[rpms/trafficserver] rawhide: Remove accepted patches, fix current build issues, remove old workarounds to prep for 10.2.0 shortly

[rpms/trafficserver] rawhide: Remove accepted patches, fix current build issues, remove old workarounds to prep for 10.2.0 shortly

[Jered Floyd]

A new commit has been pushed.

Repo   : rpms/trafficserver
Branch : rawhide
Commit : 11474591b75d3aa8731ed73aab6d90e42b2fe5c3
Author : Jered Floyd <jered@redhat.com>
Date   : 2026-08-11T14:51:10+00:00
Stats  : +31/-318 in 7 file(s)
URL    : https://src.fedoraproject.org/rpms/trafficserver/c/11474591b75d3aa8731ed73aab6d90e42b2fe5c3?branch=rawhide

Log:
Remove accepted patches, fix current build issues, remove old workarounds to prep for 10.2.0 shortly

---
diff --git a/convert-ip-to-bind.patch b/convert-ip-to-bind.patch
deleted file mode 100644
index 99461f7..0000000
--- a/convert-ip-to-bind.patch
+++ /dev/null
@@ -1,56 +0,0 @@
---- tests/gold_tests/records/gold/renamed_records.gold
-+++ tests/gold_tests/records/gold/renamed_records.gold
-@@ -1,5 +1,5 @@
- ```
--┌■ 8 Renamed records:
-+┌■ 11 Renamed records:
- └┬──» #1 : proxy.config.output.logfile -> proxy.config.output.logfile.name
-  ├──» #2 : proxy.config.exec_thread.autoconfig -> proxy.config.exec_thread.autoconfig.enabled
-  ├──» #3 : proxy.config.hostdb -> proxy.config.hostdb.enabled
-@@ -7,5 +7,8 @@
-  ├──» #5 : proxy.config.ssl.origin_session_cache -> proxy.config.ssl.origin_session_cache.enabled
-  ├──» #6 : proxy.config.ssl.session_cache -> proxy.config.ssl.session_cache.mode
-  ├──» #7 : proxy.config.ssl.TLSv1_3 -> proxy.config.ssl.TLSv1_3.enabled
-- └──» #8 : proxy.config.ssl.client.TLSv1_3 -> proxy.config.ssl.client.TLSv1_3.enabled
-+ ├──» #8 : proxy.config.ssl.client.TLSv1_3 -> proxy.config.ssl.client.TLSv1_3.enabled
-+ ├──» #9 : proxy.local.incoming_ip_to_bind -> proxy.config.incoming_ip_to_bind
-+ ├──» #10 : proxy.local.outgoing_ip_to_bind -> proxy.config.outgoing_ip_to_bind
-+ └──» #11 : proxy.local.http.parent_proxy.disable_connect_tunneling -> proxy.config.http.parent_proxy.disable_connect_tunneling
- ```
---- tests/gold_tests/records/gold/renamed_records.yaml
-+++ tests/gold_tests/records/gold/renamed_records.yaml
-@@ -4,6 +4,11 @@ records:
-       enabled: 1
-   hostdb:
-     enabled: 1
-+  http:
-+    parent_proxy:
-+      disable_connect_tunneling: 0
-+  incoming_ip_to_bind: 0.0.0.0
-+  outgoing_ip_to_bind: 0.0.0.0
-   output:
-     logfile:
-       name: traffic.out
---- tests/gold_tests/records/legacy_config/old_records.config
-+++ tests/gold_tests/records/legacy_config/old_records.config
-@@ -7,3 +7,6 @@ CONFIG proxy.config.ssl.origin_session_cache INT 0
- CONFIG proxy.config.ssl.session_cache INT 0
- CONFIG proxy.config.ssl.TLSv1_3 INT 0
- CONFIG proxy.config.ssl.client.TLSv1_3 INT 0
-+CONFIG proxy.local.incoming_ip_to_bind STRING 0.0.0.0
-+CONFIG proxy.local.outgoing_ip_to_bind STRING 0.0.0.0
-+CONFIG proxy.local.http.parent_proxy.disable_connect_tunneling INT 0
---- tools/records/convert2yaml.py
-+++ tools/records/convert2yaml.py
-@@ -48,7 +48,10 @@
-     'proxy.config.ssl.origin_session_cache': 'proxy.config.ssl.origin_session_cache.enabled',
-     'proxy.config.ssl.session_cache': 'proxy.config.ssl.session_cache.mode',
-     'proxy.config.ssl.TLSv1_3': 'proxy.config.ssl.TLSv1_3.enabled',
--    'proxy.config.ssl.client.TLSv1_3': 'proxy.config.ssl.client.TLSv1_3.enabled'
-+    'proxy.config.ssl.client.TLSv1_3': 'proxy.config.ssl.client.TLSv1_3.enabled',
-+    'proxy.local.incoming_ip_to_bind': 'proxy.config.incoming_ip_to_bind',
-+    'proxy.local.outgoing_ip_to_bind': 'proxy.config.outgoing_ip_to_bind',
-+    'proxy.local.http.parent_proxy.disable_connect_tunneling': 'proxy.config.http.parent_proxy.disable_connect_tunneling'
- }
- 
- ###############################################################################################

