litespeedtech / litespeedtech/openlitespeed

1.9.2 release binaries are built with TEST_OUTPUT_PLAIN_CONF / DEBUG_POOL / DISABLE_OBJ_POOL and shipped unstripped

Open
#519 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.5k
Forks
233
Avg merge
2d 19h
Merged PRs (30d)
5

Description

## Summary

The official `openlitespeed-1.9.2-x86_64-linux.tgz` / `-aarch64-linux.tgz` release packages appear to be built straight from the CMake defaults in `CMakeLists.txt`, which still carry several debug/test switches. `build.sh` comments those switches out before invoking cmake, so a source build ends up with a *better* binary than the release package. The binaries are also shipped with full DWARF debug info, unstripped.

## Evidence

`bin/openlitespeed` from the x86_64 package is `ELF 64-bit ... with debug_info, not stripped`, so the compile-time configuration can be read back from DWARF:

- `DW_AT_producer`: `GNU C++17 9.1.1 20190605 (Red Hat 9.1.1-2) -mtune=generic -march=x86-64 -g -O2 -std=gnu++17 -ffunction-sections -fdata-sections`
- build path: `/home/build/release/openlitespeed/1.9.2/openlitespeed-1.9.2/`

Macros that are active in the release binary (verified by which functions/call sites exist):

| Macro | Where it comes from | Effect in the release binary |
|---|---|---|
| `TEST_OUTPUT_PLAIN_CONF` | `CMakeLists.txt` line 193, unconditional | `plainconf::parseFile()` calls `testOutputConfigFile()`, so every start/restart dumps `httpd_config.conf.txt` and `.txt` next to every top-level config file. Users see unexplained `.txt` files in their vhost directories. |
| `DEBUG_POOL` | `CMakeLists.txt` line 195, unconditional | In `ls_pool.c` the slab allocator is compiled out: `refill()` / `chunk_alloc()` are not present in the binary, `ls_sys_getblk()` / `ls_sys_putnblk()` are, i.e. `ls_palloc()` is a plain `malloc()`/`free()` wrapper. |
| `DISABLE_OBJ_POOL` | `CMakeLists.txt` line 123, unconditional | `GObjPool::allocate()` is only called from constructors (11 call sites, all pre-allocation); `get()`/`recycle()` are `new`/`delete`. |

`build.sh` (lines 433–436) does:

```
commentout 'add_definitions(-DRUN_TEST)' CMakeLists.txt
commentout 'add_definitions(-DPOOL_TESTING)' CMakeLists.txt
commentout 'add_definitions(-DTEST_OUTPUT_PLAIN_CONF)' CMakeLists.txt
commentout 'add_definitions(-DDEBUG_POOL)' CMakeLists.txt
```

so a user who builds from source with `build.sh` gets neither the `.txt` dumps nor the debug allocator, while the official package has both.

## Size

Everything in the package is unstripped. `strip --strip-unneeded` on the x86_64 package:

| File | Before | After |
|---|---|---|
| `bin/openlitespeed` | 47,251,368 | 8,767,624 |
| `modules/mod_security.so` | 107,706,000 | 7,478,392 |
| `modules/modpagespeed.so` | 91,603,792 | 16,967,720 |
| whole `.tgz` | 94.7 MB | 19.9 MB |

The aarch64 package behaves the same (72.6 MB → 15.6 MB). The stripped binaries start and report their version normally.

## Suggestions

1. Do not define `TEST_OUTPUT_PLAIN_CONF` and `DEBUG_POOL` unconditionally in `CMakeLists.txt`; gate them behind `CMAKE_BUILD_TYPE=Debug` (or an explicit option) so the release pipeline cannot pick them up by accident. The same probably applies to `DISABLE_OBJ_POOL` if the object pools are meant to be used in production.
2. Strip the release binaries (or ship the debug symbols as a separate package).

Environment: packages downloaded from litespeedtech.com, version string `LiteSpeed/1.9.2 Open (BUILD built: Thu Aug 27 19:13:01 UTC 2026)`.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the unconditional definitions in CMakeLists.txt, then compare them with the commentout calls in build.sh around lines 433–436. Trace the release packaging steps and verify that release binaries no longer emit configuration dumps or retain full debug information, while source builds and version checks still work.

Written by the indexing model from the issue text.

Assessment

Tech stack
cmake, cpp
Domain
build-system, release
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.