Repository: carrvo/debian-libapache2-mod-authnz-external
Pull request #1: Features/debian package
Author: login: carrvo
Created: 2025-03-07T20:32:35Z | Merged: 2025-03-10T21:40:52Z

Re-create https://github.com/phokz/mod-auth-external/pull/62

Also, this work has a [mentors package](https://mentors.debian.net/package/libapache2-mod-authnz-external/)


Diff:
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3528a68
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+libapache2-mod-authnz-external/
+libapache2-mod-authnz-external-dbgsym_*
+libapache2-mod-authnz-external_*
+mod_authnz_external-*.tar.gz
diff --git a/AUTHENTICATORS b/AUTHENTICATORS
deleted file mode 100644
index 112ca49..0000000
--- a/AUTHENTICATORS
+++ /dev/null
@@ -1,307 +0,0 @@
-            How To Implementation External Authentication Programs
-	       for mod_authnz_external or mod_auth_external
-	       			Version 3.3.x
-
-LANGUAGES
-
- External authenticators can be written in almost any language.  The sample
- authenticators in the 'test' directory are in Perl and PHP.  The 'pwauth'
- authenticator is in ANSI C.  The example code fragments in this document
- are in C.
-
- If the authenticator is a script rather than a compiled program, it normally
- has to start with a "#!/bin/sh" or "#!/usr/bin/perl" type directive.  Scripts
- without such directives may get interpreted by the shell, or may just not
- work, depending on your installation.
-
-SECURITY
-
- The authenticator program should be written with great care because it runs
- as a privileged user and handles privileged data.  A poorly written
- authenticator could substantially compromise the security of your system.
- You get points for paranoia.  Some notes:
-
- - Don't make any assumptions about the length of the login names and
-   passwords given by the user.  I *think* Apache will never pass you ones
-   that are longer than 8192 characters, but don't depend this.  Check very
-   carefully for buffer overflows.
-
- - Don't make assumptions about the content of the login and password strings.
-   For example, if you are using them in an SQL query, do proper checking
-   and/or quoting to insure that nobody is doing SQL injection.
-
- - Think about locking.  It is possible to get lots of hits at your website
-   very fast, so there may be many programs simultaneously reading your
-   authentication database, plus updates may be going on at the same time.
-   Probably some form of locking is needed to make all this work right.
-
- - Think about core dumps.  On some systems core dump files can be publically
-   readable.  A core dump from your authenticator is likely to contain the
-   user's plain text password, and may include large chunks of your password
-   database that may have been in buffers.  For C programs on most versions of
-   Unix, it is possible to disable core dumps by doing something like:
-   
-    rlim.rlim_cur = rlim.rlim_max = 0;
-    (void)setrlimit(RLIMIT_CORE, &rlim);
-
-   Actually, core dumps seem to be mostly a thing of the past. Most modern
-   Unixes don't seem to generate them.
-
- It may not hurt to spend a little time looking at the features of the pwauth
- authenticator, which is the most secure external authenticator that I have
- written.
-
-PASSWORD AUTHENTICATORS
-
- Authenticators communicate their result by the exit status code they return.
- A value of 0 indicates that the password is correct.  Other values indicate
- that the password is incorrect, or something else is wrong.  It can be
- useful to return different error codes for different kinds of errors.  These
- will be logged in the Apache error log file, and can be helpful in diagnosing
- problems.  This version of mod_authnz_external does not have any provision for
- returning textual error messages from the external authenticator.  You might
- be able to use syslog() for this.  This might be improved in future releases.
-
- Returned error codes should not be negative.  Negative values are used
- internally to mod_authnz_external to indicate problems launching your program.
-
- How the external authentication program gets its arguments depends on
- the method used.  The method used is determined by the 'SetExternalAuthMethod'
- command in your Apache configuration file.  You need implement only the
- method that you plan to use in your configuration.
-
- PIPE METHOD
-
-  In the "pipe" method, the arguments are read from standard input.  The
-  user name will be on the first line, and the password will be on the
-  second.  Here's a typical chunk of C code to read that:
-
-  main()
-  {
-      char user[100], password[100], *p;
-
-      if (fgets(user, sizeof(user), stdin) == NULL) exit(2);
-      if ((p= strchr(user, '\n')) == NULL) exit(4)
-      *p= '\0';
-
-      if (fgets(password, sizeof(password), stdin) == NULL) exit(3);
-      if ((p= strchr(password, '\n')) == NULL) exit(5)
-      *p= '\0';
-
-      if (check_password(user, password) == OK)
-           exit(0);	/* Good Password */
-      else
-      	   exit(1);	/* Incorrect Password */
-  }
-
-  Here we simply read two lines from stdin, being careful not to allow
-  buffer overflows and stripping off trailing newlines.
-
-  We assume "check_password()" is some function that checks the validity of a
-  password and returns 'OK' if it is good.
-  
-  Note that we exit with different non-zero error codes in different error
-  cases.  This will be helpful for debugging, as those values will be logged
-  when authentication fails, giving you some clue as to what went wrong.
-  It'd really be better for check_password() to return more detailed error
-  codes, but I wanted to keep the example simple.
-
- CHECKPASSWORD METHOD
-
-  The "checkpassword" method is identical to the "pipe" method, except
-  that the user name and password are terminated by NUL ('\0') characters
-  instead of newline characters, and they must be read from file descriptor
-  3 instead of standard input.  Documentation for the checkpassword
-  interface is at http://cr.yp.to/checkpwd.html.
-
- ENVIRONMENT METHOD
-
-  In the "environment" method, the arguments are passed in environment
-  variables.  The user id and the clear-text password are passed in the
-  USER and PASS environment variables respectively.
-  
-  Note that the environment method has fundamental security weaknesses,
-  and should probably not be used unless you have cause to believe it is
-  safe on your system. I wouldn't be surprised if it is marginally faster
-  than the pipe method. Most applications should use the pipe method instead.
-
-  A typical chunk of C code to authenticate with the environment method
-  might be like:
-
-  main()
-  {
-      char *user, *password;
-
-      if ((user= getenv("USER")) == NULL) exit(2);
-      if ((password= getenv("PASS")) == NULL) exit(3);
-
-      if (check_password(user, password) == OK)
-           exit(0);	/* Good Password */
-      else
-      	   exit(1);	/* Incorrect Password */
-  }
-
-GROUP AUTHENTICATORS
-
- Security is generally less of a issue with group authenicators, since they
- are not handling any data as sensitive as clear-text passwords.  They are
- only passed a user name (presumably already authenticated), and a list of
- group names.  They exit with status code 0 if that user is in one of those
- groups, and a non-zero code otherwise.
-
- In versions of mod_auth_external before 2.1.8, external authenticators were
- always passed just one group name.  If the Apache "require group" directive
- listed more than one group, then the external authenticator would be called
- once with each group name, which could be inefficient if you have a large
- number of groups.  Mod_auth_external will still behave this way if you
- issue the "GroupExternalManyAtOnce off" directive.
-
- Newer versions of mod_auth_external and mod_authnz_external will pass all
- group names, separated by spaces.  There will only be multiple calls if more
- than one "require group" directive applies to the same program (e.g., if
- different parent directories contain such directives in their .htaccess
- files - for efficiency, this should be avoided).  The list of group names
- is passed in exactly as they appear on the "require group" directive - if
- your program can't handle multiple spaces between group names, don't put
- them there.
-
- Arguments are passed in a manner similar to password authenticators.  The
- method used is determined by the 'SetExternalGroupMethod' command in your
- Apache configuration file.
-
- ENVIRONMENT METHOD
-
-  In the "environment" method, the arguments are passed in environment
-  variables.  The user id and the group names are passed in the USER and
-  GROUP environment variables respectively.  A typical chunk of C code to
-  fetch the arguments and check each group might be like:
-
-  main()
-  {
-      char *user, *groups, *group;
-
-      if ((user= getenv("USER")) == NULL) exit(2);
-      if ((groups= getenv("GROUP")) == NULL) exit(3);
-
-      group= strtok(groups, " ");
-      while (group != NULL)
-      {
-	  if (check_group(user, group) == OK)
-		exit(0);	/* User is in group */
-          group= strtok(NULL, " ");
-      }
-      exit(1);			/* User is not in any group */
-  }
-
-  Here "check_group()" is some function that looks in your database to see if
-  user is in group and returns 'OK' if he is.
-
- PIPE METHOD
-
-  In the "pipe" method, the arguments are read from standard input.  The
-  user name will be on the first line, and the group name will be on the
-  second.  Here's a typical chunk of C code to read that:
-
-  main()
-  {
-      char user[100], groups[100], *group, *p;
-
-      if (fgets(user, sizeof(user), stdin) == NULL) exit(2);
-      if ((p= strchr(user, '\n')) == NULL) exit(4)
-      *p= '\0';
-
-      if (fgets(groups, sizeof(groups), stdin) == NULL) exit(3);
-      if ((p= strchr(groups, '\n')) == NULL) exit(5)
-      *p= '\0';
-
-      group= strtok(groups, " ");
-      while (group != NULL)
-      {
-	  if (check_group(user, group) == OK)
-		exit(0);	/* User is in group */
-          group= strtok(NULL, " ");
-      }
-      exit(1);			/* User is not in any group */
-  }
-
-  Here we simply read two lines from stdin, being careful not to allow
-  buffer overflows and stripping off trailing newlines.  We loop through
-  all groups, checking each.
-
- CHECKPASSWORD METHOD
-
-  Mod_auth_external will happily try to do group authentication via the
-  checkpassword method, piping NUL terminated user and group names to
-  the child process's file descriptor 3, but this isn't actually allowed
-  for in the checkpassword protocol specification, so I don't recommend it.
-
-OTHER ENVIRONMENT VARIABLES
-
- In all cases (pipe or environment method, password or group authentication),
- the following additional environment variables will be supplied to the
- authenticator:
-
-    AUTHTYPE  either "PASS" or "GROUP" depending on whether we are doing
-              password or group authentication.  This is handy if you are
-	      using one program to do both.
-
-    CONTEXT   a string whose value is set by an "AuthExternalContext"
-              directive in the .htaccess file or "<Directory>" block for
-	      the directory.  This can be used to select different
-	      authentication behaviors in different directories.  It is
-	      undefined if there is no "AuthExternalContext" directive.
-
-    IP        the client's ip-address.
-
-    HOST      the host name corresponding to IP, if Apache has
-              "HostnameLookups On".
-
-    PATH      the httpd's path environment variable.
-
-    COOKIE    all cookie values passed in by the client.
-
-    HTTP_HOST the server's host name, as given in the HTTP request.  May
-              be useful if you have multiple virtual hosts sharing an
-              authenticator.
-
-    URI       the document requested.  This is the URL including any extra
-              path information, but not including the hostname or any CGI
-	      arguments.
-
- These may be useful for logging, or you may want to accept logins from
- certain users only if they are connecting from certain locations or requesting
- certain documents.
-
- Note that if you have configured Apache with "HostnameLookups Off" then HOST
- will usually not be set.  If you really want hostnames, either turn on
- HostnameLookups or do your own gethostbyaddr() calls from the authenticator
- when HOST is not defined.  Note that if the user is coming from an
- unresolvable IP, then hostname lookups can be very slow.
-
- Note that using IP addresses to track a user through your site is not
- reliable.  Users of services like AOL and WebTV use proxy servers, so that 
- their IP addresses appear to change constantly since each request may come
- through a different proxy.  A single user's requests for successive pages,
- or for different images on the same page may all come from different IP
- addresses.
-
- The PATH environment variable passed to the authenticator is just whatever
- PATH was in effect when Apache was launched, and may differ if the server
- was launched automatically during a reboot or manually by an admin. 
- Probably your program should set its own PATH if it needs one.
-
- The COOKIE environment variable contains all cookies set in the current
- request.  This has the same format as the HTTP_COOKIES ("key=val;key=val")
- passed to a CGI program.  This should be used with caution.  Cookies come
- from the user's computer and might have been created, editted or deleted
- by the user rather than your website.  This severely limits their use for
- authentication.  It is not possible to set cookies from an authentication
- module.
-
- The URI variable is there because various people want it.  Mostly it
- is useful not for authentication ("who is this person?") but for access
- control ("is this person permitted to do this?"), and good design usually
- dictates separating those functions.  Strictly speaking, an authenticator
- is not the right place to be doing access control.  However,
- mod_authnz_external is 50% a kludge-builder's tool, so we won't fuss if you
- want to break the rules.
diff --git a/CHANGES b/CHANGES
deleted file mode 100644
index 23da9e6..0000000
--- a/CHANGES
+++ /dev/null
@@ -1,345 +0,0 @@
-v3.3.3   (Josef Liska & Micah Andersen - July 22, 2019)
-----------------------------------------------
- * Added METHOD environment variable to retrieve the HTTP request method 
-   (e.g. GET, HEAD, POST, OPTIONS, etc.). Thanks to Vijay from Google Code.
- * Fixed a bug with incorrect parenthesis grouping when checking the result
-   of the external process in exec_external(). Thanks to @dcb314.
- * Added the "GroupExternalAuthNCheck Off" directive to disable the check
-   for a previously authenticated user when using *only* the group 
-   authorization module. If you use *any* user authentication module in the
-   same context, this may be undesirable. Thanks to Micah Andersen/BIMI.
- * Fix launching external processes on Windows - many programs require the
-   %SystemRoot% environment variable to function properly. Thanks to Micah
-   Andersen/BIMI.
-
-v3.3.2   (Jan Wolter - Dec 12, 2013)
-----------------------------------------------
- * Replaced reference to remote_ip field of the connection record with
-   useragent_ip, due to the elimination of remote_ip in Apache 2.4.1. Thanks
-   to davidsansome and cjwatson for pointing out the need for this.
- * Fixed a bug with setting of GROUP environment variable. Thanks to
-   ddarbyson for reporting this, and Guoan Hu for posting the fix.
- * Added test/test.pipe.php, a PHP version of test/test.pipe contributed
-   by Claus Andersen.
- * Spelling fixes (as seen on lintian.debian.org). Thanks to klemens/ka7.
- * Fixed Windows build by defining out Unix-specific signal code. Thanks
-   to Michal Pokorny <agentydragon@gmail.com>.
-
-v3.3.1   (Jan Wolter - Oct 12, 2011)
-----------------------------------------------
- * Deleted most of the sample authenticators from the distribution. They
-   are mostly old and crufty or available elsewhere. No need to clutter
-   the main distribution with them.
- * Added code to support caching authentications with mod_authn_socache.
-   This is enabled by the "AuthExternalProvideCache On" directive.  This
-   feature should be considered experimental, since mod_authn_socache still
-   seems buggy and it's interface may not have been finalized.
-
-v3.3.0   (Jan Wolter - Oct 6, 2011)
-----------------------------------------------
- * Revised to work with Apache 2.3 / 2.4.  Will not work with previous Apache
-   versions.
- * Deleted 'GroupExternalAuthoritative' and 'AuthzExternalAuthoritative'
-   directives which are obsolete.
- * Deleted 'GroupExternalError' directive which is superseded by Apache's
-   'AuthzSendForbiddenOnFailure' directive.
-
-v3.2.6   (Jan Wolter - Oct 6, 2011)
------------------------------------------------
- * Modified parsing of "Require groups" line so that you can have group
-   names that include spaces by enclosing them in quotes.  This change
-   suggested by David Homborg.
- * Default action of Makefile changed to "build" not "install".
- * Corrected an exploitable SQL injection flaw in the sample mysql
-   authenticator.
- * Add references to version 3.3.x to documentation.
-
-v3.2.5   (Jan Wolter - Oct 29, 2009)
------------------------------------------------
- * Fixed a bug introduced in 3.2.0 in which data for checkpassword-type
-   authenticators is written to the authenticator's stdin instead of stderr.
-
-v3.2.4   (Jan Wolter - May 20, 2009)
------------------------------------------------
- * Dropped the radius code from the distribution, because of possible problems
-   with it's license.  Thanks to Hai Zaar for pointing out this problem.
- * Modified AuthExternal directive to be able to take more than one
-   authenticator name.  If more than one is defined, then each authenticator
-   is run in turn, until one succeeds or all have failed.  Probably a similar
-   change should be made to GroupExternal, but it hasn't been done yet because
-   it's a more complex change and nobody has asked for it.  Thanks to Andreas
-   Ntaflos for suggesting this change.
- * Inserted code to restore SIGCHLD to default before running the
-   authenticator.  Sometime other modules (like php built with the
-   --enable-sigchild option) leave SIGCHLD messed up, which would cause
-   problems with getting the return code back from authenticators.  We
-   restore SIGCHLD to whatever state it was in originally after the
-   authenticator terminates.  Thanks to Stefan Mehlhorn for reporting this
-   problem and providing the help needed to diagnose it.
- * Clean-up of handling of return codes from apr_proc_wait() to be more
-   formally correct.
-
-v3.2.3   (Jan Wolter - Feb 26, 2009)
------------------------------------------------
- * Added GroupExternalError directive, which allows you to specify the
-   HTTP error code to be returned if the group access check fails.
-   Default is 401, but you may want to return 403 if you want to show the
-   user an error page instead of asking him to login again.  Thanks to
-   Peter Crawshaw <pcrawshaw@mta.ca> for this patch.
- * In hopes of getting to a more consistently named set of directives,
-   added new aliases for two old directives:
-      GroupExternalAuthoritative    alias for    AuthzExternalAuthoritative
-      GroupExternalManyAtOnce       alias for    AuthExternalGroupsAtOnce
-   Documentation updated to refer primarily to the new names.
-
-v3.2.2   (Jan Wolter - Dec 1, 2008)
------------------------------------------------
- THIS RELEASE UPDATES DOCUMENTATION ONLY!
- * Improved documentation of AuthExternalContext directive in the INSTALL
-   file.
- * Added documentation to the UPGRADE file on interactions between multiple
-   Require directives.
-
-v3.2.1   (Jan Wolter - Jul 31, 2008)
------------------------------------------------
- * Added AuthExternalContext directive, which defines a string that will be
-   passed to the authenticator in the CONTEXT environment variable.  This can
-   be set from the .htaccess file or the <Directory> block to give slightly
