Virgin Apache is Hard to Find
markcox writes "Apache Week had written an article examining the Apache packages distributed by 10 popuplar Linux vendors. The survey found that all the vendors added some patches to virgin Apache including build patches, backported security patches, changing the product name through to dubious patches, and missed security fixes."
The strangness that various distros impart to apache is why I usually start with Apache Toolbox. This uses wget to automatically download any missing source, and currently supports 60+ third party modules in addition to the 36 apache modules which are included in standard source distribution. For redhatters, this even halts appropriately for RPMs that cause problems. Works on slowaris, and pretty much any BSD/*NIX with gcc. I'm not a member of this project or anything, just a fan: it just works.
http://tinyurl.com/4ny52
...Virgin Apache developers are fairly easy to find...
Sure I'm paranoid, but am I paranoid enough?
Apache is one of those programs that I actually refuse to use a binary distribution of. I just download the latest source, set my preferred options (making sure I build with dynamically loadable modules, which allows me to comment out the ones I don't need in httpd.conf) and away I go. If Apache is installed, I "rpm -e" it and then "make install" my source-built version. If I want to upgrade, usually only the httpd binary and modules need updating and then a quick restart of the server and I'm nicely up-to-date (would you trust "rpm -Uvh" on a live production server's Apache ??!).