Nginx Freenginx

Wow sad unfortunate situation [nginx-announce] announcing freenginx.org. But grateful for his dedication to Nginx!

Yeah tricky situation.

Thanks for the heads up. Busy with client work so will have to look at Freenginx a bit later. Looks like Freenginx code right now is same just different download urls and Mercurial source control repo. So can add optional Freenginx support to Centmin Mod just like I did for Angie Nginx fork https://community.centminmod.com/th...-that-was-forked-from-nginx.24378/#post-98352

 

Maxim dev mailing list discussions The nginx-devel February 2024 Archive by thread

 

Looks like made the news on Phoronix too https://www.phoronix.com/news/Nginx-Forked-To-Freenginx and their comments https://www.phoronix.com/forums/node/1443374

https://www.phoronix.com/forums/for...b-server-into-freenginx?p=1443452#post1443452

Knowing this info and why Official Nginx 1.25.4 was released today, I'm siding with F5 on this as I would want to know of security bugs even if Nginx HTTP/3 is experimental code still. Would also make me cautious using Maxim's Freenginx fork if his philosophy is not to assign CVE security labels to Nginx code that he thinks is experimental

 

Added to 130.00beta01 optional freenginx forked Nginx support via variable FREENGINX_INSTALL='y' that you can optionally set in the persistent config file /etc/centminmod/custom_config.inc (disabled by default), which will have Nginx version build tagged with -freengx

 

More info at Nginx core developer quits project in security dispute, starts “freenginx” fork

Also comment on ARS article from a person familar with CNA

 

Freenginx: Core Nginx developer announces fork | Hacker News

 

Copyright holders have at their discretion the right to or not to pursue their rights. Not sure it would be wise to pursue Maxim legally for use of Nginx name and risk pissing off the Nginx developer/contributor/own staff/ community and users.

I 100% understand his feelings as almost exact similar situation happened to me recently when a 12+ years old working client relationship ended with my client passing away and having eventually been taken advantage of by his relative who didn't pay me for my work in saving the server and site from overdue web hosting bill termination when no known relatives had been found yet and even wanted to take false unsubstantiated legal action against me. I did it anyway knowing there was a possibility of such outcome as 12yrs is a long time working on my deceased client's server and I considered it almost apart of set of babies and had a attachment to seeing them survive and continue in the way I designed and configured it for.

 

Thanks for heads up. Notice the differences in Change logs! Clearly Maxmim doesn't like HTTP/3 security bugs being labelled with CVEs Personally I prefer CVE labelled security classed bugs for Nginx HTTP/3

http://freenginx.org/en/CHANGES

Code (Text):

Changes with freenginx 1.25.4                                    20 Feb 2024

   *) Change: now the "freenginx" name is used in responses.

   *) Bugfix: "open socket left" alerts might appear in logs during worker
      processes shutdown when using AIO.

   *) Bugfix: a segmentation fault might occur in a worker process if AIO
      was used in subrequests.

   *) Bugfix: a segmentation fault might occur in a worker process if the
      "image_filter" directive was used, and errors with code 415 were
      redirected with the "error_page" directive.

   *) Bugfix: a segmentation fault might occur in a worker process when
      handling cached responses with the "X-Accel-Redirect" header.
      Thanks to Jiří Setnička.

   *) Bugfix: a segmentation fault might occur in a worker process when
      using HTTP/3.

   *) Bugfixes and improvements in HTTP/3.

Nginx http://nginx.org/en/CHANGES

Code (Text):

Changes with nginx 1.25.4                                        14 Feb 2024

   *) Security: when using HTTP/3 a segmentation fault might occur in a
      worker process while processing a specially crafted QUIC session
      (CVE-2024-24989, CVE-2024-24990).

   *) Bugfix: connections with pending AIO operations might be closed
      prematurely during graceful shutdown of old worker processes.

   *) Bugfix: socket leak alerts no longer logged when fast shutdown was
      requested after graceful shutdown of old worker processes.

   *) Bugfix: a socket descriptor error, a socket leak, or a segmentation
      fault in a worker process (for SSL proxying) might occur if AIO was
      used in a subrequest.

   *) Bugfix: a segmentation fault might occur in a worker process if SSL
      proxying was used along with the "image_filter" directive and errors
      with code 415 were redirected with the "error_page" directive.

   *) Bugfixes and improvements in HTTP/3.

 

Just set in persistent config file /etc/centminmod/custom_config.inc

Code (Text):

FREENGINX_INSTALL='y'

Then run centmin.sh menu option 4 and input desired freenginx version

 

Ah i see what you mean they changed the name of the file downloaded too Index of /download/ from nginx- to freenginx- will need to update 130.00beta01 then

 

updated 130.00beta01 with fix you can pull down via cmupdate command

persistent config file using /etc/centminmod/custom_config.inc the variables to switch from official Nginx to forked freenginx and to use system OpenSSL on AlmaLinux 9 instead of compiling OpenSSL

Code (Text):

FREENGINX_INSTALL=y
OPENSSL_SYSTEM_USE=y

 

Yeah the nginx_upgrade.inc bug was fixed in latest 130.00beta01 update

 

FREENGINX_INSTALL='y' works with FREENGINX_VERSION='1.27.1' not NGINX_VERSION='1.27.1' as official Nginx versions may not align with Freenginx versions. That would be one reason. The other is as you say FREENGINX_INSTALL='y' only works on centmin.sh menu option 4 upgrade runs and not initial install runs right now and work on such will be in future Centmin Mod 140.00beta01