-   different behavior from the same authenticator in different directories.
-   Thanks to Olivier Thauvin <nanardon at mandriva dot org> for this patch.
-
-v3.2.0   (Jan Wolter - Jan 7, 2007)
------------------------------------------------
- * Rewrite external authenticator launching code to use Apache's cross-OS
-   process/thread library instead of directly calling Unix functions.
-   Theoretically this should get us much closer to being usable on non-
-   Unix platforms.
- * Support alternate syntax for configuration, using DefineAuthExternal and
-   DefineAuthGroup commands.
- * More detailed error logging.
- * Much cleanup of documentation.
-
-v3.1.0   (Jan Wolter - Feb 17, 2006)
------------------------------------------------
- * New authn/authz version for Apache 2.2.
- * Renamed from "mod_auth_external" to "mod_authnz_external" to agree
-   with new module naming conventions.
- * The more secure "pipe" method is now the default, instead of the old
-   insecure "environment" method.
- * Eliminated "AuthExternalAuthoritative" directive.  Instead use
-   "AuthBasicAuthoritative" for authentication and "AuthzExternalAuthoritative"
-   for access control.
- * Substantially rewritten to function as an authentication provider for
-   mod_auth_basic instead of a stand-alone authentication module.
- * Eliminated duplication of documentation inside mod_authnz_external.c file.
- * Addition of UPGRADE document, and update of all other documentation.
- * Normalization of many variable names and other clean up of code.
-
-v2.2.10  (Jan Wolter - Sep 29, 2005)
------------------------------------------------
- * Renamed module from "external_auth_module" to "auth_external_module".  This
-   seems to be what is wanted for static linking.
-
-v2.2.9  (Jan Wolter - Sep 25, 2004)
------------------------------------------------
- * Small corrections to 2.0 defines, thanks to Guenter Knauf <gk@gknw.de>.
- * Pwauth removed from this package.  It is now distributed separately.
-
-v2.2.8  (Jan Wolter - Jun 30, 2004)
------------------------------------------------
- * Trivial documentation improvement.
- * Clarification of docomentation on use of pwauth options UNIX_LASTLOG,
-   FAILLOG_JFH, and MIN_UNIX_UID with PAM.
-
-v2.2.7  (Jan Wolter - Oct 23, 2003)
------------------------------------------------
- * Pwauth gains IGNORE_CASE and DOMAIN_AWARE options, both aimed at making
-   work more easily for those used to authentication in Microsoft environments.
-   Thanks to Peter Eggimann <egp@zhwin.ch> for these enhancemen
- * Fix one bit of remaining Apache 1.3 api inside HARDCODE block.
- * Grammar corrections in AUTHENTICATORS file.
-
-v2.2.6  (Jan Wolter - Aug 14, 2003)
------------------------------------------------
- * Minor improvements to debugging notes in the INSTALL document.
-
-v2.2.5  (Jan Wolter - Jul 11, 2003)
------------------------------------------------
- * Pass local hostname (or virtual hostname) to authenticator in HTTP_HOST
-   environment variable.  Thanks to Steve Horan <sjh-mae@horan.net.au> for
-   submitting this modification.
-
-v2.2.4  (Jan Wolter - Jan 12, 2003)
------------------------------------------------
- * Documentation updates for OpenBSD and minor OpenBSD portability fixes to
-   pwauth.
-
-v2.2.3  (Jan Wolter - Oct 21, 2002)
------------------------------------------------
- * More update of installation instructions.  Thanks to Sven Koch
-   <haegar@sdinet.de> and Joshua Polterock <joshuap@sdsc.edu>.
-
-v2.2.2  (Jan Wolter - Oct 14, 2002)
------------------------------------------------
- * Partial update of installation instructions.
-
-v2.2.1  (Jan Wolter - Jun 24, 2002)
------------------------------------------------
- * Corrected undefined symbol in _HARDCODE_ option.  Thanks to Phil
-   Benchoff <benchoff@vt.edu>.
-
-v2.2.0  (Dave Woolaway, Sven Koch & Jan Wolter - Jun 22, 2002)
---------------------------------------------------------------
- * Ported to work with Apache 2.0.28 by Dave Woolaway <dave@watersheep.org>
- * Independently ported to work with Apache 2.0.39 by Sven Koch
-   <haegar@sdinet.de>
- * Version merger and insufficient documentation updates by Jan Wolter.
-
-v2.1.15 (Jan Wolter - Jan 22, 2002)
------------------------------------
- * Added MySQL-auth to distribution.  Contributed by Anders Nordby
-   <anders@fix.no>.
-
-v2.1.14 (Jan Wolter - Jan 1, 2002)
------------------------------------
- * Minor clarification to documentation on virtual hosts.
- * Minor update of description of pwauth in README file.
- * Correction of AIX compilation instructions.  Thanks to Mathieu Legare
-   <legare@uqtr.ca> for this.
- * Fixed name of GROUP environment variable in pwauth/unixgroup script.  Thanks
-   to Jeroen Roodnat <jroodnat@xs4all.nl> for pointing this out.
-
-v2.1.13 (Jan Wolter - Jul 31, 2001)
------------------------------------
- * Pass AUTHTYPE environment variable to external authenticator.  This is
-   PASS if we are doing password authentication, GROUP if we are doing group
-   authentication, so the same authentication program can easily be used to
-   do both.  Thanks to Dan Thibadeau <dan_thibadeau@hp.com> for this.
- * pwauth can now be configured to work for more than one UID.
- * pwauth/FORM_AUTH updated to discuss suExec.
-
-v2.1.12 (Jan Wolter - Jul 9, 2001)
------------------------------------
- * Fixed erroneous variable names in _HARDCODE_ stuff.  Thanks to Phil
-   Benchoff <benchoff@vt.edu> for this fix.
- * Added pwauth/unixgroup, a simple perl unix group authenticator.  Hope to
-   replace this with a better solution someday.
-
-v2.1.11 (Jan Wolter - Apr 25, 2001)
------------------------------------
- * Arguments may now be specified for authenticators on the AddAuthExternal
-   command.  The whole command must be in quotes, no shell meta characters
-   may be used, and there is a limit of 32 arguments.
- * Support for the checkpassword protocol, allowing use of checkpassword
-   compatible authenticators.  Thanks go to Matthew Kirkwood
-   <matthew@dev.sportingbet.com> for submitting patches for this.
- * Mod_auth_external now passes the URI environment variable to all
-   authenticators, giving the URL of the requested page minus hostname,
-   and CGI arguments.  Thanks to Charles Clancy <mgrtcc@cs.rose-hulman.edu>
-   and Niall Daley <niall@neoworks.com> for independently submitting similar
-   patches for this.
- * Fixed a possible buffer overflow problem in the HARDCODE section.  This
-   is unlikely to have been an exploitable security problem but could
-   cause a crash in rare circumstances. Thanks go to Bradley S. Huffman
-   <hip@a.cs.okstate.edu> for pointing this out.
- * Example programs in test directory log command-line arguments.
-
-v2.1.10 (Jan Wolter - Jan 9, 2001)
-----------------------------------
- * Fix a pwauth bug that could cause segmentation faults when compiled with
-   the ENV_METHOD option.
- * Add documentation on how to use pwauth for form authentication.
- * Clarify documentation on configuration for SSL servers.
-
-v2.1.9 (Jan Wolter - Jul 7, 2000)
-----------------------------------
- * Correct documentation to reflect the fact that Solaris *does* have a ps
-   command that displays environment variables.  Thanks to Piotr Klaban
-   <makler@oryl.man.torun.pl> for pointing this out.
-
-v2.1.8 (Jan Wolter - May 3, 2000)
-----------------------------------
- * By default, pass all group names at once to group authenticators.  To get
-   old one-group-at-a-time behavior back, use the new directive
-   "AuthExternalGroupsAtOnce off".  This modification contributed by
-   Rudi Heitbaum <rudi@darx.com>.  Thanks.
-
-v2.1.7 (Jan Wolter - Apr 3, 2000)
-----------------------------------
- * Pass COOKIE environment variable to authenticator with cookies from current
-   request.  Is this a good idea?
- * Added rather dubious HP-UX support to pwauth.  Untested.
-
-v2.1.6 (Jan Wolter - Mar 23, 2000)
-----------------------------------
- * Added documentation about installing as a dynamically loaded module.
- * Added documentation about "AddModule" command for RedHat installs.
- * Lots of other small documentation improvements.
-
-v2.1.5 (Jan Wolter - Jan  6, 2000)
-----------------------------------
- * Improved documentation on writing authenticators.
-
-v2.1.4 (Jan Wolter - Jan  4, 2000)
-----------------------------------
- * Oops, PAM support in v2.1.3 didn't work after all.  Many fixes, including
-   Work-around for Solaris 2.6 appdata_ptr=NULL bug.  Huge thanks again to
-   Peter Arnold <PJArnold@uq.net.au> for help with testing.
- * Generate compile-time error if Apache version is older than 1.3.1
- * Better code to get lastlog path for pwauth.
-
-v2.1.3 (Jan Wolter - Dec 17, 1999)
-----------------------------------
- * AuthExternalAuthoritative directive added.  This code contributed by Mike
-   Burns (burns@cac.psu.edu).
- * Testing of PAM support in pwauth under Solaris 2.6 by Peter Arnold
-   <PJArnold@uq.net.au>.
- * Many clarifications to install manual and other documentation.
-
-v2.1.2 beta (Jan Wolter - Jun 28, 1999)
-----------------------------------
-PAM support and minor bug fixes.  PAM support in pwauth is based on code
-contributed by Karyl Stein (xenon313@arbornet.org).  Not been fully tested.
-
-v2.1.1 (Jan Wolter - Mar 10, 1999)
-----------------------------------
-Various small enhancements making better use of Apache API.
-
- * Better memory management, eliminating all use of fixed sized arrays.
- * Child process calls ap_cleanup_for_exec() to close any resources (file
-   descriptors, etc) left open in the pools.
- * Cleanup of error messages.
-
-
-v2.1.0 (Jan Wolter - Mar 5, 1999)
----------------------------------
-Significant rewrite, rolling in changes from various divergent versions
-and a number of bug fixes, and small enhancements. Changes include:
-
- * Better checking against overflow of various fixed sized arrays.  (There was
-   already some protection, so there probably wasn't a big security problem
-   here.)
- * Set environment variables in child process, not parent process.  This
-   prevents them from being inherited by future spawned children.
- * Check WIFEXITED before acceping WEXITSTATUS.
- * Elimination of memory leak in strdup() calls.
- * Check return code from pipe().
- * Don't close standard output on child process, instead direct it to error
-   log file, just like stderr.
- * Don't use system() calls.  Instead do direct execl() for faster launch
-   and better security.
- * In pipe method, the "user=" and "pass=" tags are no longer given on the
-   login and password line.
- * Pipe method is supported for group authenticators as well as user
-   authenticators.
- * ip-address and host-name are made available to authenticator in IP and HOST
-   environment variables.
- * Updated and expanded comments up front.
-
-
-v2.0.1 (Tyler Allison)
-----------------------
-I received a patch update to mod_auth_external v2.0 that supposedly fixes some
-pipe related bugs.  I do not have a program that uses pipes so I can not test
-it myself. I have included the original v2.0 with no patch applied that you
-should use if you run into problems and you DO NOT need pipe support.
diff --git a/CONTRIBUTORS b/CONTRIBUTORS
deleted file mode 100644
index 1bdec85..0000000
--- a/CONTRIBUTORS
+++ /dev/null
@@ -1,52 +0,0 @@
-
-mod_authnz_external is based on code from the following sources:
-------------------------------------------------------------------
-
- * Original author: Nathan Neulinger (nneul@umr.edu)
- * Based on code from The Apache Group
-
- * Previous maintainers:
- --------------------------------------------------
-	Tyler Allison		(allison@nas.nasa.gov)
-	Jan Wolter		(unixpapa.com)
-
- * Past contributors (from CHANGES):
- --------------------------------------------------
-	Various unnamed contributors
-	Karyl Stein		(xenon313@arbornet.org)
-	Peter Arnold		(PJArnold@uq.net.au)
-	Mike Burns		(burns@cac.psu.edu)
-	Rudi Heitbaum		(rudi@darx.com)
-	Piotr Klaban		(makler@oryl.man.torun.pl)
-	Bradley S. Huffman	(hip@a.cs.okstate.edu)
-	Niall Daley		(niall@neoworks.com)
-	Charles Clancy		(mgrtcc@cs.rose-hulman.edu)
-	Matthew Kirkwood	(matthew@dev.sportingbet.com)
-	Phil Benchoff		(benchoff@vt.edu)
-	Dan Thibadeau		(dan_thibadeau@hp.com)
-	Jeroen Roodnat		(jroodnat@xs4all.nl)
-	Mathieu Legare		(legare@uqtr.ca)
-	Anders Nordby		(anders@fix.no)
-	Sven Koch		(haegar@sdinet.de)
-	Dave Woolaway		(dave@watersheep.org)
-	Joshua PolterocK	(joshuap@sdsc.edu)
-	Steve Horan		(sjh-mae@horan.net.au)
-	Peter Eggimann		(egp@zhwin.ch)
-	Guenter Knauf		(gk@gknw.de)
-	Olivier Thauvin		(nanardon at mandriva dot org)
-	Peter Crawshaw		(pcrawshaw@mta.ca)
-	Stefan Mehlhorn
-	Andreas Ntaflos
-	Hai Zaar
-	David Homborg
-	Claus Andersen
-	ddarbyson
-	Guoan Hu
-	davidsansome
-	cjwatson
-	Vijay
-	dcb314
-	Michal Pokorny		(agentydragon@gmail.com)
-	klemens/ka7
-	Josef Liska		(josef.liska@virtualmaster.com)
-	Micah Andersen/Baptist International Missions, Inc. (micah@bimi.org)
diff --git a/INSTALL b/INSTALL
deleted file mode 100644
index 9a93790..0000000
--- a/INSTALL
+++ /dev/null
@@ -1,699 +0,0 @@
-                How To Install mod_authnz_external.c
-		           Version 3.3.x
-
-NOTES:
-
- * If you want to use the HARDCODE function option follow the instructions
-   in the INSTALL.HARDCODE file in this directory before following these
-   instructions.
-
- * These instructions are for Apache version 2.4.  This version of
-   mod_authnz_external will not work with older versions of Apache.
-   Other versions are available for different releases of Apache:
-
-     Apache 1.3   mod_auth_external-2.1.x
-     Apache 2.0   mod_auth_external-2.2.x
-     Apache 2.2   mod_authnz_external-3.1.x or mod_authnz_external-3.2.x
-     Apache 2.4   mod_authnz_external-3.3.x
-
-   You can check your apache version by running it from the command line
-   with the -v flag.
-
- * If you are upgrading from mod_auth_external to mod_authnz_external,
-   read the UPGRADE file.
-
- * Starting with version 3.2.x, mod_authnz_external is designed to work
-   on any platform supported by Apache.  Previous versions were Unix-only.
-   So mod_authnz_external might work on Windows, but the author doesn't
-   really do Windows development and doesn't even own a Windows C compiler.
-   So it has not been tested at all, no pre-compiled Windows code is available,
-   and there are no installation instructions for non-Unix platforms.  If
-   you figure any of this out, please consider contributing your findings.
-
- * Originally, mod_auth_external was a stand-alone module.  However a new
-   authentication module structure was introduced in Apache-2.1, where
-   mod_auth_basic and mod_auth_digest are the only top-level authentication
-   modules.  All other authentication modules simply provide authentication
-   services to these modules, and have names starting with "mod_authn_" for
-   authentication modules, or "mod_authz_" for access control modules, or
-   "mod_authnz_" for modules that provide both services.  Mod_Authnz_External
-   is designed to fit into this new structure.  It has essentially the same
-   features as mod_auth_external, but there are differences in the
-   configuration commands.  It should be noted that it is still possible to
-   use older-style independent authentication modules in Apache 2.2, and
-   mod_auth_external-2.2.x can be made to work with only a little difficulty
-   arising from mod_auth_basic's reluctance to be turned off.  See the
-   mod_auth_external INSTALL document for information on using it with
-   Apache 2.2
-
- * Do not, however, install both mod_auth_external and mod_authnz_external
-   in your httpd.  I don't know what exactly would happen, but it won't be
-   good.
-
- * There are two ways of installing mod_authnz_external on a Unix system. 
-
-     (1) You can statically link it with Apache.  This requires rebuilding
-	 Apache in such a way that mod_authnz_external will be compiled in. 
-         Nobody does this anymore.
-
-     (2) You can make mod_authnz_external a dynamically loaded module.  If
-	 your Apache has been built to support dynamically loaded modules
-	 you can do this without rebuilding Apache, so it is pretty easy.
-	 Performance may be slightly worse with this option.  For information
-	 on dynamically loaded modules see http://www.apache.org/docs/dso.html
-
-   Instructions for both options are given here.  The dynamic loading
-   option will probably be preferred on virtually all modern installations.
-
- * There is also documentation in the README file and in the AUTHENTICATORS
-   file.  If you find this document unclear, reading those may help.
-
-
-INSTALL METHOD A: Dynamically Linking Mod_auth_external using apxs:
--------------------------------------------------------------------
-
-Step 1:
-	Ensure that your Apache server is configured to handle dynamically
-	loaded modules.  To check this, run Apache server with the -l command
-	flag, like
-
-	       httpd -l
-
-	If mod_so.c is one of the compiled-in modules, then you are ready
-	to go.  Note that some installations may give the http daemon different
-	names, like 'apache' or 'httpd2'.  Some may have multiple copies of
-	apache sitting in different directories.  Be sure you looking at the
-	one that is being run.
-
-Step 2:
-	Compile the module using the following command in the
-	mod_authnz_external distribution directory:
-
-		apxs -c mod_authnz_external.c
-
-	'Apxs' is the Apache extension tool.  It is part of the standard
-	Apache distribution.  If you don't have it, then there may be a
-	Apache development package that needs to be installed on your system,
-	or your Apache server may not be set up for handling dynamically
-	loaded modules.  Some systems rename it weirdly, like 'apxs2' in
-	some openSUSE distributions.
-
-	Apxs should create a file named 'mod_authnz_external.so'.
-
-	AIX Note:  For Apache 1.3 on AIX the 'apxs' command compiled
-	   mod_authnz_external.c into mod_authnz_external.o correctly, but
-	   generation of the shared library file failed with a message like
-	   "No csects or exported symbols have been saved."  We don't know
-	   if this still happens with Apache 2.0.  If it does happen, the
-	   fix under Apache 1.3 was to create a file in the current
-	   directory named mod_authnz_external.exp which contained the two
-	   lines below:
-
-		 #! mod_authnz_external.o
-		 authnz_external_module 
-
-	   Then run 
-	    
-		apxs -c mod_authnz_external.c -bE:mod_authnz_external.exp
- 
-Step 3:
-	Install the module.  Apxs can do this for you too.  Do the following
-	command (as root so you can write to Apache's directories and config
-	files):
-
-	       apxs -i -a mod_authnz_external.la
-
-	This will create mod_authnz_external.so and copy it into the proper
-	place, and add appropriate AddModule and LoadModule commands to the
-	configuration files.  (Actually, it may get the LoadModule command
-	wrong.  See below.)
-
-Step 4:
-	Go to the CONFIGURATION instructions below.
-
-
-INSTALL METHOD B: Statically Linking
-------------------------------------
-
-Step 1:
-	Read the instructions on how to configure the Apache server in the
-	INSTALL file provided with the Apache source.
-
-Step 2:
-	When you run the ./configure script, include an --with-module flag,
-	giving the full pathname to the mod_authnz_external.c file in this
-	distribution.  For example, if you have unpacked this distribution
-	in /usr/local/src/mod_authnz_external and are building Apache for
-	installation in /usr/local/apache, you might do:
-
-    ./configure --prefix=/usr/local/apache \
-      --with-module=aaa:/usr/local/src/mod_authnz_external/mod_authnz_external.c
-
-	This will copy the mod_authnz_external.c file into the correct place in
-	the Apache source tree and set things up to link it in.
-
-Step 3:
-	Type "make" to compile Apache and "make install" to install it.
-
-Step 4:
-	Go to the CONFIGURATION instructions below.
-
-
-CONFIGURATION:
---------------
-
-There are three parts to doing the configuration.  First, if you are using
-dynamic loading, you need to configure Apache to load the mod_authnz_external
