Ubuntu
nginx package

HTTP/2 is not enabled for nginx-extras

Bug #1534368 reported by Laine Gholson
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
nginx (Ubuntu)
Fix Released
Low
Thomas Ward

Bug Description

The package description for nginx-extras in Ubuntu Xenial falsely claims that it has HTTP/2 support, even though when --enable-http_v2_module was removed from common_configure_flags, nginx-extras isn't compiled with HTTP/2.

Two solutions:
* Actually add HTTP/2 support (will not happen at this time, per Security Team)
* Remove HTTP/2 from module list in description

See original description
Tags: armhf xenial
Revision history for this message
Thomas Ward (teward) wrote :

Working As Intended, and we're not enabling it at this time due to a request/mandate from the Security Team at this time. Read the answer I wrote to this question, and the links included in there, to explain why it is currently disabled: https://answers.launchpad.net/ubuntu/+source/nginx/+question/280708

Changed in nginx (Ubuntu):
status: New → Won't Fix
Revision history for this message
Thomas Ward (teward) wrote :

Also, I'm pretty certain we *did* remove HTTP/2 from the module list in the description. I remember doing that myself.

Revision history for this message
Thomas Ward (teward) wrote :

Ooops, my bad, I did miss the removal from the description of nginx-extras... reopening because i'm working on it in the next merge.

Changed in nginx (Ubuntu):
assignee: nobody → Thomas Ward (teward)
importance: Undecided → Low
status: Won't Fix → In Progress
Thomas Ward (teward)
description: updated
Thomas Ward (teward)
Changed in nginx (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package nginx - 1.9.9-1ubuntu1

---------------
nginx (1.9.9-1ubuntu1) xenial; urgency=low

  * Merge from Debian unstable. Remaining changes: (LP: #1534208)
    - debian/patches/ubuntu-branding.patch: add Ubuntu branding (refreshed)
    - d/{control,rules,nginx-core.*}: add new binary package for main,
      nginx-core, which contains only source-tarball-included modules
      and no third-party modules.
    - debian/tests/control: add nginx-core test.
    - debian/control:
      - drop luajit from Build-Depends as it is in universe.
      - Update nginx-core description to match nginx-full description of the
        standard and optional HTTP modules that are enabled.
      - Remove HTTP/2 references in package descriptions, per Ubuntu
        Security Team mandate to disable HTTP/2 support.
    - debian/rules:
      - Update nginx-core configure flags to match nginx-full config flags,
        due to refreshing the nginx-core 'enabled modules' to match the
        nginx-full modules (minus third-party modules)
      - Disable HTTP/2 module support in all flavors, per Ubuntu Security
        Team mandate.
    - debian/apport/source_nginx.py: Add apport hooks for additional bug
      information gathering.
    - debian/nginx-common.install: Add install rule for apport hooks.
  * debian/control: Remove HTTP/2 reference in nginx-extras description, which
    was missed previously due to accidental oversight. (LP: #1534368)

 -- Thomas Ward <email address hidden> Thu, 14 Jan 2016 18:42:00 -0500

Changed in nginx (Ubuntu):
status: Fix Committed → Fix Released
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Thomas and the nginx team have convinced me that nginx's http/2 implementation is widely used and mature enough to enable before 16.04 LTS release.

Thanks

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.