diff --git a/fastlz-cast.patch b/fastlz-cast.patch
new file mode 100644
index 0000000..afb8fc4
--- /dev/null
+++ b/fastlz-cast.patch
@@ -0,0 +1,11 @@
+--- lib/fastlz/fastlz.cc.orig	2026-08-11 13:28:37.082400955 +0000
++++ lib/fastlz/fastlz.cc	2026-08-11 13:30:18.842803728 +0000
+@@ -162,7 +162,7 @@
+ }
+ 
+ /* special case of memcpy: exactly MAX_COPY bytes */
+-static void flz_maxcopy(void* dest, const void* src) {
++static void flz_maxcopy(uint8_t* dest, const uint8_t* src) {
+ #if defined(FLZ_ARCH64)
+   const uint32_t* p = (const uint32_t*)src;
+   uint32_t* q = (uint32_t*)dest;

diff --git a/kernel-72-errno.patch b/kernel-72-errno.patch
new file mode 100644
index 0000000..dd5a833
--- /dev/null
+++ b/kernel-72-errno.patch
@@ -0,0 +1,11 @@
+--- lib/swoc/unit_tests/test_bw_format.cc	2026-08-11 13:18:40.628212580 +0000
++++ lib/swoc/unit_tests/test_bw_format.cc	2026-08-11 13:18:54.252399059 +0000
+@@ -525,7 +525,7 @@
+ 
+   w.print("{}", swoc::bwf::Errno(13));
+   REQUIRE(w.view() == "EACCES: Permission denied [13]"sv);
+-  w.clear().print("{}", swoc::bwf::Errno(134));
++  w.clear().print("{}", swoc::bwf::Errno(192));
+   REQUIRE(w.view().substr(0, 22) == "Unknown: Unknown error"sv);
+   w.clear().print("{:s}", swoc::bwf::Errno(13));
+   REQUIRE(w.view() == "EACCES: Permission denied"sv);

