anchor.diff:  	&& chown www-data:www-data "$HTTPD_PREFIX"
   WORKDIR $HTTPD_PREFIX
   
  -ENV HTTPD_VERSION 2.2.31
  -ENV HTTPD_SHA1 e3b55387112206307ba76526820a2627472f3787
  +ENV HTTPD_VERSION 2.4.37
  +ENV HTTPD_SHA256 3498dc5c6772fac2eb7307dc7963122ffe243b5e806e0be4fb51974ff759d726
   
  +# https://httpd.apache.org/security/vulnerabilities_24.html
  +ENV HTTPD_PATCHES=""
  +
  +ENV APACHE_DIST_URLS \
   # https://issues.apache.org/jira/browse/INFRA-8753?focusedCommentId=14735394#comment-14735394
  -ENV HTTPD_BZ2_URL https://www.apache.org/dyn/closer.cgi?action=download&filename=httpd/httpd-$HTTPD_VERSION.tar.bz2
  -# not all the mirrors actually carry the .asc files :'(
  -ENV HTTPD_ASC_URL https://www.apache.org/dist/httpd/httpd-$HTTPD_VERSION.tar.bz2.asc
  +	https://www.apache.org/dyn/closer.cgi?action=download&filename= \
  +# if the version is outdated (or we're grabbing the .asc file), we might have to pull from the dist/archive :/
  +	https://www-us.apache.org/dist/ \
  +	https://www.apache.org/dist/ \
  +	https://archive.apache.org/dist/
   
