@
+ AP_IMPLEMENT_HOOK_VOID(insert_filter, (request_rec *r), (r))
+ AP_IMPLEMENT_HOOK_RUN_ALL(int, create_request,
+                           (request_rec *r), (r), OK, DECLINED)
++AP_IMPLEMENT_HOOK_RUN_ALL(int,post_perdir_config,
++                          (request_rec *r), (r), OK, DECLINED)
+ 
+ 
+ static int decl_die(int status, char *phase, request_rec *r)
+@@ -164,6 +167,13 @@
+         return access_status;
+     }
+ 
++    /* First chance to handle the request after per-directory configuration is
++     * generated 
++     */
++    if ((access_status = ap_run_post_perdir_config(r))) {
++        return access_status;
++    }
++
+     /* Only on the main request! */
+     if (r->main == NULL) {
+         if ((access_status = ap_run_header_parser(r))) {
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/02-rename-prefork-to-itk.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/02-rename-prefork-to-itk.patch
@@ -0,0 +1,157 @@
+Rename prefork to itk in the copy that was created in 01-copy-prefork.patch.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/Makefile.in
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/Makefile.in	2009-03-17 21:38:54.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/Makefile.in	2009-03-17 21:39:03.000000000 +0100
+@@ -1,5 +1,5 @@
+ 
+-LTLIBRARY_NAME    = libprefork.la
+-LTLIBRARY_SOURCES = prefork.c
++LTLIBRARY_NAME    = libitk.la
++LTLIBRARY_SOURCES = itk.c
+ 
+ include $(top_srcdir)/build/ltlib.mk
+Index: httpd-2.2.11/server/mpm/experimental/itk/config.m4
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/config.m4	2009-03-17 21:38:53.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/config.m4	2009-03-17 21:39:03.000000000 +0100
+@@ -1,3 +1,3 @@
+-if test "$MPM_NAME" = "prefork" ; then
++if test "$MPM_NAME" = "itk" ; then
+     APACHE_FAST_OUTPUT(server/mpm/$MPM_NAME/Makefile)
+ fi
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-03-17 21:38:54.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-03-17 21:39:03.000000000 +0100
+@@ -1250,7 +1250,7 @@
+ /* This really should be a post_config hook, but the error log is already
+  * redirected by that point, so we need to do this in the open_logs phase.
+  */
+-static int prefork_open_logs(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
++static int itk_open_logs(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp, server_rec *s)
+ {
+     apr_status_t rv;
+ 
+@@ -1271,7 +1271,7 @@
+     return OK;
+ }
+ 
+-static int prefork_pre_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp)
++static int itk_pre_config(apr_pool_t *p, apr_pool_t *plog, apr_pool_t *ptemp)
+ {
+     static int restart_num = 0;
+     int no_detach, debug, foreground;
+@@ -1328,9 +1328,9 @@
+     return OK;
+ }
+ 
+-static void prefork_hooks(apr_pool_t *p)
++static void itk_hooks(apr_pool_t *p)
+ {
+-    /* The prefork open_logs phase must run before the core's, or stderr
++    /* The itk open_logs phase must run before the core's, or stderr
+      * will be redirected to a file, and the messages won't print to the
+      * console.
+      */
+@@ -1340,11 +1340,11 @@
+     (void) set42sig();
+ #endif
+ 
+-    ap_hook_open_logs(prefork_open_logs, NULL, aszSucc, APR_HOOK_MIDDLE);
++    ap_hook_open_logs(itk_open_logs, NULL, aszSucc, APR_HOOK_MIDDLE);
+     /* we need to set the MPM state before other pre-config hooks use MPM query
+      * to retrieve it, so register as REALLY_FIRST
+      */
+-    ap_hook_pre_config(prefork_pre_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
++    ap_hook_pre_config(itk_pre_config, NULL, NULL, APR_HOOK_REALLY_FIRST);
+ }
+ 
+ static const char *set_daemons_to_start(cmd_parms *cmd, void *dummy, const char *arg)
+@@ -1457,7 +1457,7 @@
+     return NULL;
+ }
+ 
+-static const command_rec prefork_cmds[] = {
++static const command_rec itk_cmds[] = {
+ UNIX_DAEMON_COMMANDS,
+ LISTEN_COMMANDS,
+ AP_INIT_TAKE1("StartServers", set_daemons_to_start, NULL, RSRC_CONF,
+@@ -1474,13 +1474,13 @@
+ { NULL }
+ };
+ 
+-module AP_MODULE_DECLARE_DATA mpm_prefork_module = {
++module AP_MODULE_DECLARE_DATA mpm_itk_module = {
+     MPM20_MODULE_STUFF,
+     ap_mpm_rewrite_args,        /* hook to run before apache parses args */
