unable to build on ubuntu 24.04 due to libmodsecurity version requirement

[imgurbot12]

Hello, thanks for you work on this library!

I recently wrote my own wrapper on this as an actix-web middleware and published it as a crate.
However, it fails to build on docs.rs since their build image is based on 24.04 which uses libmodsecurity-dev version 3.0.12.

Is it possible to maintain support for older versions of modsecurity to make this library and its dependents more accessible to older systems?
It seems that using the latest and greatest version works against common adoption and usability on all platforms.

I'd be happy to implement a PR with some recommended direction if you have any feedback.
Hope to hear from you soon, thanks!

[rkrishn7]

Hi, thanks for raising this!

I think it might be worth it to raise this upstream in libmodsecurity. It looks like noble currently supports 3.0.10-3.0.12, so ideally 3.0.13 can be published as well.

Is it possible to maintain support for older versions of modsecurity to make this library and its dependents more accessible to older systems?

Older versions are supported with older versions of this crate. In general I think newer versions here should be tied to the latest stable there to remain up-to-date with any fixes/security patches.

[imgurbot12]

Appreciate the response. I can certainly try raising it on the libmodsecurity repo but after a small bit of research I have to say I don't think the mod-security team will be able to do anything about it.

Based on their readme it doesn't appear they manage their own packaging

Having our packages in distros on time is a desire that we have, so let us know if there is anything we can do to facilitate your work as a packager.

And after looking into the package information for it, it seems like the packaging for ubuntu is managed by canonical. Since 22.04 is an LTS release, I suspect that they won't be quick to update any package if at all considering they care about stability above change.

I suppose it doesn't hurt to ask but realistically this will mean that modern versions of libmodsecurity and therefore this library won't be able to be installed on a large portion of systems due to the nature of staged release systems for large distros.

Additionally, my concern is that supporting only the latest versions means earlier versions of this library won't be able to take advantage of any patches or bugfixes applied to later additions meaning the earlier versions are objectively inferior as development evolves.

[imgurbot12]

Got some information from the debian/ubuntu packager for modsecurity in that issue.

He confirmed that the existing packaging is unlikely to change beyond security patches. There is a 3rd party party repository he mentioned that could provide more recent versions, but that might not be a viable option for many companies or products such as docs.rs. At the very least this will mean subsequent builds of this libraries documentation won't be available on docs.rs since it will likely remain on 24.04 for quite some time.