This is a new feature that requires new dependencies. Disable it.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Fixes at least:

CVE-2017-15710
CVE-2017-15715
CVE-2018-1283
CVE-2018-1312

Added CPE ID for proper CVE tracking.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Remove build timestamp [0] and correct sorting [1].
Thanks to debian for the patch.

[0] https://reproducible-builds.org/docs/timestamps/
[1] https://reproducible-builds.org/docs/stable-inputs/

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>

- fix CVE-2017-9798
 - fix #4926
  make http2 support configurable, in case of enables libnghttp2
  package dont build http2. instead use CONFIG_APACHE_HTTP2 to
  enable http2 support

Signed-off-by: Thomas Heil <heil@terminal-consulting.de>

fix Makefile chmod (644)
replace MD5SUM with HASH
add PKG_MIRROR_HASH when PKG_SOURCE_PROTO:=git

(PKG_SOURCE_PROTO:=svn tarballs are not reproducible for now)

Signed-off-by: Etienne Champetier <champetier.etienne@gmail.com>

- fixes security issues
  CVE-2017-7679, CVE-2017-7668, CVE-2017-7659, CVE-2017-3169
  CVE-2017-3167, CVE-2017-9788, CVE-2017-9789

Signed-off-by: Thomas Heil <heil@terminal-consulting.de>

- refresh patches

Signed-off-by: heil <heil@terminal-consulting.de>

Signed-off-by: heil <heil@terminal-consulting.de>

Instead of explicitly specyfing an Apache mirror use the
@APACHE download facility.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>

Signed-off-by: heil <heil@terminal-consulting.de>

- CVE-2014-0118
 - CVE-2014-0231
 - CVE-2014-0226
 - CVE-2013-5704

Signed-off-by: Thomas Heil <heil@terminal-consulting.de>

information, update source-url update to v2.2.27

Signed-off-by: Thomas Heil <heil@terminal-consulting.de>