I believe it’s a reasonable assumption that the kernel matches the Debian release. If anybody is running with old kernel or disables getrandom I would say they are on their own - also other stuff will break, not only apache2.
Yes, that makes sense. Surprisingly, although I've been putting off upgrading my kernel for a while, this was the first thing that broke - so far at least, everything else has fallbacks.
I think a perfectly valid fix would be to document (in the changelog or elsewhere) that this hard requirement was added, in particular because (IIUC) using getrandom() instead of one of the other codepaths is the choice of the package maintainer. (I.e. this isn't just the result of upstream.) Tracking down what broke and why was mostly tricky because it wasn't documented, and Googling only turns up results on an unrelated Windows issue.
> This changed in libapr1 1.7, re-assigning to apr. I am not sure about the severity, though. According to the man page, getrandom has been introduced in linux 3.17. Debian 9 already has 4.9 so you have to have a kernel that is from Debian 8 to be affected by this.
Sorry if the priority was overly high. I was going based on these descriptions from reportbug:
4 important a bug which has a major effect on the usability of a package, without rendering it completely unusable to everyone.
5 normal a bug that does not undermine the usability of the whole package; for example, a problem with a particular option or menu item.
Based on that, "important" seemed more correct than "normal," since "won't even parse command-line options" is about as severe an effect on usability as it gets, but it was (likely) only affecting me. Looking at
https://www.debian.org/Bugs/Developer#severities, normal is listed as "the default value, applicable to most bugs," and given that I'd categorize this as normal.