Personally, I just compile the entire suite from source code, including the compiler (GCC) itself, openSSL, anything related to what my web server might need.
On Mon, Oct 27, 2014 at 11:10 AM, Lesley Kimmel <ljkimmel99@xxxxxxxxxxx> wrote:
If it were me I'd use the system expat. Your Linux vendor would be expected to fix any security issues within a short timeframe. APR-Util probably wouldn't have a new release so quickly for this library which it bundles.
I'd be very concerned about OpenSSL. My experience is with scenarios where the security library is part of the custom httpd package.
There are always issues of identifying required packages for deployment when you run on different distros/versions, and disabling features in rare cases when the build would find it on the build system but you don't want to require its installation on the target machine.
----- End forwarded message ----- |