-module.  If 'apxs' is working correctly, it should do this for you
-automatically, but it doesn't always.
-
-Second you define the external program and communication method to use in
-your httpd.conf file, identifying them with a keyword.
-
-Finally you set up specific directories to use that authenticator, referencing
-it by keyword.
-
-These instructions talk about editing the "httpd.conf" file, as it appears in
-the standard Apache distributions.  In many version of Linux, however, this
-file will actually just include a lot of other configuration files, some of
-which may be automatically generated by various GUI configuration tools.  I
-include notes on some of these variations that I have encountered, but you
-may need to do some of your own figuring to find out how to adapt these
-instructions to your server configuration.
-
-(1) Configuring Module Loading:
-
-    This step is only required if you are using dynamic loading.  In theory,
-    apxs will have done it for you.  If you are trustful, you can skip ahead
-    to step 2 and only come back to this if things don't seem to be working.
-    In cases where you are using multiple non-authoritative authenticators
-    you'll probably want to check this manually, even if apxs works right, to
-    ensure that the modules are loaded (and thus envoked) in the desired order.
-
-    (a) First, you should make sure that there is a proper "LoadModule"
-	command in the httpd.conf file.  This should have been put there
-	by 'apxs' but, some older Linux distributions, like Redhat 6.1,
-	messed it up.  Basically, the 'LoadModule' command should look a
-	lot like all the other LoadModule commands.  Something like
-
-	    LoadModule authnz_external_module modules/mod_authnz_external.so
-
-	where the second part is the path from Apache's root directory
-	to the location where the module was stored by apxs.
-
-	Make sure that apxs didn't put this directive inside any inappropriate
-	<IfDefine> directives, as some Redhat versions have done in the past.
-
-	If you previously had mod_authnz_external or mod_auth_external
-	installed and are installing a new version, you may have more than
-	one LoadModule command into httpd.conf.  You only need one.  Get rid
-	of the old ones.
-
-    (b) Check you httpd.conf file to see if there is a "ClearModuleList"
-	command.  If this exists, then you need to add a command like:
-
-	    AddModule mod_authnz_external.c
-
-	somewhere below "ClearModuleList" command (probably somewhere among
-	the dozens of other AddModule commands).  If you used 'apxs' to
-	install mod_authnz_external, then this should already be done, but
-	it may again be stashed in an inappropriate <IfDefine>.
-
-	The standard Apache configuration files don't have a "ClearModuleList"
-	command and don't need an "AddModule" command.  However the standard
-	RedHat configuration files, among others, do.
-
-(2) Configurating the External Authenticator
-
-    In this section we insert commands into httpd.conf that will be run when
-    Apache starts up to tell Apache where your external authenticators are
-    and how to communicate with them.
-
-    It is possible to configure several different external authenticators
-    into Apache.  For each one you need to configure a name, a method
-    of communicating with authenticator, and the location of the
-    authenticator.
-
-    The structure of Apache httpd.conf differs widely on different systems.
-    The notes below on where to put configuration commands assume that you
-    have something close to a straight apache install, but you probably
-    don't.  Very likely there will be comments in your httpd.conf file that
-    tell you where to put local configuration.
-
-    If you are using virtual hosts, put these commands at the end of the
-    appropriate <VirtualHost> block.  The declarations must be *inside*
-    the <VirtualHost> block to work for a virtual host.  They are not
-    inherited from the primary host to the virtual hosts.  Note that most
-    Apache SSL servers are set up as virtual hosts, so you'll probably
-    need to put these definitions in the <VirtualHost> block for use with
-    an SSL server.
-
-    Otherwise, just put them anywhere (just before the Virtual Hosts
-    section of the standard Apache config file might make the most sense).
-
-    Two different command syntaxes are supported in mod_authnz_external.
-    One that is compatible with older releases, and one that is a bit
-    more compact, using one command instead of two.
-
-    (a) For External Authentication Programs:
-
-	New-Style Syntax:
-
-	   DefineExternalAuth <keyword> <method> <location>
-
-	Old-Style Syntax:
-
-	   AddExternalAuth <keyword> <location>
-	   SetExternalAuthMethod <keyword> <method>
-
-	<keyword> is some name you choose.  You can configure multiple
-	different external authenticators by using different keywords for them.
-
-	<method> defines how the login and password are passed to the
-	external authenticator.  The only values that do anything are:
-
-	  pipe           read newline-terminated strings from stdin.  (default)
-	  environment    get args from environment variables.
-	  checkpassword  read null-terminated strings from file descriptor 3.
-	  function       internal authenticator called as function.
-
-	Pipe is the default.  Environment used to be the default but it is
-	insecure on some versions of Unix.  See the README file.
-
-	<location> tells where to find the authenticator.  It's syntax varies
-	somewhat by method (which is why we introduced the new syntax - to
-	keep it closer to the method declaration):
-
-	For "pipe", "environment", and "checkpassword" methods:
-
-	    <location> is the full path where you installed your external
-	    authentication program, like "/usr/local/bin/auth_check".
-	    It always starts with a slash.  If you put it in quotes, you
-	    can include command-line arguments, but these arguments won't
-	    be processed by a shell, so you can't use wildcards or I/O
-	    redirects or anything like that.  (If you need shell processing
-	    of arguments, write an sh-script wrapper for your authenticator,
-	    and put the path to that here.)
-
-	For the "function" method:
-
-	    <location> is a string like "<type>:<data>".  The <type> part
-	    is a string that can be used to select from multiple internal
-	    functions.  <data> is a string passed to that function and is
-	    typically used as config file path.  The ":" is required even if
-	    the <data> is an empty string.
-
-	In the old-style syntax, the path declaration should always precede
-	the method declaration, and the method declaration can be omitted if
-	you want the default.
-
-	Here are some examples.  We give old style syntax only for the first
-	example, but it can be used in all cases:
-
-	 * For external authentication programs using a pipe:
-
-	   DefineExternalAuth archive_auth pipe /usr/local/bin/authcheck
-
-	      - or -
-
-	   AddExternalAuth archive_auth /usr/local/bin/authcheck
-	   SetExternalAuthMethod archive_auth pipe
-
-	 * For external authentication programs using environment variables:
-
-	   DefineExternalAuth archive_auth environment /usr/local/bin/authcheck
-
-	 * For external authenticators using the checkpassword protocol:
-
-	   DefineExternalAuth archive_auth checkpassword "/bin/checkpassword /bin/true"
-
-	 * For HARDCODE functions with a configuration file:
-
-	   DefineExternalAuth archive_auth function RADIUS:/usr/local/raddb
-
-	 * For HARDCODE functions with no configuration file:
-
-	   DefineExternalAuth function archive_auth RADIUS:
-
-    (b) For External Group-Checking Programs:
-
-	If you want to use an external program to do group checking, add one
-	of the following to your server's httpd.conf.
-
-	New-Style Syntax:
-
-	    DefineExternalGroup <keyword> <method> <location>
-
-	Old-Style Syntax:
-
-	    AddExternalGroup <keyword> <location>
-	    SetExternalGroupMethod <keyword> <method>
-
-	<keyword> is some name you choose to identify this particular
-	group checking method.  The keywords for login authenticators and
-	group authenticators are separate name spaces, so it doesn't matter
-	if these keywords match any you defined with DefineExternalAuth or
-	AddExternalAuth
-
-	<method> defines how the login and group names are passed to the
-	external authenticator.  Legal values are:
-
-	   pipe - authenticator reads data from standard input.
-	   environment - authenticator gets data from environment variables.
-
-	Pipe is the default.  Environment used to be the default in older
-	versions.  The "checkpassword" keyword also works, but doesn't
-	really make a lot of sense since there are no checkpassword
-	authenticators for groups.
-
-	Examples:
-
-	* For external authentication programs using a pipe:
-
-	  DefineExternalGroup archive_group pipe /usr/local/bin/grpcheck
-
-	     - or -
-
-	  AddExternalGroup archive_group /usr/local/bin/grpcheck
-	  SetExternalGroupMethod archive_group pipe
-
-	* For external group check programs using environment variables:
-
-	  DefineExternalGroup archive_group environment /usr/local/bin/grpcheck
-
-(3) Configuring Web Pages to Use Authentication
-
-    For any directory you want to protect, you need either a .htaccess file
-    in the directory or a <Directory> block for the directory in your
-    httpd.conf file.
-
-    Note that for .htaccess files to work, you must specify "AllowOverride
-    AuthConfig" in the httpd.conf file for any directories they appear
-    under.  As distributed, Apache sets "AllowOverride None" for most
-    directories.  If this is not changed, .htaccess files will be ignored.
-
-    * EXTERNAL PASSWORD CHECKING:
-
-    For normal user authentication, the following directives should be in
-    the .htaccess file or <Directory> block:
-
-	AuthType Basic
-	AuthName <authname>
-	AuthBasicProvider external
-	AuthExternal <keyword>
-	Require valid-user
-
-    Here <authname> identifies what we are authenticating for - it usually
-    appears in the browser's pop-up login window.  <keyword> matches a
-    keyword you defined with DefineExternalAuth or AddExternalAuth in step 2.
-
-    If you only want some users to have access to the directory, as opposed
-    to all valid users, you can list the users on the "require" line,
-    changing it to:
-
-	Require user <username1> <username2> ...
-
-    Or if you want to allow only user's whose login name matches the
-    login name of the unix user who owns the file being accessed, you
-    can say (assuming you have mod_authz_owner installed):
-
-	Require file-owner
-
-    It is possible to list more than one authenticator on the AuthExternal
-    command:
-
-        AuthExternal <keyword1> <keyword2>...
-
-    Here each keyword should match an authenticator defined with the
-    DefineExternalAuth command.  If the first authenticator fails, then
-    the second one will be run, and so on, until either one authenticator
-    accepts the user's login/password combination or all reject it.
-
-    * EXTERNAL GROUP CHECKING:
-
-    If you want to use the external group check program to allow only
-    users in a given group to have access, you could do:
-
-	AuthType Basic
-	AuthName <authname>
-	AuthBasicProvider external
-	AuthExternal <keyword>
-	GroupExternal <groupkeyword>
-	Require external-group <groupname1> <groupname2> ...
-
-    Here <groupkeyword> matches a name you defined with with the 
-    DefineExternalGroup or AddExternalGroup command in step 2.
-
-    Normally if you have multiple group names on your "Require group"
-    command, then the group checker will be run only once, passing it the
-    whole space-separated list of groups.  Some older group checking
-    programs may only be able to handle one group name at a time.  So if
-    you want the group checker to be run once for each group name, you can
-    add the directive:
-
-        GroupExternalManyAtOnce off
-
-    If you have GroupExternalManyAtOnce turned off, then you can have
-    spaces in your group names by enclosing the names in quote marks.
-    If it is on, then all parsing of the group name list is up to your
-    authenticator.
-
-    If, instead of listing group names, you want to allow access only
-    to users whose group name (as determined by whatever group database
-    your external group checker uses) matches the unix group name that
-    owns the file being accessed, you can configure an external group
-    checker and then install mod_authz_owner and do:
-
-        Require external-file-group
-
-    The GroupExternal directive cannot (yet?) be used with multiple external
-    authenticators.
-
-    * USE WITH MOD_AUTHN_SOCACHE
-
-    Mod_authnz_external version 3.3.1 and later can be used with the
-    Apache mod_authn_socache module, which caches authentications. If
-    you do this, then after a successful authentication, mod_socache
-    will remember the user for a settable time (5 minutes by default)
-    and not rerun the external authenticator again to check their password
-    until after the timeout.  This can be a very substantial performance
-    improvement.
-
-    It can also be a very substantial security problem.  One common use of
-    mod_authnz_external is to authenticate from databases that are not readable
-    by Apache, and should not be.  For example, if you are authenticating out
-    of the a unix password file with pwauth, you don't want make the password
-    file readable to Apache because then an Apache bug would risk exposing
-    your entire password file to the net. But if you turn on caching with
-    mod_authn_socache, then the cache it builds up is essentially an
-    Apache-readable copy of the most sensitive data from your password file.
-    With some settings, it may even be stored on disk rather than on memory.
-    The only good thing you can say for it is that all the passwords in that
-    cache will be encrypted (even if you are dopey enough not to encrypt them
-    in your actual password database). But encryption is a pretty weak
-    defense all by itself.
-
-    So using mod_authnz_external with mod_authn_socache might be dumb, but,
-    what the heck, when have we passed up a chance to give you more rope to
-    hang yourself with?
-
-    One note: normally when you use mod_authn_socache with one of the standard
-    Apache modules, a cache entry is created everytime it looks up a user's
-    password in the database, even if the password they submitted wasn't
-    the correct one.  With mod_authnz_external it only happens after
-    successful authentications. That's because mod_authnz_external doesn't
-    have direct access to the password database. After a successful
-    authentication we can fake-up something that looks to mod_authn_socache
-    like some credentials out of a database by simple encrypting the password
-    that the user sent us and pretending we got that out of a database. This
-    means we don't get quite the performance gains that mod_authn_socache
-    would give with something like mod_authn_dbd, but we get pretty close.
-
-    So here's how you do it. First you AuthBasicProvider statement should
-    list both 'socache' and 'external', and it's important that 'socache'
-    should be listed first, so that it tries to look up users in the cache
-    before mod_authnz_external runs the authenticator:
-
-       AuthBasicProvider socache external
-
-    Then you need to tell mod_authnz_external to start forging credentials
-    for mod_authn_socache:
-
-       AuthExternalProvideCache On
-
-    And you need to tell mod_authn_socache to accept credentials from
-    mod_authnz_external:
-
-       AuthnCacheProvideFor external
-
-    And that should do it. You should see many fewer runs of the external
-    authenticator, and perhaps a slight decline in your overall security.
-
-    * PASSING CONTEXT INFORMATION INTO AUTHENTICATORS:
-
-    If you want the authentication to work slightly differently in
-    different directories, then you can add a directive like:
-
-        AuthExternalContext <context>
-
-    This will simply pass whatever <context> string was given to the
-    authenticator in an environment variable called CONTEXT.  The
-    authenticator can use that to modify it's behavior.
-
-    * MODIFYING ERROR CODES FOR GROUP CHECKING:
-
-    Normally, if a group authentication fails, then apache will return a
-    401 error, which will normally cause the browser to pop up a fresh
-    login box so the user can try logging in with a different ID.  This
-    may not always be appropriate.  If you rejected him because he has a
-    blocked IP address, returning a 403 error, which displays an error
-    page (which you can configure) may be a better choice than asking him
-    to endlessly try new logins and passwords.
-
-    Previous versions of mod_authnz_external had a 'GroupExternalError'
-    directive that allowed you to change this. This no longer exists
-    Under Apache 2.4 you can control the return code using the
-    'AuthzSendForbiddenOnFailure' directive.
-
-    * USING GROUP CHECKING INDEPENDENT OF USER CHECKING:
-
-    Normally, the group authorization process checks that a user was 
-    successfully authenticated by the user authentication module before 
-    actually running the external group checking program.  This may be 
-    undesirable if your goal is to use mod_authz_external on its own as 
-    a group checker, without any user checking. You can use the 
-    following directive in your Apache config to disable the user 
-    authentication check:
-    
-    GroupExternalAuthNCheck Off
-    
-
-    * INTERACTIONS WITH OTHER AUTHENTICATORS:
-
-    Previous versions of mod_authnz_external had 'GroupExternalAuthoritative'
-    directive. In Apache 2.4, the notion of authoritativeness is
-    thankfully almost entirely gone, so this directive is too.
-    
-    * OLD DIRECTIVES
-
-    Some of the directives mentioned above used to have different names.
-    One old name still works for backward compatibility.
-
-	AuthExternalGroupsAtOnce      equals   GroupExternalManyAtOnce
-
-(4) Install the Authenticator
-
-    Install your external authentication program in the location named
-    by the pathname on your AddExternalAuth directive.
-
-    Make sure everything is permitted so that whatever account the httpd
-    runs under can execute the authenticator.  Typically this requires
-    'execute' access to the script and all the directories above it.  If
-    it is a script, then read access to the script will also be needed.  
-
-    If your script is an set-uid script, then make sure the file is owned
-    by the user it is supposed to run as, and that the suid-bit is set.
-
-(5) Restart Apache
-
-    Restart Apache, so that all the new configuration commands will be
-    loaded.  If you have the apachectl command do:
-
-	apachectl restart
-
-    For some systems which doesn't have apachectl, you'll want to manually
-    run the startup script for apache.  The locations of these vary somewhat
-    in different Unix systems, but they typically are something like this:
-
-	/etc/init.d/httpd restart
-
-(6) Test It
-
-    Test your changes/code by trying to view a protected page.
-    
-    If it doesn't work, check the apache error logs.  They are loaded
-    with helpful information.  Some common problems and their usual causes:
-
-      - Miscellaneous odd behaviors.
-
-	Did you restart the httpd after the last time you edited the
-	httpd.conf file or recompiled Apache?  Confirm that an
-	"Apache configured -- resuming normal operations" message appeared
-	in the error log when you restarted.
-
-      - Apache complains about not recognizing mod_authnz_external commands
-        in the httpd.conf file like "DefineExternalAuth" and "AddExternalAuth".
-
-	Either the module didn't get installed (if you statically linked
-	the module, are you running the newly compiled copy of httpd?),
-	or it isn't enabled (if it is dynamically linked, the AddModule
-	LoadModule commands described above in step (1) may be missing,
