[rpms/dovecot] rawhide: fix FTBFS caused by openssl 4.0

[rpms/dovecot] rawhide: fix FTBFS caused by openssl 4.0

[Michal Hlavinka]

A new commit has been pushed.

Repo   : rpms/dovecot
Branch : rawhide
Commit : b43f1b1764521f22bf58f00ba0a13245f3d6edbb
Author : Michal Hlavinka <mhlavink@redhat.com>
Date   : 2026-07-23T20:56:07+02:00
Stats  : +43/-2 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/dovecot/c/b43f1b1764521f22bf58f00ba0a13245f3d6edbb?branch=rawhide

Log:
fix FTBFS caused by openssl 4.0

---
diff --git a/dovecot-2.4.4-openssl4.patch b/dovecot-2.4.4-openssl4.patch
new file mode 100644
index 0000000..a6f6f51
--- /dev/null
+++ b/dovecot-2.4.4-openssl4.patch
@@ -0,0 +1,34 @@
+diff --git a/src/lib-ssl-iostream/dovecot-openssl-common.c b/src/lib-ssl-iostream/dovecot-openssl-common.c
+index f8163412e63..8d0833d8dca 100644
+--- a/src/lib-ssl-iostream/dovecot-openssl-common.c
++++ b/src/lib-ssl-iostream/dovecot-openssl-common.c
+@@ -84,7 +84,7 @@ void dovecot_openssl_common_global_ref(void)
+ 	   which is after Dovecot has dlclose()d plugins that may have
+ 	   registered OpenSSL callbacks (e.g. libcassandra).  Accessing those
+ 	   unmapped code pages from OPENSSL_cleanup() crashes the process.
+-	   Dovecot calls OPENSSL_cleanup() explicitly via
++	   Dovecot calls OPENSSL_cleanup() (for OPENSSL < 4.0) explicitly via
+ 	   dovecot_openssl_common_global_unref() while the relevant modules
+ 	   are still loaded. */
+ 	OPENSSL_init_ssl(OPENSSL_INIT_NO_ATEXIT, NULL);
+@@ -105,7 +105,20 @@ bool dovecot_openssl_common_global_unref(void)
+ #endif
+ 		dovecot_openssl_engine = NULL;
+ 	}
++	/* On OpenSSL < 4.0 OPENSSL_cleanup() runs synchronously here, while this
++	   module (and the custom memory functions it installed with
++	   CRYPTO_set_mem_functions()) is still mapped, so it is safe and frees
++	   OpenSSL's global state.
++
++	   On OpenSSL >= 4.0 OPENSSL_cleanup() no longer cleans up synchronously;
++	   it only arms a global destructor that runs at process exit - after
++	   Dovecot has dlclose()d this module - which would then call the
++	   now-unmapped free() function and crash (e.g. lib-dcrypt's test-crypto
++	   and test-stream). There it must not be called; OPENSSL_INIT_NO_ATEXIT
++	   already prevents any exit-time cleanup. */
++#if OPENSSL_VERSION_NUMBER < 0x40000000L
+ 	OPENSSL_cleanup();
++#endif
+ 	return FALSE;
+ }
+ 

diff --git a/dovecot.spec b/dovecot.spec
index f812e0d..a36f2b4 100644
--- a/dovecot.spec
+++ b/dovecot.spec
@@ -6,7 +6,7 @@ Name: dovecot
 Epoch: 1
 Version: 2.4.4
 %global prever %{nil}
-Release: 5%{?dist}
+Release: 6%{?dist}
 #dovecot itself is MIT, a few sources are PD, pigeonhole is LGPLv2
 License: MIT AND LGPL-2.1-only
 
@@ -52,6 +52,9 @@ Patch24: dovecot-2.4.2-fixbuild.patch
 # temporary workaround for s390x build test failure
 # https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/FZBVU55TK5332SMZSSDNWIVJCWGUAJQS/
 Patch25: dovecot-2.4.2-ftbfs-workaround.patch
+# openssl 4.0 FTBFS fix, form upsteam, for <= 2.4.4
+# https://github.com/dovecot/core/commit/fda272dc196d368625c425d309ca77241dbf50a1
+Patch26: dovecot-2.4.4-openssl4.patch
 
 BuildRequires: gcc, gcc-c++, openssl-devel, pam-devel, zlib-devel, bzip2-devel, libcap-devel
 BuildRequires: libtool, autoconf, automake, pkgconfig
@@ -163,6 +166,7 @@ mv dovecot-pigeonhole-%{pigeonholever} dovecot-pigeonhole
 %patch -P 23 -p2 -b .nolibotp
 %patch -P 24 -p1 -b .fixbuild
 %patch -P 25 -p1 -b .ftbfs-workaround
+%patch -P 26 -p1 -b .openssl4
 cp run-test-valgrind.supp dovecot-pigeonhole/
 # valgrind would fail with shell wrapper
 echo "testsuite" >dovecot-pigeonhole/run-test-valgrind.exclude
@@ -489,7 +493,10 @@ make check ||:
 %{_libdir}/%{name}/dict/libdriver_pgsql.so
 
 %changelog
-* Thu Jun 25 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.4.4-5
+* Thu Jul 23 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.4.4-6
+- fix FTBFS caused by openssl 4.0
+
+* Thu Jul 16 2026 Michal Hlavinka <mhlavink@redhat.com> - 1:2.4.4-5
 - F45+ obsolete dovecot-fts-xapian (PR#9) as it is no longer maintained,
   included fts flatcurve is a possible replacement