+     NULL,                       /* create per-directory config structure */
+     NULL,                       /* merge per-directory config structures */
+     NULL,                       /* create per-server config structure */
+     NULL,                       /* merge per-server config structures */
+-    prefork_cmds,               /* command apr_table_t */
+-    prefork_hooks,              /* register hooks */
++    itk_cmds,                   /* command apr_table_t */
++    itk_hooks,                  /* register hooks */
+ };
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm.h
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/mpm.h	2009-03-17 21:38:54.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm.h	2009-03-17 21:39:03.000000000 +0100
+@@ -15,10 +15,10 @@
+  */
+ 
+ /**
+- * @file prefork/mpm.h
+- * @brief Unix Prefork MPM (default for Uinx systems)
++ * @file itk/mpm.h
++ * @brief ITK MPM (setuid per-vhost, no threads)
+  *
+- * @defgroup APACHE_MPM_PREFORK Unix Prefork
++ * @defgroup APACHE_MPM_ITK Apache ITK
+  * @ingroup  APACHE_MPM APACHE_OS_UNIX
+  * @{
+  */
+@@ -28,12 +28,12 @@
+ #include "scoreboard.h"
+ #include "unixd.h"
+ 
+-#ifndef APACHE_MPM_PREFORK_H
+-#define APACHE_MPM_PREFORK_H
++#ifndef APACHE_MPM_ITK_H
++#define APACHE_MPM_ITK_H
+ 
+-#define PREFORK_MPM
++#define ITK_MPM
+ 
+-#define MPM_NAME "Prefork"
++#define MPM_NAME "ITK"
+ 
+ #define AP_MPM_WANT_RECLAIM_CHILD_PROCESSES
+ #define AP_MPM_WANT_WAIT_OR_TIMEOUT
+@@ -58,5 +58,5 @@
+ extern int ap_threads_per_child;
+ extern int ap_max_daemons_limit;
+ extern server_rec *ap_server_conf;
+-#endif /* APACHE_MPM_PREFORK_H */
++#endif /* APACHE_MPM_ITK_H */
+ /** @} */
+Index: httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/mpm_default.h	2009-03-17 21:38:54.000000000 +0100
++++ httpd-2.2.11/server/mpm/experimental/itk/mpm_default.h	2009-03-17 21:39:03.000000000 +0100
+@@ -15,10 +15,10 @@
+  */
+ 
+ /**
+- * @file  prefork/mpm_default.h
+- * @brief Prefork MPM defaults
++ * @file  itk/mpm_default.h
++ * @brief ITK MPM defaults
+  *
+- * @addtogroup APACHE_MPM_PREFORK
++ * @addtogroup APACHE_MPM_ITK
+  * @{
+  */
+ 
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/10-nice.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/10-nice.patch
@@ -0,0 +1,140 @@
+Support a per-location nice value. Note that since we now have two different settings
+in the per-dir configuration, we need to introduce a merge function.
+
+Index: httpd-2.2.11/server/mpm/experimental/itk/itk.c
+===================================================================
+--- httpd-2.2.11.orig/server/mpm/experimental/itk/itk.c	2009-04-14 23:29:16.000000000 +0200
++++ httpd-2.2.11/server/mpm/experimental/itk/itk.c	2009-04-14 23:31:05.000000000 +0200
+@@ -156,11 +156,14 @@
+ 
+ static volatile int die_now = 0;
+ 
++#define UNSET_NICE_VALUE 100
++
+ typedef struct
+ {
+     uid_t uid;
+     gid_t gid;
+     char *username;
++    int nice_value;
+ } itk_per_dir_conf;
+ 
+ typedef struct
+@@ -511,6 +514,7 @@
+         CAP_SETUID,
+         CAP_SETGID,
+ 	CAP_DAC_READ_SEARCH,
++        CAP_SYS_NICE,
+     };
+ #endif    
+ 
+@@ -1444,6 +1448,12 @@
+     strncpy(ap_scoreboard_image->servers[my_child_num][0].vhost, r->server->server_hostname, 31);
+     ap_scoreboard_image->servers[my_child_num][0].vhost[31] = 0;
+ 
++    if (dconf->nice_value != UNSET_NICE_VALUE &&
++        setpriority(PRIO_PROCESS, 0, dconf->nice_value)) {
++        _DBG("setpriority(): %s", strerror(errno));
++        err = 1;
++    }
++
+     wanted_uid = dconf->uid;
+     wanted_gid = dconf->gid;
+     wanted_username = dconf->username;
+@@ -1454,7 +1464,7 @@
+         wanted_username = unixd_config.user_name;
+     }
+ 
+-    if (wanted_uid != -1 && wanted_gid != -1 && (getuid() != wanted_uid || getgid() != wanted_gid)) {
++    if (!err && wanted_uid != -1 && wanted_gid != -1 && (getuid() != wanted_uid || getgid() != wanted_gid)) {
+         if (setgid(wanted_gid)) {
+             _DBG("setgid(%d): %s", wanted_gid, strerror(errno));
+             err = 1;
+@@ -1474,7 +1484,7 @@
+      */
+     if (err) {
+         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, NULL, \
+-            "Couldn't set uid/gid, closing connection.");