-	incorrect, or commented out by an inappropriate <IfDefine>).
-	Sometimes I've found that the httpd.conf file I've been editing is
-	not actually the one being used by the copy of Apache that is
-	running.  Sometimes I test this by inserting deliberately invalid
-	commands and checking to see if error messages are generated when
-	Apache is restarted. We leave the choice of invalid command words
-        to be used to your imagination.
-
-      - It displays pages in a protected directory without asking for
-	a login and password.
-
-	For some reason Apache is not seeing the directory configuration
-	commands that set up authentication for that directory.  If you
-	are using .htaccess files, does your httpd.conf file say
-	"AllowOverride AuthConfig" for the directory?  Apache is usually
-	distributed with "AllowOverride None" set, which will cause
-	.htaccess files to be quietly ignored.
-
-      - All logins are rejected, and the error log says it cannot execute the
-        authentication module.  Error messages might look like:
-	
-	    exec of '/foo/bar/authcheck' failed: (2) No such file or directory
-	    [Thu Nov 15 12:26:43 2007] [error] AuthExtern authcheck
-	       [/foo/bar/authcheck]: Failed (-1) for user foo
-            [Thu Nov 15 12:26:43 2007] [error] user foo: authentication
-	       failure for /mae/index.html": Password Mismatch
-
-	The first of these three messages is from Apache's process launching
-	library, and gives the clearest information about what caused the
-	error.  Typically it will be either "No such file", which means that
-	the pathname you specified for the authenticator in step (2) does
-	not match the actual location of your external authenticator, or
-	it will be "permission denied", indicating that either the file
-	or one of the directories above it is permitted so whatever account
-	apache is configured to run as does not have execute permission.
-	If it's a script, it also needs read opinion.
-
-	The second error message is actually generated by mod_auth_external.
-	It just says authentication failed for the user.  Normally it would
-	give the status code returned by the authenticator in parenthesis,
-	but if the authenticator could not be executed it will show a
-	phoney status code of -1 (which some systems display as 255).
-
-	The third error message is from Apache.  Don't be mislead by it's
-	saying "Password Mismatch".  When mod_auth_external fails, it
-	rejects all access attempts.  To apache this looks like a
-	Password Mismatch.
-	
-      - Authentications failed and the message in the error log says it
-        failed with a status code of -2 or 254, for example:
-
-	    [Thu Nov 15 12:26:43 2007] [error] AuthExtern authcheck
-	       [/foo/bar/authcheck]: Failed (-2) for user foo
-            [Thu Nov 15 12:26:43 2007] [error] user foo: authentication
-	       failure for /mae/index.html": Password Mismatch
-
-        A status code of -2 (or 254) indicates that the authenticator
-        crashed or was killed before it could return a status code.  This
-	could either be because some other process sent it a signal to
-	terminate it, or it crashed due to some kind internal error in
-	the code, causing a segmentation fault or some other similar
-	crash.
-
-      - Error log says "Failed (X) for user foo" with X being some number
-        other than -1, -2, 255 or 254.
-      
-	The authenticator ran, and exited with the given non-zero return
-	code.  You'll have to check the authenticator to see under what
-	conditions it exits with that return code.
diff --git a/INSTALL.HARDCODE b/INSTALL.HARDCODE
deleted file mode 100644
index bce9623..0000000
--- a/INSTALL.HARDCODE
+++ /dev/null
@@ -1,76 +0,0 @@
-If you want to use mod_authnz_external.c with a hardcoded internal function,
-then you first have to hardcode an internal function (who wudda thunk?).
------------------------------------------------------------------------------
-
-Step 1:
-	Edit "mod_authnz_external.c"
-
-Step 2:
-	Uncomment the _HARDCODE_ #define.
-
-Step 3:
-	Uncomment the line:
-              /* #include "your_function_here.c" */
-	Replace "your_function_here.c" with the path/name of your function.
-
-	(Actually, I think it might be better to imbed the function itself
-	directly in this file instead of including it.  Modules work better
-	if they are implemented in a single source file.)
-
-	Your function should start something like:
-
-	  int
-	  function_name (char *user_name,char *user_passwd,char *config_path)
-
-	It should return 0 if the password is correct for the given user,
-	and other values if it is not, pretty much just like external
-	authentication programs do.
-
-	You'll want to code this very carefully.  A crash will crash not just
-	your program but the entire httpd.
-
-	** BIG NOTE TO PROGRAMMERS **
-	-DO NOT- use exit() or other such calls that will cause your
-	function to exit abnormally or dump core. It will take the entire 
-	httpd with it and display a message to your browser saying "no data". 
-	Use "return" instead of exit().
-
-Step 4:
-	Choose a <function name> for your function. ie: 'RADIUS' or 'SYBASE'
-	This will be used for telling mod_authnz_external which hard coded
-	function you want to call.
-
-Step 5:
-	Find the exec_hardcode() function inside mod_authnz_external.c.
-	Find the big commented section there.  Replace the example call
-	to example() with a call to your function.  Also change the name
-	"EXAMPLE" to the name you chose for your function.
-
-	The function call in exec_hardcode() should look something like:
-
-        if (strcmp(check_type,"<function name>")==0) {
-            code = function_name(c->user,sent_pw,config_file);
-        }
-
-	Here, we replace "<function_name>" with the name you chose in step 4.
-	function_name(), of course, should be whatever you called your function
-	in step 3.
-
-Step 6:
-	Save your work.  Also save some whales.
-
-Step 7:
-	Compile and configure mod_authnz_external as described in the
-	INSTALL file.
-
-	The AddExternalAuth command in your httpd.conf file might look
-	something like
-
-	    AddExternalAuth whatever EXAMPLE:/usr/local/data/configfile
-
-	Here 'whatever' is the name you will use to invoke this authenticator
-	in the AuthExternal commands in your .htaccess files.  'EXAMPLE'
-	is the name you choose in step 4 and inserted into the "if" statement
-	in step 5.  Any data after the colon will be passed into your function.
-	It might be a config file path or something else.
-
diff --git a/Makefile b/Makefile
index ec2ab2d..615ae31 100644
--- a/Makefile
+++ b/Makefile
@@ -5,22 +5,34 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev dupload
+
+debian-package-version:
+	dch -v $(version)
+
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
+
+debsign:
+	debsign libapache2-mod-authnz-external_$(version)_amd64.changes
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+dupload:
+	dupload --to debian-mentors
diff --git a/UPGRADE b/UPGRADE
deleted file mode 100644
index 253ca8c..0000000
--- a/UPGRADE
+++ /dev/null
@@ -1,115 +0,0 @@
-How to upgrade from mod_auth_external to mod_authnz_external:
-
-(0)  Read the section entitled "Authn / Authz" in the README file.  This will
-     probably make understanding this new version of the module easier.
-
-(1)  Make sure mod_auth_external is no longer being loaded.  You cannot load
-     both mod_auth_external and mod_authnz_external without problems.  This
-     means ensuring that there is no "LoadModule" or "AddModule" line for
-     mod_auth_external.  You could also remove the mod_auth_external.so file
-     from the Apache 'modules' directory.
-
-(2)  Install mod_authnz_external as described in the INSTALL file.
-
-(3)  The server-level configuration directives in the httpd.conf file are the
-     same as before.  There has been no change to the way "AddExternalAuth",
-     "AddExternalGroup", "AddExternalAuthMethod", and "AddExternalGroupMethod"
-     work.
-
-(4)  In the per-directory configurations (either in .htaccess files or in a
-     <Directory> block in httpd.conf) need to include a new directive to tell
-     mod_auth_basic to use mod_authnz_external for authentication.  For
-     mod_auth_external, the per-directory configurations normally looked
-     something this:
-
-	AuthType Basic
-        AuthName <authname>
-        AuthExternal <keyword>
-	require valid-user
-
-     For mod_authnz_external, you need to add the "AuthBasicProvider" directive.
-
-	AuthType Basic
-        AuthName <authname>
-	AuthBasicProvider external
-        AuthExternal <keyword>
-	require valid-user
-
-     The directive "AuthType Basic" tells apache that you want to use the
-     mod_auth_basic module to do "basic authentiation".  The directive
-     "AuthBasicProvider external" tells mod_auth_basic to use
-     mod_authnz_external to check the correctness of passwords.
-
-     Note that the "AuthBasicProvider" directive is only needed if you are
-     using mod_authnz_external for password checking.  If you are using it
-     only for group checking, then this is not needed.
-
-(5)  If you were using mod_auth_external in a non-authoritative mode, then
-     your per-directory configuration probably included the directive:
-
-        AuthExternalAuthoritative off
-
-     This command will no longer work.  If upgrading to Apache 2.2, you
-     should use one or both of the following commands:
-
-        AuthBasicAuthoritative off
-        GroupExternalAuthoritative off
-
-     The "AuthBasicAuthoritative" directive effects password checking, which
-     is done through mod_auth_basic.
-
-     The "GroupExternalAuthoritative" effects only group checking.  That is
-     if you had both "GroupExternal" directive setting up an external program
-     for group checking, and an "AuthGroupFile" directive setting up a group
-     file, then it would control whether the first module to process a
-     "Require group admin" directive was the only one to run, or whether each
-     group checker was given a chance to decide if the user was in that group
-     based on it's group database.
-
-     In Apache 2.4, all of this is handled quite differently. I need to
-     document this.
-
-(6)  If you were using multiple Require directives, the behavior may change
-     under Apache 2.2.  Suppose you wanted to allow access to user "pete" and
-     members of the group "admins".  You might have do:
-
-        Require group admin
-	Require user pete
-
-     Under Apache 2.0, both of these directives would have been checked by
-     mod_auth_external, and it would have correctly allowed access if either
-     of the two conditions were satisfied.  In Apache 2.2, however, only
-     "Require group" and "Require file-group" directives are checked by
-     mod_authnz_external.  "Require user" and "Require valid-user" are checked
-     by mod_authz_user, a standard module that comes with Apache.  How the
-     two directives interact depends on whether they are authoritative or
-     not.  mod_authz_user is Authoritative by default, so to get the old
-     behavior, you will need to do
-
-        GroupUserAuthoritative off
-
-     Again, in Apache 2.4, all of this is handled quite differently, and this
-     document needs updating.
-
-(7)  Note that a new type of functionality is available under Apache 2.2 with
-     mod_authnz_external.  Thanks to mod_authz_owner, you can now do:
-
-         Require file-owner
-     or
-         Require file-group
-
-     The first checks if the name of the authenticated user matches the
-     name of the unix account that owns the file.  The second checks if,
-     according to whatever group database has been configured for the 
-     current directory, the currently authenticated user is in a group
-     with the same name as the Unix group that owns the file.
-     
-     Normally these are rather strange directives, because normally unix
-     accounts have no relationship to accounts in whatever database is
-     being used for http authentication, but for people using 'pwauth'
-     with mod_authnz_external, these really check if the user has been
-     authenticated as the unix user who owns the file.
-
-     In Apache 2.4, this is the same, except the latter of the two becomes:
-
-         Require external-file-group
diff --git a/debian/README.Debian b/debian/README.Debian
new file mode 100644
index 0000000..f757caa
--- /dev/null
+++ b/debian/README.Debian
@@ -0,0 +1,28 @@
+# mod-authnz-external
+
+For more information, see these links:
+AUTHENTICATORS
+README
+INSTALL
+UPGRADE
+https://github.com/phokz/mod-auth-external
+
+Older links:
+http://blog.innerewut.de/2007/6/26/apache-2-2-authentication-with-mod_authnz_external
+http://www.unixpapa.com/mod_auth_external
+http://code.google.com/p/mod-auth-external
+
+## Compatibility with pwauth
+
+This package can be used with pwauth to provide secure auth against PAM without
+exposing /etc/shadow file.
+
+To use it with pwauth on Debian, make sure to also install pwauth package (separate)
+then add these lines to relevant Location or Directory section:
+    AuthBasicProvider external
+    AuthExternal pwauth
+
+And to the related virtual host section:
+   AddExternalAuth pwauth /usr/sbin/pwauth
+   SetExternalAuthMethod pwauth pipe
+
diff --git a/debian/changelog b/debian/changelog
new file mode 100644
index 0000000..cf7de7e
--- /dev/null
+++ b/debian/changelog
@@ -0,0 +1,48 @@
+libapache2-mod-authnz-external (3.3.3) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * NEW source: https://github.com/phokz/mod-auth-external
+  * package for latest version (July 22, 2019)
+
+ -- carrvo <carrvo@gmail.com>  Thu, 06 Mar 2025 19:16:48 -0700
+
+libapache2-mod-authnz-external (3.3.2-3) unstable; urgency=medium
+
+  * QA upload.
+
+  * Added d/gbp.conf to describe branch layout.
+  * Updated vcs in d/control to Salsa.
+  * Updated d/gbp.conf to enforce the use of pristine-tar.
+  * Updated Standards-Version from 4.6.1 to 4.7.0.
+  * Use wrap-and-sort -at for debian control files.
+  * Trim trailing whitespace.
+  * Drop fields with obsolete URLs.
+  * Fix day-of-week for changelog entry 3.2.4-1.
+
+ -- Petter Reinholdtsen <pere@debian.org>  Sat, 30 Nov 2024 11:00:39 +0100
+
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
+
+  * QA upload.
+  * Make package reproducible by stop embedding the build path in 
+    compiled files.
+  * Bump Standards-Version to 4.6.1.
+
+ -- Philip Rinn <rinni@debian.org>  Fri, 11 Nov 2022 22:49:32 +0100
+
+libapache2-mod-authnz-external (3.3.2-1) unstable; urgency=medium
+
+  * QA upload.
+  * Set maintainer to Debian QA Group <packages@qa.debian.org>. (see: #673655)
+
+ -- Marcos Talau <talau@debian.org>  Wed, 09 Nov 2022 14:11:13 -0300
+
+libapache2-mod-authnz-external (3.3.2-0.2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Use "dh". (Closes: #999218)
+
+ -- Christoph Berg <myon@debian.org>  Fri, 07 Jan 2022 15:02:32 +0100
+
+# Older entries have been removed from this changelog.
+# To read the complete changelog use `apt changelog libapache2-mod-authnz-external`.
diff --git a/debian/control b/debian/control
new file mode 100644
index 0000000..81acd39
--- /dev/null
+++ b/debian/control
@@ -0,0 +1,32 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Uploaders: carrvo <carrvo@gmail.com>
+Section: httpd
+Priority: optional
+Standards-Version: 4.6.2
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Homepage: https://github.com/phokz/mod-auth-external
+Vcs-Browser: https://github.com/phokz/mod-auth-external
+Vcs-Git: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
+Architecture: amd64
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: pwauth
+Homepage: https://github.com/carrvo/debian-libapache2-mod-authnz-external
+Description: authenticate Apache against external authentication services
+ Mod_Authnz_External can be used to quickly construct secure, reliable
+ authentication systems.  It can also be mis-used to quickly open gaping
+ holes in your security.  Read the documentation, and use with extreme
+ caution.
+ .
+ Notably, this module can be used to securely authenticate against PAM
+ (without exposing /etc/shadow file), using, for example, pwauth
+ authenticator.
+ .
+ This Package includes the mod-authnz-external Module for Apache Version 2.x
diff --git a/debian/copyright b/debian/copyright
new file mode 100644
index 0000000..a547360
--- /dev/null
+++ b/debian/copyright
@@ -0,0 +1,74 @@
+Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Source: https://github.com/phokz/mod-auth-external
+Upstream-Name: mod-auth-external
+Upstream-Contact: Josef Liška <josef.liska@virtualmaster.com>
+
+Files:
+ *
+Copyright: 1995 The Apache Group
+License: Apache
+    Copyright (c) 1995 The Apache Group.  All rights reserved.
+    .
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions
+    are met:
+    .
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    .
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in
+       the documentation and/or other materials provided with the
+       distribution.
+    .
+    3. All advertising materials mentioning features or use of this
+       software must display the following acknowledgment:
+       "This product includes software developed by the Apache Group
+       for use in the Apache HTTP server project (http://www.apache.org/)."
+    .
+    4. The names "Apache Server" and "Apache Group" must not be used to
+       endorse or promote products derived from this software without
+       prior written permission.
+    .
+    5. Redistributions of any form whatsoever must retain the following
+       acknowledgment:
+       "This product includes software developed by the Apache Group
+       for use in the Apache HTTP server project (http://www.apache.org/)."
+    .
+    THIS SOFTWARE IS PROVIDED BY THE APACHE GROUP ``AS IS'' AND ANY
+    EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+    IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+    PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE APACHE GROUP OR
+    IT'S CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+    SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+    NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+    LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+    STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE  OF THIS SOFTWARE, EVEN IF ADVISED
+    OF THE POSSIBILITY OF SUCH DAMAGE.
+Comment:
+    This package was debianized for Ubuntu by Chuck Short <zulcss@ubuntu.com> on
+    Tue, 08 Jan 2008 10:20:36 -0500.
+    This package was debianized for Debian by Hai Zaar <haizaar@haizaar.com> on
+    Tue, 31 Mar 2009 18:32:20 +0300 based on the work mentioned above.
+    .
+    It was downloaded from https://github.com/phokz/mod-auth-external
+    .
+    Upstream Authors:
+    .
+    Josef Liška      <josef.liska@virtualmaster.com>
+    Micah Andersen   <micah@bimi.org>
+    Rai              <agentydragon@gmail.com>
+    joakim-tjernlund
+    .
+    It was originally located at http://code.google.com/p/mod-auth-external
+    .
+    Original Authors:
+    .
+    Nathan Neulinger <nneul@umr.edu>
+    Tyler Allison    <allison@nas.nasa.gov>
+    Dave Woolaway    <dave@watersheep.org>
+    Sven Koch        <haegar@sdinet.de>
+    Jan Wolter       <jan@unixpapa.com>
+
diff --git a/debian/docs b/debian/docs
new file mode 100644
index 0000000..fc1e1e6
--- /dev/null
+++ b/debian/docs
@@ -0,0 +1,6 @@
+AUTHENTICATORS
+INSTALL
+UPGRADE
+CHANGES
+CONTRIBUTORS
+README
diff --git a/debian/libapache2-mod-authnz-external.apache2 b/debian/libapache2-mod-authnz-external.apache2
new file mode 100644
index 0000000..025e6a6
--- /dev/null
+++ b/debian/libapache2-mod-authnz-external.apache2
@@ -0,0 +1,2 @@
+mod /usr/lib/apache2/modules/mod_authnz_external.so
+mod /etc/apache2/mods-available/authnz_external.load
diff --git a/debian/rules b/debian/rules
new file mode 100755
index 0000000..81e2e0f
--- /dev/null
+++ b/debian/rules
@@ -0,0 +1,3 @@
+#!/usr/bin/make -f
+%:
+	dh $@ --with apache2
diff --git a/debian/source/format b/debian/source/format
new file mode 100644
index 0000000..89ae9db
--- /dev/null
+++ b/debian/source/format
@@ -0,0 +1 @@
+3.0 (native)