diff --git a/openssl4.patch b/openssl4.patch
deleted file mode 100644
index b83a241..0000000
--- a/openssl4.patch
+++ /dev/null
@@ -1,199 +0,0 @@
---- src/tscore/X509HostnameValidator.cc.orig	2026-07-25 02:15:34.822042537 +0000
-+++ src/tscore/X509HostnameValidator.cc	2026-07-25 02:15:32.185006059 +0000
-@@ -205,12 +205,12 @@
- {
-   bool retval = false;
- 
--  if (!a->data || !a->length || cmp_type != a->type) {
-+  if (!ASN1_STRING_get0_data(a) || !ASN1_STRING_length(a) || cmp_type != ASN1_STRING_type(a)) {
-     return false;
-   }
--  retval = equal(a->data, a->length, b, blen);
-+  retval = equal(ASN1_STRING_get0_data(a), ASN1_STRING_length(a), b, blen);
-   if (retval && peername) {
--    *peername = ats_strndup((char *)a->data, a->length);
-+    *peername = ats_strndup((char *)ASN1_STRING_get0_data(a), ASN1_STRING_length(a));
-   }
-   return retval;
- }
-@@ -218,11 +218,11 @@
- bool
- validate_hostname(X509 *x, const unsigned char *hostname, bool is_ip, char **peername)
- {
--  GENERAL_NAMES *gens = nullptr;
--  X509_NAME     *name = nullptr;
--  int            i;
--  int            alt_type;
--  bool           retval = false;
-+  GENERAL_NAMES   *gens = nullptr;
-+  const X509_NAME *name = nullptr;
-+  int             i;
-+  int             alt_type;
-+  bool            retval = false;
-   ;
-   equal_fn equal;
-   size_t   hostname_len = strlen((char *)hostname);
-@@ -267,9 +267,9 @@
-   name = X509_get_subject_name(x);
- 
-   while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
--    ASN1_STRING   *str;
--    int            astrlen;
--    unsigned char *astr;
-+    const ASN1_STRING   *str;
-+    int                 astrlen;
-+    unsigned char       *astr;
-     str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
-     // Convert to UTF-8
-     astrlen = ASN1_STRING_to_UTF8(&astr, str);
---- src/iocore/net/SSLNetVConnection.cc.orig	2026-07-25 02:24:07.789952688 +0000
-+++ src/iocore/net/SSLNetVConnection.cc	2026-07-25 02:25:36.161167556 +0000
-@@ -167,7 +167,7 @@
- }
- 
- static void
--debug_certificate_name(const char *msg, X509_NAME *name)
-+debug_certificate_name(const char *msg, const X509_NAME *name)
- {
-   BIO *bio;
- 
---- src/iocore/net/SSLUtils.cc.orig	2026-07-25 02:25:58.022467139 +0000
-+++ src/iocore/net/SSLUtils.cc	2026-07-25 02:37:47.633108283 +0000
-@@ -1104,7 +1104,7 @@
- } /* CheckServerCertNow() */
- 
- static char *
--asn1_strdup(ASN1_STRING *s)
-+asn1_strdup(const ASN1_STRING *s)
- {
-   // Make sure we have an 8-bit encoding.
-   ink_assert(ASN1_STRING_type(s) == V_ASN1_IA5STRING || ASN1_STRING_type(s) == V_ASN1_UTF8STRING ||
-@@ -2407,7 +2407,7 @@
- 
-     std::set<std::string> name_set;
-     // Grub through the names in the certs
--    X509_NAME *subject = nullptr;
-+    const X509_NAME *subject = nullptr;
- 
-     // Insert a key for the subject CN.
-     subject = X509_get_subject_name(cert);
-@@ -2420,8 +2420,8 @@
-           break;
-         }
- 
--        X509_NAME_ENTRY *e  = X509_NAME_get_entry(subject, pos);
--        ASN1_STRING     *cn = X509_NAME_ENTRY_get_data(e);
-+        const X509_NAME_ENTRY *e  = X509_NAME_get_entry(subject, pos);
-+        const ASN1_STRING     *cn = X509_NAME_ENTRY_get_data(e);
-         subj_name           = asn1_strdup(cn);
- 
-         Dbg(dbg_ctl_ssl_load, "subj '%s' in certificate %s %p", subj_name.get(), data.cert_names_list[i].c_str(), cert);
---- src/iocore/net/OCSPStapling.cc.orig	2026-07-25 02:41:18.458968716 +0000
-+++ src/iocore/net/OCSPStapling.cc	2026-07-25 02:42:21.478823756 +0000
-@@ -489,7 +489,7 @@
-   }
- 
-   /* Calculate the issuerKey hash, excluding tag and length */
--  if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, nullptr)) {
-+  if (!EVP_Digest(ASN1_STRING_get0_data(issuerKey), ASN1_STRING_length(issuerKey), md, &i, dgst, nullptr)) {
-     goto err;
-   }
- 
-@@ -515,7 +515,7 @@
- {
-   const X509_NAME    *iname;
-   const ASN1_INTEGER *serial;
--  ASN1_BIT_STRING    *ikey;
-+  const ASN1_BIT_STRING    *ikey;
- 
-   if (!dgst) {
-     dgst = EVP_sha1();
---- src/api/InkAPI.cc.orig	2026-07-25 02:59:52.703119493 +0000
-+++ src/api/InkAPI.cc	2026-07-25 03:00:42.523798053 +0000
-@@ -8307,9 +8307,9 @@