++            "Couldn't set uid/gid/priority, closing connection.");
+         ap_lingering_close(r->connection);
+         exit(0);
+     }
+@@ -1630,6 +1640,27 @@
+     return NULL;
+ }
+ 
++static const char *set_nice_value (cmd_parms *cmd, void *ptr, const char *arg)
++{
++    itk_per_dir_conf *dconf = (itk_per_dir_conf *) ptr;
++    int nice_value = atoi(arg);
++
++    if (nice_value < -20) {
++        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                     "WARNING: NiceValue of %d is below -20, increasing NiceValue to -20.",
++                     nice_value);
++        nice_value = -20;
++    }
++    else if (nice_value > 19) {
++        ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, NULL,
++                     "WARNING: NiceValue of %d is above 19, lowering NiceValue to 19.",
++                     nice_value);
++        nice_value = 19;
++    }
++    dconf->nice_value = nice_value;
++    return NULL;
++}
++
+ static const command_rec itk_cmds[] = {
+ UNIX_DAEMON_COMMANDS,
+ LISTEN_COMMANDS,
+@@ -1647,6 +1678,8 @@
+               "Tie a virtual host to a specific child process."),
+ AP_INIT_TAKE1("MaxClientsVHost", set_max_clients_vhost, NULL, RSRC_CONF,
+               "Maximum number of children alive at the same time for this virtual host."),
++AP_INIT_TAKE1("NiceValue", set_nice_value, NULL, RSRC_CONF|ACCESS_CONF,
++              "Set nice value for the given vhost, from -20 (highest priority) to 19 (lowest priority)."),
+ AP_GRACEFUL_SHUTDOWN_TIMEOUT_COMMAND,
+ { NULL }
+ };
+@@ -1657,6 +1690,32 @@
+     itk_per_dir_conf *c = (itk_per_dir_conf *)
+         apr_pcalloc(p, sizeof(itk_per_dir_conf));
+     c->uid = c->gid = -1;
++    c->nice_value = UNSET_NICE_VALUE;
++    return c;
++}
++
++/* == merge the parent per-dir config structure into ours == */
++static void *itk_merge_dir_config(apr_pool_t *p, void *parent_ptr, void *child_ptr)
++{
++    itk_per_dir_conf *c = (itk_per_dir_conf *)
++        apr_pcalloc(p, sizeof(itk_per_dir_conf));
++    itk_per_dir_conf *parent = (itk_per_dir_conf *) parent_ptr;
++    itk_per_dir_conf *child = (itk_per_dir_conf *) child_ptr;
++
++    if (child->username != NULL) {
++      c->username = apr_pstrdup(p, child->username);
++      c->uid = child->uid;
++      c->gid = child->gid;
++    } else if (parent->username != NULL) {
++      c->username = apr_pstrdup(p, parent->username);
++      c->uid = parent->uid;
++      c->gid = parent->gid;
++    }
++    if (child->nice_value != UNSET_NICE_VALUE) {
++      c->nice_value = child->nice_value;
++    } else {
++      c->nice_value = parent->nice_value;
++    }
+     return c;
+ }
+ 
+@@ -1673,7 +1732,7 @@
+     MPM20_MODULE_STUFF,
+     ap_mpm_rewrite_args,        /* hook to run before apache parses args */
+     itk_create_dir_config,      /* create per-directory config structure */
+-    NULL,                       /* merge per-directory config structures */
++    itk_merge_dir_config,       /* merge per-directory config structures */
+     itk_create_server_config,   /* create per-server config structure */
+     NULL,                       /* merge per-server config structures */
+     itk_cmds,                   /* command apr_table_t */
--- pe-httpd-2.2.29.orig/debian/mpm-itk/patches/04-correct-output-makefile-location.patch
+++ pe-httpd-2.2.29/debian/mpm-itk/patches/04-correct-output-makefile-location.patch
@@ -0,0 +1,13 @@
+Fix the build system to use MPM_SUBDIR_NAME (which points to the directory
+with the MPM in) instead of MPM_NAME (which returns the name of the MPM);
+they differ since the MPM is in experimental/.
+
+Index: apache2.2/server/mpm/experimental/itk/config.m4
+===================================================================
+--- apache2.2.orig/server/mpm/experimental/itk/config.m4	2007-01-29 21:03:51.000000000 +0100
++++ apache2.2/server/mpm/experimental/itk/config.m4	2007-01-29 21:03:57.000000000 +0100
+@@ -1,3 +1,3 @@
+ if test "$MPM_NAME" = "itk" ; then
+-    APACHE_FAST_OUTPUT(server/mpm/$MPM_NAME/Makefile)
++    APACHE_FAST_OUTPUT(server/mpm/$MPM_SUBDIR_NAME/Makefile)
+ fi
--- pe-httpd-2.2.29.orig/debian/icons/odf6otc-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6otc-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6otc-20x22.png.uue