Reviews:
user: login: carrvo
body: From https://mentors.debian.net/package/libapache2-mod-authnz-external/
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-07T22:50:20Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-07T23:02:03Z
user: login: bimimicah
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T23:19:35Z
user: login: bimimicah
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T23:20:29Z
user: login: bimimicah
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T23:20:48Z
user: login: bimimicah
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T23:33:53Z
user: login: bimimicah
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T23:38:52Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-07T23:53:51Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T20:38:37Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T20:55:22Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:14:27Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:22:05Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:22:28Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:22:37Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:22:50Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:24:18Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:24:30Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:24:47Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:25:23Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:26:27Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:32:22Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:33:05Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:37:32Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:37:55Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T21:39:57Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T22:04:33Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T22:07:57Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T22:08:31Z
user: login: carrvo
state: COMMENTED
author_association: OWNER
submitted_at: 2025-03-10T22:09:07Z

Review comments:
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
path: debian/control
user: login: carrvo
body: The uploader is not in the package's "Maintainer" or "Uploaders" fields 
created_at: 2025-03-07T22:43:37Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
path: debian/control
user: login: carrvo
body: E [malformed-deb-archive](https://udd.debian.org/lintian-tag/malformed-deb-archive)

    second (official) member control.tar.zst not control.tar.(gz|xz)
    third (official) member data.tar.zst not data.tar.(gz|xz|bz2|lzma)
created_at: 2025-03-07T22:44:57Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
+Architecture: amd64
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+Original-Maintainer: Debian QA Group <packages@qa.debian.org>
+Installed-Size: 59
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: pwauth
+Section: web
path: debian/control
user: login: carrvo
body: I [wrong-section-according-to-package-name](https://udd.debian.org/lintian-tag/wrong-section-according-to-package-name)