  -# see https://httpd.apache.org/docs/2.2/install.html#requirements
  -RUN set -x \
  -	&& runDeps=' \
  +# see https://httpd.apache.org/docs/2.4/install.html#requirements
  +RUN set -eux; \
  +	\
  +	runDeps=' \
   		apr-dev \
   		apr-util-dev \
  +		apr-util-ldap \
   		perl \
  -	' \
  -	&& apk update \
  -	&& apk add --no-cache --virtual .build-deps \
  +	'; \
  +	apk add --no-cache --virtual .build-deps \
   		$runDeps \
   		ca-certificates \
  +		coreutils \
  +		dpkg-dev dpkg \
   		gcc \
   		gnupg \
   		libc-dev \
  +		# mod_session_crypto
  +		libressl \
  +		libressl-dev \
  +		# mod_proxy_html mod_xml2enc
  +		libxml2-dev \
  +		# mod_lua
  +		lua-dev \
   		make \
  -		openssl \
  -		openssl-dev \
  +		# mod_http2
  +		nghttp2-dev \
   		pcre-dev \
   		tar \
  +		# mod_deflate
  +		zlib-dev \
  +		tzdata \
  +	; \
  +	cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime; \
  +	echo 'Asia/Shanghai' >  /etc/timezone; \
   	\
  -	&& wget -O httpd.tar.bz2 "$HTTPD_BZ2_URL" \
  -	&& echo "$HTTPD_SHA1 *httpd.tar.bz2" | sha1sum -c - \
  +	ddist() { \
  +		local f="$1"; shift; \
  +		local distFile="$1"; shift; \
  +		local success=; \
  +		local distUrl=; \
  +		for distUrl in $APACHE_DIST_URLS; do \
  +			if wget -O "$f" "$distUrl$distFile" && [ -s "$f" ]; then \
  +				success=1; \
  +				break; \
  +			fi; \
  +		done; \
  +		[ -n "$success" ]; \
  +	}; \
  +	\
  +	ddist 'httpd.tar.bz2' "httpd/httpd-$HTTPD_VERSION.tar.bz2"; \
  +	echo "$HTTPD_SHA256 *httpd.tar.bz2" | sha256sum -c -; \
  +	\
   # see https://httpd.apache.org/download.cgi#verify
  -	&& wget -O httpd.tar.bz2.asc "$HTTPD_ASC_URL" \
  -	&& export GNUPGHOME="$(mktemp -d)" \
  -	&& gpg --keyserver ha.pool.sks-keyservers.net --recv-keys B1B96F45DFBDCCF974019235193F180AB55D9977 \
  -	&& gpg --batch --verify httpd.tar.bz2.asc httpd.tar.bz2 \
  -	&& rm -r "$GNUPGHOME" httpd.tar.bz2.asc \
  +	ddist 'httpd.tar.bz2.asc' "httpd/httpd-$HTTPD_VERSION.tar.bz2.asc"; \
  +	export GNUPGHOME="$(mktemp -d)"; \
  +	for key in \
  +# gpg: key 791485A8: public key "Jim Jagielski (Release Signing Key) <jim@apache.org>" imported
  +		A93D62ECC3C8EA12DB220EC934EA76E6791485A8 \
  +# gpg: key 995E35221AD84DFF: public key "Daniel Ruggeri (https://home.apache.org/~druggeri/) <druggeri@apache.org>" imported
  +		B9E8213AEFB861AF35A41F2C995E35221AD84DFF \
  +	; do \
  +		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
  +	done; \
  +	gpg --batch --verify httpd.tar.bz2.asc httpd.tar.bz2; \
  +	command -v gpgconf && gpgconf --kill all || :; \
  +	rm -rf "$GNUPGHOME" httpd.tar.bz2.asc; \
   	\
  -	&& mkdir -p src \
  -	&& tar -xvf httpd.tar.bz2 -C src --strip-components=1 \
  -	&& rm httpd.tar.bz2 \
  -	&& cd src \
  +	mkdir -p src; \
  +	tar -xf httpd.tar.bz2 -C src --strip-components=1; \
  +	rm httpd.tar.bz2; \
  +	cd src; \
   	\
  -	&& ./configure \
  +	patches() { \
  +		while [ "$#" -gt 0 ]; do \
  +			local patchFile="$1"; shift; \
  +			local patchSha256="$1"; shift; \
  +			ddist "$patchFile" "httpd/patches/apply_to_$HTTPD_VERSION/$patchFile"; \
  +			echo "$patchSha256 *$patchFile" | sha256sum -c -; \
  +			patch -p0 < "$patchFile"; \
  +			rm -f "$patchFile"; \
  +		done; \
  +	}; \
  +	patches $HTTPD_PATCHES; \
  +	\
  +	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
  +	./configure \
  +		--build="$gnuArch" \
   		--prefix="$HTTPD_PREFIX" \
  -# https://httpd.apache.org/docs/2.2/programs/configure.html
  -# Caveat: --enable-mods-shared=all does not actually build all modules. To build all modules then, one might use:
  -		--enable-mods-shared='all ssl ldap cache proxy authn_alias mem_cache file_cache authnz_ldap charset_lite dav_lock disk_cache' \
  -	&& make -j "$(getconf _NPROCESSORS_ONLN)" \
  -	&& make install \
  +		--enable-mods-shared=reallyall \
  +		--enable-mpms-shared=all \
  +	; \
  +	make -j "$(nproc)"; \
  +	make install; \
   	\
  -	&& cd .. \
  -	&& rm -r src man manual \
  +	cd ..; \
  +	rm -r src man manual; \
   	\
  -	&& sed -ri \
  +	sed -ri \
   		-e 's!^(\s*CustomLog)\s+\S+!\1 /proc/self/fd/1!g' \
   		-e 's!^(\s*ErrorLog)\s+\S+!\1 /proc/self/fd/2!g' \
  -		"$HTTPD_PREFIX/conf/httpd.conf" \
  +		"$HTTPD_PREFIX/conf/httpd.conf"; \
   	\
  -	&& runDeps="$runDeps $( \
  -		scanelf --needed --nobanner --recursive /usr/local \
  -			| awk '{ gsub(/,/, "\nso:", $2); print "so:" $2 }' \
  +	runDeps="$runDeps $( \
  +		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
  +			| tr ',' '\n' \
   			| sort -u \
  -			| xargs -r apk info --installed \
  -			| sort -u \
  -	)" \
  -	&& apk add --virtual .httpd-rundeps $runDeps \
  -	&& apk del .build-deps
  +			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
  +	)"; \
  +	apk add --virtual .httpd-rundeps $runDeps; \
  +	apk del .build-deps tzdata; \
  +	\
  +# smoke test
  +	httpd -v
   
   COPY httpd-foreground /usr/local/bin/
  -RUN chmod u+x /usr/local/bin/httpd-foreground
  +
   EXPOSE 80
   CMD ["httpd-foreground"]
positive.code: FROM alpine:3.4
  
  MAINTAINER Back Yu <yhfszb@gamil.com>
  
  RUN sed -i 's/dl-cdn.alpinelinux.org/mirrors.aliyun.com/g' /etc/apk/repositories
  
  
negative.code: 	&& addgroup -g 82 -S www-data \
  	&& adduser -u 82 -D -S -G www-data www-data
  # 82 is the standard uid/gid for "www-data" in Alpine
  # https://git.alpinelinux.org/cgit/aports/tree/main/apache2/apache2.pre-install?h=v3.8.1
  # https://git.alpinelinux.org/cgit/aports/tree/main/lighttpd/lighttpd.pre-install?h=v3.8.1
  # https://git.alpinelinux.org/cgit/aports/tree/main/nginx/nginx.pre-install?h=v3.8.1
  
  ENV HTTPD_PREFIX /usr/local/apache2
  ENV PATH $HTTPD_PREFIX/bin:$PATH
  