From d3e91a83b6380e313579f4d72db9b9e2162062ec Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Sun, 23 Apr 2023 12:42:02 -0400
Subject: [PATCH] gnu: httpd: Update to 2.4.57 [security fixes].

Fixes CVE-2023-27522, CVE-2023-25690, CVE-2022-37436, CVE-2022-36760,
CVE-2006-20001, CVE-2022-31813, CVE-2022-30556, CVE-2022-30522,
CVE-2022-29404, CVE-2022-28615, CVE-2022-28614, CVE-2022-28330,
CVE-2022-26377, CVE-2022-23943, CVE-2022-22721, CVE-2022-22720,
and CVE-2022-22719.

* gnu/packages/web.scm (httpd): Update to 2.4.57.
(httpd/pinned): New variable.
* gnu/packages/gnome.scm (libsoup-minimal): Replace httpd with httpd/pinned.
---
 gnu/packages/gnome.scm |  2 +-
 gnu/packages/web.scm   | 19 +++++++++++++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 29d75e2894..3d49ec3de5 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -5027,7 +5027,7 @@ as OpenStreetMap, OpenCycleMap, OpenAerialMap and Maps.")
            vala
            curl
            gnutls ;for 'certtool'
-           httpd))
+           httpd/pinned))
     (propagated-inputs
      ;; libsoup-3.0.pc refers to all of these (except where otherwise noted)
      (list brotli
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index a61eb9cbf4..8d5d94ced0 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -273,14 +273,14 @@
 (define-public httpd
   (package
     (name "httpd")
-    (version "2.4.52")
+    (version "2.4.57")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://apache/httpd/httpd-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "1jgmfbazc2n9dnl7axhahwppyq25bvbvwx0lqplq76by97fgf9q1"))))
+               "0ajdz5f2w9nbmqydip2mv9m4xlnc4swmw7mqzgnrbq4mxr5bik6v"))))
     (build-system gnu-build-system)
     (native-inputs (list `(,pcre "bin")))       ;for 'pcre-config'
     (inputs (list apr apr-util openssl perl)) ; needed to run bin/apxs
@@ -305,6 +305,21 @@ and its related documentation.")
     (license license:asl2.0)
     (home-page "https://httpd.apache.org/")))
 
+;; A package variant that may be out of date and vulnerable. Only for use in
+;; test suites and should never be referred to by a built package.
+(define-public httpd/pinned
+  (hidden-package
+    (package
+      (inherit httpd)
+      (version "2.4.52")
+      (source (origin
+               (method url-fetch)
+               (uri (string-append "mirror://apache/httpd/httpd-"
+                                   version ".tar.bz2"))
+               (sha256
+                (base32
+                 "1jgmfbazc2n9dnl7axhahwppyq25bvbvwx0lqplq76by97fgf9q1")))))))
+
 (define-public mod-wsgi
   (package
     (name "mod-wsgi")