    web => httpd
created_at: 2025-03-07T22:45:26Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,67 @@
+This package was debianized for Ubuntu by Chuck Short <zulcss@ubuntu.com> on
+Tue, 08 Jan 2008 10:20:36 -0500.
+This package was debianized for Debian by Hai Zaar <haizaar@haizaar.com> on
+Tue, 31 Mar 2009 18:32:20 +0300 based on the work mentioned above.
+
+It was downloaded from https://github.com/phokz/mod-auth-external
+
+Upstream Authors:
+
+Josef Liška      <josef.liska@virtualmaster.com>
+Micah Andersen   <micah@bimi.org>
+Rai              <agentydragon@gmail.com>
+joakim-tjernlund
+
+It was originally located at http://code.google.com/p/mod-auth-external
path: debian/copyright
user: login: carrvo
body: W [obsolete-url-in-packaging](https://udd.debian.org/lintian-tag/obsolete-url-in-packaging)

    http://code.google.com/p/mod-auth-external [debian/copyright]
created_at: 2025-03-07T22:45:53Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: carrvo
body: W [odd-historical-debian-changelog-version](https://udd.debian.org/lintian-tag/odd-historical-debian-changelog-version)

    3.3.2-2 (for native) [debian/changelog:9]
created_at: 2025-03-07T22:46:10Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
+Architecture: amd64
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+Original-Maintainer: Debian QA Group <packages@qa.debian.org>
+Installed-Size: 59
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: pwauth
+Section: web
+Priority: optional
+Homepage: https://github.com/phokz/mod-auth-external
path: debian/control
user: login: carrvo
body: I [installable-field-mirrors-source](https://udd.debian.org/lintian-tag/installable-field-mirrors-source)

    (in section for libapache2-mod-authnz-external) Homepage [debian/control:24]
    (in section for libapache2-mod-authnz-external) Priority [debian/control:23]
    (in section for libapache2-mod-authnz-external) Recommends [debian/control:21]
    (in section for libapache2-mod-authnz-external) Section [debian/control:22]
created_at: 2025-03-07T22:46:43Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
path: debian/control
user: login: carrvo
body: I [out-of-date-standards-version](https://udd.debian.org/lintian-tag/out-of-date-standards-version)

    4.7.0 (released 2024-04-07) (current is 4.7.1)
created_at: 2025-03-07T22:46:55Z
author_association: OWNER
path: debian/copyright
user: login: carrvo
body: P [no-dep5-copyright](https://udd.debian.org/lintian-tag/no-dep5-copyright)

