Topic: source from builds

[bholub]

I want to use (or at least test) the builds provided by this site, but I work for a company with tight restrictions on 3rd party code. Is there any way to get the source used to compile the binaries provided here? I know it says they are unchanged ASF source, but is there any way to prove that?

I appreciate any input, thank you very much!

--
Brian

[tdonovan]

Apache 2.2.6 is an exception - it has a patch for the mod_perl and mod_fcgid problems in 2.2.6.
Yes, other versions are built from the unchanged Apache Win32 source code.

re: "is there any way to prove that?"

I cannot think of any way to prove it, except to:

* Download the Apache Win32 source code from http://httpd.apache.org

* Apply any patches mentioned on the download page

* Build OpenSSL, Zlib, and Apache (Release build) using Visual Studio 2005 SP1

* Compare the results of this build with the Apache Lounge binaries.

Just copying the Apache source code to the Apache Lounge Download page wouldn't really prove anything - so I don't think that would help.

-tom-

[Steffen]

Hi Brian,

I understand the restrictions.

It is hard to prove if the source/binary is not manipulated. Even the official downloads from ASF does not give you a guarantee.

The binary is build with the original source from ASF, which you can be downloaded. But now the big question: did I change the source? The answer is no, but I cannot prove it. The only way is that you go to sit next to me when I build Apache.

I think it is a question of trust, even when you use for example software from Microsoft.

Steffen


Note:
ASF is also, like me, including e.g. openssl en zlib in the binary. There is no guarantee that this sources are the original, they cannot prove it.

[bholub]

Fantastic, thank you guys both so much for your speedy responses. I appreciate it very much!