+RK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odc-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odc-20x22.png.uue
@@ -0,0 +1,25 @@
+begin-base64 644 odf6odc-20x22.png.uue

+AABJRU5ErkJggg==
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6oth-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6oth-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6oth-20x22.png.uue

+MKiiAQYGAFMTaQfquhWYAAAAAElFTkSuQmCC
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odt-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odt-20x22.png.uue
@@ -0,0 +1,24 @@
+begin-base64 644 odf6odt-20x22.png.uue

+lDhEkJEdBYCDjoFBCA0wMAAAEE1PsJ/Jn2YAAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6ods-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6ods-20x22.png.uue
@@ -0,0 +1,24 @@
+begin-base64 644 odf6ods-20x22.png.uue

+EBpgYAAAbP5NPEH1cBAAAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6ott-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6ott-20x22.png.uue
@@ -0,0 +1,25 @@
+begin-base64 644 odf6ott-20x22.png.uue

+BTCBBBkY5NEAAwMA9LlgMjOLUzMAAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odm-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odm-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6odm-20x22.png.uue

+0QADAwCDDmJcDd4k9QAAAABJRU5ErkJggg==
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odp-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odp-20x22.png.uue
@@ -0,0 +1,24 @@
+begin-base64 644 odf6odp-20x22.png.uue

+HQWAg46BQQgNMDAAAGkwUKkiN6jBAAAAAElFTkSuQmCC
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odi-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odi-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6odi-20x22.png.uue

+CgAHHQODOhpgYAAAhh9mExNPmYgAAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odf-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odf-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6odf-20x22.png.uue

+AAAAAElFTkSuQmCC
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6ots-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6ots-20x22.png.uue
@@ -0,0 +1,25 @@
+begin-base64 644 odf6ots-20x22.png.uue

+UJpdvW69xycAAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6otf-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6otf-20x22.png.uue
@@ -0,0 +1,27 @@
+begin-base64 644 odf6otf-20x22.png.uue

+YII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6otp-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6otp-20x22.png.uue
@@ -0,0 +1,25 @@
+begin-base64 644 odf6otp-20x22.png.uue

+GOTRAAMDAEoQYSbvnJwhAAAAAElFTkSuQmCC
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odg-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odg-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6odg-20x22.png.uue

+HYggBx8KAAcdA4M6GmBgAABuC2ZqLPWjjgAAAABJRU5ErkJggg==
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6oti-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6oti-20x22.png.uue
@@ -0,0 +1,27 @@
+begin-base64 644 odf6oti-20x22.png.uue

+MJigAQYGAOZzdl7FtGVFAAAAAElFTkSuQmCC
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6otg-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6otg-20x22.png.uue
@@ -0,0 +1,27 @@
+begin-base64 644 odf6otg-20x22.png.uue

+CA0wMAAAjGF0n7ZMFJ4AAAAASUVORK5CYII=
+====
--- pe-httpd-2.2.29.orig/debian/icons/odf6odb-20x22.png.uue
+++ pe-httpd-2.2.29/debian/icons/odf6odb-20x22.png.uue
@@ -0,0 +1,26 @@
+begin-base64 644 odf6odb-20x22.png.uue

+AAAAAElFTkSuQmCC
+====