    [debian/copyright]
created_at: 2025-03-07T22:47:18Z
author_association: OWNER
path: debian/control
user: login: carrvo
body: P [silent-on-rules-requiring-root](https://udd.debian.org/lintian-tag/silent-on-rules-requiring-root)

    [debian/control]
created_at: 2025-03-07T22:48:20Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
+exposing /etc/shadow file.
+
+To use it on Debian, make sure to also pwauth package then add these lines to
+relevant Location or Directory section:
+    AuthBasicProvider external
+    AuthExternal pwauth
+
+And to the related virtual host section:
+   AddExternalAuth pwauth /usr/sbin/pwauth
+   SetExternalAuthMethod pwauth pipe
+
+See these links for more info:
+README file
+http://blog.innerewut.de/2007/6/26/apache-2-2-authentication-with-mod_authnz_external
+http://www.unixpapa.com/mod_auth_external
+
path: debian/README.Debian
user: login: carrvo
body: P [trailing-whitespace](https://udd.debian.org/lintian-tag/trailing-whitespace)

    [debian/changelog:12]
created_at: 2025-03-07T22:48:44Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
path: debian/control
user: login: carrvo
body:  No VCS field present 
created_at: 2025-03-07T22:49:51Z
author_association: OWNER
diff_hunk: @@ -5,22 +5,28 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev
+
+debian-package-version:
+	dch -v $(version)
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
path: Makefile
user: login: carrvo
body: Ideally elevating with sudo should be replaced with [instructions for debian/rules so that it builds to the appropriate directory](https://wiki.debian.org/Packaging/Intro?action=show&redirect=IntroDebianPackaging#Step_4:_Build_the_package).
created_at: 2025-03-07T23:00:49Z
author_association: OWNER
diff_hunk: @@ -0,0 +1 @@
+3.0 (native)
path: debian/source/format
user: login: carrvo
body: Should figure out how to use [quilt format](https://www.debian.org/doc/manuals/maint-guide/modify.en.html)
created_at: 2025-03-07T23:01:59Z
author_association: OWNER
diff_hunk: @@ -5,22 +5,28 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev
+
+debian-package-version:
+	dch -v $(version)
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
path: Makefile
user: login: bimimicah
body: I'm not sure what debian's packaging typically looks like. On many distros, the mod_authnz_external package tends to be structured like this (I'm thinking specifically of Fedora/RedHat/Oracle/Rocky/etc. using RPM, since that's what I'm most familiar with):

1. [Source repo](https://src.fedoraproject.org/rpms/mod_authnz_external/tree/epel10): contain spec/script files for grabbing the project source from github/other source location, along with distro-specific files such as examples, configs, source patches, etc. Doesn't contain source, docs, examples, etc. for the actual project being packaged.
2. [Source package](https://kojipkgs.fedoraproject.org/packages/mod_authnz_external/3.3.3/11.el10_0/src/mod_authnz_external-3.3.3-11.el10_0.src.rpm): built from source repo, contains source repo files + actual project files from project repo
3. [per-architecture install package](https://kojipkgs.fedoraproject.org/packages/mod_authnz_external/3.3.3/11.el10_0/x86_64/mod_authnz_external-3.3.3-11.el10_0.x86_64.rpm): built for each CPU architecture from source package, contains just the final files to be added to the system + any installation scripts

### This part might be useful:
Running a build directly from our repo's standard makefile runs `apxs` to compile the module and "install"/copy it to the destination, but for a package build you probably just want to **tell `apxs` to only compile the module, not install it**.
Here is a [Fedora example](https://src.fedoraproject.org/rpms/mod_authnz_external/blob/epel10/f/mod_authnz_external.spec#_30) that may be helpful to you (see the **%build** section). Also see [`apxs` man page](https://man.freebsd.org/cgi/man.cgi?query=apxs) for help.

Hope this is helpful to you.
created_at: 2025-03-07T23:19:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
path: debian/README.Debian
user: login: bimimicah
body: It would probably be good to include some basic explanation from the main project readme file at the top of this file, as well as a link to the project homepage. I guess the previous Debian maintainer probably only used it with `pwauth`, but these are actually 2 separate projects.
created_at: 2025-03-07T23:20:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
+exposing /etc/shadow file.
+
+To use it on Debian, make sure to also pwauth package then add these lines to
path: debian/README.Debian
user: login: bimimicah
body: probably should say:
"also `add the` pwauth package"
or
"also `install the` pwauth package"
created_at: 2025-03-07T23:20:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
path: debian/control
user: login: bimimicah
body: ### Original comment:
Josef Liška/phokz is the official head maintainer of mod_authnz_external, as designated by Jan Wolter's widow, to the best of my knowledge. Of course, as an open source project, anyone is welcome to fork it as long as they follow the license, but for the official repo, that is the correct attribution. 👍
<br>
### Additional comment:
I don't know what the Debian policy is, but maybe this field is supposed to be **you**, as the _source package_ maintainer, not the _source project_ maintainer?
You may want to check the [latest commit on the Debian package source repo](https://salsa.debian.org/debian/libapache2-mod-authnz-external/-/commit/ecb7f6ee6a08e84d0cda4e53ce7dc02731d1d107) from 3 months ago.
created_at: 2025-03-07T23:33:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: bimimicah
body: There is a newer version (3.3.2-3) of this package that you might have missed, that should come in between 3.3.3 and 3.3.2-2. See:
[latest commit on the Debian package source repo from 3 months ago](https://salsa.debian.org/debian/libapache2-mod-authnz-external/-/commit/ecb7f6ee6a08e84d0cda4e53ce7dc02731d1d107)
[package update feed](https://tracker.debian.org/pkg/libapache2-mod-authnz-external/news/)
You may want to coordinate with [Petter Reinholdtsen](mailto:pere@hungry.com) or maybe he could help you get more familiar with Debian-related issues you come across?
created_at: 2025-03-07T23:38:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: carrvo
body: This looks like literally everything I was looking for! (And vaguely like it is not orphaned despite Debian's listing...)
created_at: 2025-03-07T23:53:51Z
author_association: OWNER
diff_hunk: @@ -0,0 +1 @@
+3.0 (native)
path: debian/source/format
user: login: carrvo
body: Moved to its own branch: https://github.com/carrvo/debian-libapache2-mod-authnz-external/tree/features/debian-package-quilt
created_at: 2025-03-10T20:38:37Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
path: debian/control
user: login: carrvo
body: I have added myself to the `Uploaders` field so that the `Maintainers` can correctly attribute the source's maintainer. This may not be expected for Debian, but I like drawing awareness to the upstream and it resolves the warning.
created_at: 2025-03-10T20:55:22Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
path: debian/README.Debian
user: login: carrvo
body: I will clean up this file. However, as per [the description of the file](https://www.debian.org/doc/manuals/maint-guide/dother.en.html#readme) I will not include anything from the main project README (but I will still distribute and refer to it).
created_at: 2025-03-10T21:14:27Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
path: debian/README.Debian
user: login: carrvo
body: Done.
created_at: 2025-03-10T21:22:05Z
author_association: OWNER
path: debian/control
user: login: carrvo
body: Ignoring.
created_at: 2025-03-10T21:22:28Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
path: debian/control
user: login: carrvo
body: Fixed.
created_at: 2025-03-10T21:22:37Z
author_association: OWNER
path: debian/copyright
user: login: carrvo
body: Fixed.
created_at: 2025-03-10T21:22:50Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
+Architecture: amd64
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+Original-Maintainer: Debian QA Group <packages@qa.debian.org>
+Installed-Size: 59
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: pwauth
+Section: web
path: debian/control
user: login: carrvo
body: Fixed.
created_at: 2025-03-10T21:24:18Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,67 @@
+This package was debianized for Ubuntu by Chuck Short <zulcss@ubuntu.com> on
+Tue, 08 Jan 2008 10:20:36 -0500.
+This package was debianized for Debian by Hai Zaar <haizaar@haizaar.com> on
+Tue, 31 Mar 2009 18:32:20 +0300 based on the work mentioned above.
+
+It was downloaded from https://github.com/phokz/mod-auth-external
+
+Upstream Authors:
+
+Josef Liška      <josef.liska@virtualmaster.com>
+Micah Andersen   <micah@bimi.org>
+Rai              <agentydragon@gmail.com>
+joakim-tjernlund
+
+It was originally located at http://code.google.com/p/mod-auth-external
path: debian/copyright
user: login: carrvo
body: Ignoring.
created_at: 2025-03-10T21:24:30Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
+Architecture: amd64
+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
+Original-Maintainer: Debian QA Group <packages@qa.debian.org>
+Installed-Size: 59
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: pwauth
+Section: web
+Priority: optional
+Homepage: https://github.com/phokz/mod-auth-external
path: debian/control
user: login: carrvo
body: Fixed.
created_at: 2025-03-10T21:24:47Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
path: debian/control
user: login: carrvo
body: Using highest dev version instead. This will actually be further outdated.
created_at: 2025-03-10T21:25:23Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,17 @@
+This package can be used with pwauth to provide secure auth against PAM without
+exposing /etc/shadow file.
+
+To use it on Debian, make sure to also pwauth package then add these lines to
path: debian/README.Debian
user: login: carrvo
body: Re-worked.
created_at: 2025-03-10T21:26:27Z
author_association: OWNER
diff_hunk: @@ -5,22 +5,28 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev
+
+debian-package-version:
+	dch -v $(version)
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
path: Makefile
user: login: carrvo
body: Additional information from the commentor on the suggestion is found in the newer `rules` file.
> 2. The original package repo has some files you probably will find useful that are missing/out-of-date here. The `rules` and `watch` files look like they are probably going to be pretty useful for you. (especially note the newer version's `rules` file)
created_at: 2025-03-10T21:32:21Z
author_association: OWNER
diff_hunk: @@ -5,22 +5,28 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev
+
+debian-package-version:
+	dch -v $(version)
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
path: Makefile
user: login: carrvo
body: I will move this work to another branch to better experiment and explore.
created_at: 2025-03-10T21:33:05Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: carrvo
body: Contacting Debian package source to see if this repository is redundant.
created_at: 2025-03-10T21:37:32Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: carrvo
body: Pulling in missing changelog entry from Debian package source.
created_at: 2025-03-10T21:37:55Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
path: debian/control
user: login: carrvo
body: This seems to be very strange and has been replicated for the same dev system for https://salsa.debian.org/debian/libapache2-mod-authnz-external/

Moving to an issue.
created_at: 2025-03-10T21:39:57Z
author_association: OWNER
diff_hunk: @@ -0,0 +1 @@
+3.0 (native)
path: debian/source/format
user: login: carrvo
body: And own issue: https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/9
created_at: 2025-03-10T22:04:33Z
author_association: OWNER
diff_hunk: @@ -5,22 +5,28 @@ APXS=apxs
 TAR= README INSTALL INSTALL.HARDCODE CHANGES CONTRIBUTORS AUTHENTICATORS UPGRADE TODO \
 	mod_authnz_external.c test/* Makefile
 
-.DEFAULT_GOAL:= build
-.PHONY: install build clean
+version = $(error version is not set)
 
-install: mod_authnz_external.la
-	$(APXS) -i -a mod_authnz_external.la
+.DEFAULT_GOAL:= debian-package
+.PHONY: clean
 
-build: mod_authnz_external.la
-
-mod_authnz_external.la: mod_authnz_external.c
-	$(APXS) -c mod_authnz_external.c
+download:
+	wget https://github.com/phokz/mod-auth-external/archive/mod_authnz_external-$(version).tar.gz
+	tar -xvzf mod_authnz_external-$(version).tar.gz
+	#mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external-$(version)
+	mv mod-auth-external-mod_authnz_external-$(version) libapache2-mod-authnz-external
 
 clean:
-	rm -rf mod_authnz_external.so mod_authnz_external.o \
-	    mod_authnz_external.la mod_authnz_external.slo \
-	    mod_authnz_external.lo .libs
-	-ls -a .*.swp
+	rm -rf mod_authnz_external*
+	rm -rf mod_auth_external*
+	sudo rm -rf libapache2-mod-authnz-external*
+
+debian-package-dependencies:
+	sudo apt install build-essential fakeroot devscripts apxs apache2-dev
+
+debian-package-version:
+	dch -v $(version)
 
-mae.tar: $(TAR)
-	tar cvf mae.tar $(TAR)
+debian-package: libapache2-mod-authnz-external
+	cp -R debian libapache2-mod-authnz-external/
+	cd libapache2-mod-authnz-external && debuild --rootcmd=sudo --no-tgz-check -us -uc
path: Makefile
user: login: carrvo
body: And own issue: https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/8
created_at: 2025-03-10T22:07:57Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,25 @@
+libapache2-mod-authnz-external (3.3.2-2) unstable; urgency=medium
path: debian/changelog
user: login: carrvo
body: Redundancy moved to its own issue: https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/7
created_at: 2025-03-10T22:08:31Z
author_association: OWNER
diff_hunk: @@ -0,0 +1,35 @@
+Source: libapache2-mod-authnz-external
+Maintainer: Josef Liška  <josef.liska@virtualmaster.com>
+Section: web
+Priority: optional
+Standards-Version: 4.7.0
+Build-Depends: debhelper-compat (= 13),
+    libc6 (>= 2.4),
+    apache2-api-20120211,
+    apache2-bin (>= 2.4.16),
+    apache2-dev,
+    dh-apache2
+Recommends: pwauth
+Homepage: https://github.com/phokz/mod-auth-external
+
+Package: libapache2-mod-authnz-external
path: debian/control
user: login: carrvo
body: Moved to its own issue: https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/6
created_at: 2025-03-10T22:09:07Z
author_association: OWNER

PR comments:
user: login: bimimicah
created_at: 2025-03-07T23:11:27Z
body: > This has been moved to [carrvo/debian-libapache2-mod-authnz-external#1](https://github.com/carrvo/debian-libapache2-mod-authnz-external/pull/1)

<br/>
I added some comments/review to the old PR as you requested. 
Would you like me to add them to the new location?
<br/>
I will go ahead and add them here.<br/>
<br/><br/>
Also, as mentioned in those comments, I've now split out the LICENSE file to make it easy to just ship it with the built package (to make it easier for you to satisfy Apache 1.0 license requirements)
author_association: CONTRIBUTOR
user: login: bimimicah
created_at: 2025-03-08T00:12:22Z
body: Well, I think that's all the comments I had before. Hope they are helpful to you.
**Honestly of everything I wrote the only thing that really matters is the license issue.** The old Apache License 1.0 specifically requires that it be distributed alongside the binary package, how it looks in the end (separate `LICENSE`/`CONTRIBUTORS` files or appended to the bottom of a `copyright` file) doesn't really matter, but the **text** of the `LICENSE` and `CONTRIBUTORS` files should end up somewhere on the user's machine associated with this package.
I figure since the package is being updated, now is a good time to get this done right. I will be contacting the Fedora/EPEL maintainers to get their package fixed as well.

