don't link against redundant apr-util dependent libraries

mod_security.spec

@@ -10,7 +10,7 @@
 Summary: Security module for the Apache HTTP Server
 Name: mod_security
 Version: 2.9.3
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: ASL 2.0
 URL: http://www.modsecurity.org/
 Source: https://github.com/SpiderLabs/ModSecurity/releases/download/v%{version}/modsecurity-%{version}.tar.gz
@@ -18,15 +18,16 @@ Source1: mod_security.conf
 Source2: 10-mod_security.conf
 Source3: modsecurity_localrules.conf
 Patch0: modsecurity-2.9.3-lua-54.patch
+Patch1: modsecurity-2.9.3-apulibs.patch
+
 Requires: httpd httpd-mmn = %{_httpd_mmn}
 %if 0%{?fedora} || 0%{?rhel} > 7
 # Ensure apache user exists for file ownership
 Requires(pre): httpd-filesystem
 %endif
 
-BuildRequires: gcc
+BuildRequires: gcc, make, autoconf, automake, libtool
 BuildRequires: httpd-devel
-BuildRequires: make
 BuildRequires: perl-generators
 BuildRequires: pkgconfig(libcurl)
 BuildRequires: pkgconfig(libpcre)
@@ -63,10 +64,12 @@ This package contains the ModSecurity Audit Log Collector.
 %autosetup -p1 -n modsecurity-%{version}
 
 %build
+./autogen.sh
 %configure --enable-pcre-match-limit=1000000 \
            --enable-pcre-match-limit-recursion=1000000 \
            --with-apxs=%{_httpd_apxs} \
-           --with-yajl
+           --with-yajl \
+           --disable-static
 # remove rpath
 sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool
 sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool
@@ -138,6 +141,9 @@ install -m0644 mlogc/mlogc-default.conf %{buildroot}%{_sysconfdir}/mlogc.conf
 %endif
 
 %changelog
+* Fri Jan 22 2021 Joe Orton <jorton@redhat.com> - 2.9.3-8
+- don't link against redundant apr-util dependent libraries
+
 * Sat Aug 08 2020 Othman Madjoudj <athmane@fedoraproject.org> - 2.9.3-7
 - Add a patch to fix build with Lua 5.4 until we completely switch to mod_sec3 as default
 

modsecurity-2.9.3-apulibs.patch

@@ -0,0 +1,14 @@
+
+Strip redundant APR-util dependent libraries, it is sufficient to link against -laprutil-1.
+
+--- modsecurity-2.9.3/build/find_apu.m4.apulibs
++++ modsecurity-2.9.3/build/find_apu.m4
+@@ -59,7 +59,7 @@
+     APU_CFLAGS="`${APU_CONFIG} --includes`"
+     if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu CFLAGS: $APU_CFLAGS); fi
+     APU_LDFLAGS="`${APU_CONFIG} --ldflags`"
+-    APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --libs`"
++    APU_LDFLAGS="$APU_LDFLAGS `${APU_CONFIG} --avoid-ldap --avoid-dbm --libs`"
+     if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDFLAGS: $APU_LDFLAGS); fi
+     APU_LDADD="`${APU_CONFIG} --link-libtool`"
+     if test "$verbose_output" -eq 1; then AC_MSG_NOTICE(apu LDADD: $APU_LDADD); fi