2 more before I call it a night:

1. If the Debian policy is to keep original project source in your package repo, then just unzip to that folder when you have new source release. <b>If that is not the policy, then it would be good to get rid of the separate copies of the documentation files</b> (AUTHENTICATORS, TODO, UPGRADE, etc.) and pull them in when you grab the project source.
2. The original package repo has some files you probably will find useful that are missing/out-of-date here. The `rules` and `watch` files look like they are probably going to be pretty useful for you. (especially note the newer version's `rules` file)
author_association: CONTRIBUTOR
user: login: carrvo
created_at: 2025-03-10T16:20:51Z
body: @bimimicah this has been quite a helpful review! I really appreciate it :heart:

I especially appreciate the licensing note. That is something often easy to mix up or get wrong.

For the duplicate files, I intend to remove them after I ensure any important information has been copied over to any relevant place. Not strictly necessary to wait since the information lives upstream, but it works as a good reminder.

Hopefully I can resolve things by end of week!
author_association: OWNER
user: login: carrvo
created_at: 2025-03-10T21:30:20Z
body: > Well, I think that's all the comments I had before. Hope they are helpful to you. **Honestly of everything I wrote the only thing that really matters is the license issue.** The old Apache License 1.0 specifically requires that it be distributed alongside the binary package, how it looks in the end (separate `LICENSE`/`CONTRIBUTORS` files or appended to the bottom of a `copyright` file) doesn't really matter, but the **text** of the `LICENSE` and `CONTRIBUTORS` files should end up somewhere on the user's machine associated with this package. I figure since the package is being updated, now is a good time to get this done right. I will be contacting the Fedora/EPEL maintainers to get their package fixed as well.

Since I am pulling the frozen v3.3.3 I will leave this in just the `debian/copyright` so that the text is there. Further releases I will distribute the separated file in addition to the `debian/copyright` (and perhaps simplify it).

> 1. If the Debian policy is to keep original project source in your package repo, then just unzip to that folder when you have new source release. If that is not the policy, then it would be good to get rid of the separate copies of the documentation files (AUTHENTICATORS, TODO, UPGRADE, etc.) and pull them in when you grab the project source.

This was a reminder that there is relevant information that would be worth copying to appropriate locations. I have now decided to distribute some of these files.


author_association: OWNER
user: login: carrvo
created_at: 2025-03-10T22:04:01Z
body: > > Well, I think that's all the comments I had before. Hope they are helpful to you. **Honestly of everything I wrote the only thing that really matters is the license issue.** The old Apache License 1.0 specifically requires that it be distributed alongside the binary package, how it looks in the end (separate `LICENSE`/`CONTRIBUTORS` files or appended to the bottom of a `copyright` file) doesn't really matter, but the **text** of the `LICENSE` and `CONTRIBUTORS` files should end up somewhere on the user's machine associated with this package. I figure since the package is being updated, now is a good time to get this done right. I will be contacting the Fedora/EPEL maintainers to get their package fixed as well.
> 
> Since I am pulling the frozen v3.3.3 I will leave this in just the `debian/copyright` so that the text is there. Further releases I will distribute the separated file in addition to the `debian/copyright` (and perhaps simplify it).
> 

Follow up: https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/10


author_association: OWNER
user: login: bimimicah
created_at: 2025-03-10T22:19:56Z
body: > Since I am pulling the frozen v3.3.3 I will leave this in just the `debian/copyright` so that the text is there. Further releases I will distribute the separated file in addition to the `debian/copyright` (and perhaps simplify it).

Good point. I should see if I can carve out some time to add testing infrastructure to the automated builds to make some progress on clearing the blockers for v3.3.4.

Please note the contents of `debian/copyright` are not currently correct, specifically:
1.  the last paragraph of the license is missing
2. the copyright header at the top is the generic Apache license copyright statement, not ours (from v.3.3.3) with the past maintainers and contributors (who are all joint copyright holders)
     &nbsp;    a. technically the old lines of code which are still under "Apache Group" copyright are a few boilerplate lines that have almost certainly been replaced during upgrades to work with newer versions of Apache, but the project as a whole is still a "derivative work" regardless. My point being they don't really hold the primary copyright and shouldn't be the only attribution in the copyright header.
3. If you feel the contributor list would go better in the comments section of the file, I suppose that makes no difference as long as the list ends up on the user's machine, but lines 58-73 really should be replaced with the contents of the v.3.3.3 `CONTRIBUTORS` file, formatted/indented however necessary for Debian standards.
4. The reference to Google Code is unnecessary as this repository replaces that one (as you can see from the Google Code project homepage).
5. The reference to the unixpapa site in the `readme` has the same issue. That is Jan Wolter's old site, archived when he passed away; it will never be updated and you cannot find support there.

Hope that clarifies things :)
author_association: CONTRIBUTOR
user: login: carrvo
created_at: 2025-03-10T23:21:16Z
body: > Please note the contents of `debian/copyright` are not currently correct, specifically:
> 
>     1. the last paragraph of the license is missing
> 
>     2. the copyright header at the top is the generic Apache license copyright statement, not ours (from v.3.3.3) with the past maintainers and contributors (who are all joint copyright holders)
>             a. technically the old lines of code which are still under "Apache Group" copyright are a few boilerplate lines that have almost certainly been replaced during upgrades to work with newer versions of Apache, but the project as a whole is still a "derivative work" regardless. My point being they don't really hold the primary copyright and shouldn't be the only attribution in the copyright header.
> 
>     3. If you feel the contributor list would go better in the comments section of the file, I suppose that makes no difference as long as the list ends up on the user's machine, but lines 58-73 really should be replaced with the contents of the v.3.3.3 `CONTRIBUTORS` file, formatted/indented however necessary for Debian standards.
> 
>     4. The reference to Google Code is unnecessary as this repository replaces that one (as you can see from the Google Code project homepage).
> 
>     5. The reference to the unixpapa site in the `readme` has the same issue. That is Jan Wolter's old site, archived when he passed away; it will never be updated and you cannot find support there.
> 

Created issue https://github.com/carrvo/debian-libapache2-mod-authnz-external/issues/14


author_association: OWNER
user: login: carrvo
created_at: 2025-03-10T23:22:45Z
body: > > Since I am pulling the frozen v3.3.3 I will leave this in just the `debian/copyright` so that the text is there. Further releases I will distribute the separated file in addition to the `debian/copyright` (and perhaps simplify it).
> 
> Good point. I should see if I can carve out some time to add testing infrastructure to the automated builds to make some progress on clearing the blockers for v3.3.4.
> 

@bimimicah  you may want to **consider** releasing it as `v3.4.0` or `v4.0.0` because the following (in `v3.3.3`) is a change to the API (and the change I am trying to consume) and a higher version increment can help bring that to attention:
> Added the "GroupExternalAuthNCheck Off" directive to disable the check
for a previously authenticated user when using only the group
authorization module. If you use any user authentication module in the
same context, this may be undesirable. Thanks to Micah Andersen/BIMI.
author_association: OWNER
user: login: bimimicah
created_at: 2025-03-11T18:45:01Z
body: > you may want to **consider** releasing it as `v3.4.0` or `v4.0.0` because the following (in `v3.3.3`) is a change to the API (and the change I am trying to consume) and a higher version increment can help bring that to attention:
> 
> > Added the "GroupExternalAuthNCheck Off" directive to disable the check
> > for a previously authenticated user when using only the group
> > authorization module. If you use any user authentication module in the
> > same context, this may be undesirable. Thanks to Micah Andersen/BIMI.

Hmmm. Interesting suggestion; I'll have to think about that. The big reason many distros haven't moved beyond the last few versions (3.3.0, 3.3.1, 3.3.2) is because this is a relatively stable project with few major changes; mostly small fixes.
So a lot of times, historically, I think people haven't moved to a newer version until they needed to upgrade Apache httpd and needed a newer version of this to go with it.
There hasn't been a major breaking change to Apache in over a decade (version 2.4 introduced changes which were resolved by our v3.3.0), so some distros haven't bothered to look for an updated mod_authnz_external package since then (OpenMandriva and NetBSD are good examples).
For similar reasons, ever since the 3.x series started in 2006, we basically don't make breaking changes until Apache does.

That's one of the big reasons I haven't made the v.3.3.4 release yet (see phokz/mod-auth-external#37). I have been worried because it has a pretty substantial addition (AUTHORIZE_ headers are added to the external processes' environment values, the first environment variable addition since CONTEXT was added in 2008) which could theoretically break applications that have been expecting a specific environment table size for the last 2 decades.... And now that I have that all in writing, I think I've made up my mind about phokz/mod-auth-external#37, I'll definitely put it behind a flag.
Basically all of that to say, our versioning system so far has been basically "Apache httpd-based", or something like this:
Read this table from the **bottom up**, it makes more sense that way....
```
Major.Minor.Revision
  ^     ^      ^
  |     |      |
  |     |      ➥ Any other changes
  |     ➥ New Apache minor versions based on the same design (e.g. when 3.3 fixed minor issues to upgrade us to Apache 2.4)
  |     ➥ Internal (non-breaking) rewrites (e.g. when 3.2 switched to use APR under the hood)
  ➥ Complete rewrites of internal and external design (e.g. when 3.0/3.1 introduced the Apache authnz model)
```

If we switched to semver ([Semantic Versioning](https://semver.org/)), which seems to be the standard nowadays, then it would look like this:
Read this table from the **top down**, it makes more sense that way....
```
Major.Minor.Revision
  ^     ^      ^
  |     |      |
  |     |      ➥ Non-breaking _bug-fixes_ only (e.g. when 3.3.3 fixed the parenthesis grouping bug that was unlikely to ever trigger)
  |     ➥ Non-breaking new features (e.g. when 3.3.3 added the GroupExternalAuthNCheck directive/flag)
  |     ➥ Non-breaking internal changes (e.g. when 3.2 switched to use APR under the hood)
  ➥ Anything that breaks compatibility, including:
          Complete rewrites of internal and external design (e.g. when 3.0/3.1 introduced the Apache authnz model)
          New Apache minor versions based on the same design (e.g. when 3.3 upgraded to Apache 2.4 and removed AuthBasicAuthoritative and GroupExternalAuthoritative)
```

**Essentially, if we switched to semver, then 3.3.4 would actually be 3.4.0 and if anyone (me, I guess) ever gets around to adding the features for phokz/mod-auth-external#40 and phokz/mod-auth-external#21, then those would be in 3.5.0 or later.**
author_association: CONTRIBUTOR
user: login: bimimicah
created_at: 2025-03-11T19:00:57Z
body: > @bimimicah you may want to **consider** releasing it as `v3.4.0` or `v4.0.0` because the following (in `v3.3.3`) is a change to the API (and the change I am trying to consume) and a higher version increment can help bring that to attention:
> 
> > Added the "GroupExternalAuthNCheck Off" directive to disable the check
> > for a previously authenticated user when using only the group
> > authorization module. If you use any user authentication module in the
> > same context, this may be undesirable. Thanks to Micah Andersen/BIMI.

I've added phokz/mod-auth-external#63 to address this. I think this is probably a good idea, unless someone has a reason why it's not.
author_association: CONTRIBUTOR
user: login: carrvo
created_at: 2025-03-11T19:23:18Z
body: I'll admit, in my currently short time as a software developer, semantic versioning is what I have generally encountered and worked with. Apparently I got too used to it to remember its name :frowning: 
author_association: OWNER