-     }
- 
-     // Extract common name
--    int              pos              = X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName, -1);
--    X509_NAME_ENTRY *common_name      = X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
--    ASN1_STRING     *common_name_asn1 = X509_NAME_ENTRY_get_data(common_name);
-+    const int              pos              = X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName, -1);
-+    const X509_NAME_ENTRY *common_name      = X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
-+    const ASN1_STRING     *common_name_asn1 = X509_NAME_ENTRY_get_data(common_name);
-     char *common_name_str = reinterpret_cast<char *>(const_cast<unsigned char *>(ASN1_STRING_get0_data(common_name_asn1)));
-     if (ASN1_STRING_length(common_name_asn1) != static_cast<int>(strlen(common_name_str))) {
-       // Embedded null char
---- plugins/experimental/sslheaders/expand.cc.orig	2026-07-25 03:13:24.680182258 +0000
-+++ plugins/experimental/sslheaders/expand.cc	2026-07-25 03:15:55.953244848 +0000
-@@ -49,14 +49,14 @@
- static void
- x509_expand_subject(X509 *x509, BIO *bio)
- {
--  X509_NAME *name = X509_get_subject_name(x509);
-+  const X509_NAME *name = X509_get_subject_name(x509);
-   X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
- }
- 
- static void
- x509_expand_issuer(X509 *x509, BIO *bio)
- {
--  X509_NAME *name = X509_get_issuer_name(x509);
-+  const X509_NAME *name = X509_get_issuer_name(x509);
-   X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
- }
- 
-@@ -72,8 +72,8 @@
- {
-   const ASN1_BIT_STRING *sig;
-   X509_get0_signature(&sig, nullptr, x509);
--  const char *ptr = reinterpret_cast<const char *>(sig->data);
--  const char *end = ptr + sig->length;
-+  const char *ptr = reinterpret_cast<const char *>(ASN1_STRING_get0_data(sig));
-+  const char *end = ptr + ASN1_STRING_length(sig);
- 
-   // The canonical OpenSSL way to format the signature seems to be
-   // X509_signature_dump(). However that separates each byte with a ':', which is
---- plugins/certifier/certifier.cc.orig	2026-07-25 03:26:32.808935744 +0000
-+++ plugins/certifier/certifier.cc	2026-07-25 04:02:32.880866169 +0000
-@@ -372,12 +372,18 @@
-   X509_gmtime_adj(X509_get_notAfter(cert.get()), static_cast<long>(3650) * 24 * 3600);
- 
-   // Get handle to subject name
--  X509_NAME *n = X509_get_subject_name(cert.get());
-+  X509_NAME *n = X509_NAME_dup(X509_get_subject_name(cert.get()));
-   // Set common name field
-   if (X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (unsigned char *)commonName.c_str(), -1, -1, 0) != 1) {
-     TSError("[%s] %s: failed to add certificate subject CN", PLUGIN_NAME, __func__);
-     return nullptr;
-   }
-+  if (X509_set_subject_name(cert.get(), n) != 1) {
-+    TSError("[%s] %s: failed to set certificate subject", PLUGIN_NAME, __func__);
-+    X509_NAME_free(n);
-+    return nullptr;
-+  }
-+  X509_NAME_free(n);
- 
-   // Set Traffic Server public key
-   if (X509_set_pubkey(cert.get(), ca_pkey_scoped.get()) == 0) {
---- plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc.orig	2026-07-25 04:25:19.072669506 +0000
-+++ plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc	2026-07-25 04:26:01.238251075 +0000
-@@ -65,7 +65,7 @@
-         // expiration date, serial number, common name, and subject alternative names
-         const ASN1_TIME    *not_after    = X509_get_notAfter(cert);
-         const ASN1_INTEGER *serial       = X509_get_serialNumber(cert);
--        X509_NAME          *subject_name = X509_get_subject_name(cert);
-+        const X509_NAME    *subject_name = X509_get_subject_name(cert);
- 
-         // Subject name
-         BIO *subject_bio = BIO_new(BIO_s_mem());
---- plugins/experimental/txn_box/plugin/src/ts_util.cc.orig	2026-07-25 04:37:47.324945887 +0000
-+++ plugins/experimental/txn_box/plugin/src/ts_util.cc	2026-07-25 04:39:21.571239702 +0000
-@@ -1106,7 +1106,7 @@
- namespace
- {
-   TextView
--  ssl_value_for(X509_NAME *name, int nid)
-+  ssl_value_for(const X509_NAME *name, int nid)
-   {
-     if (int loc = X509_NAME_get_index_by_NID(name, nid, -1); loc >= 0) {
-       if (auto entry = X509_NAME_get_entry(name, loc); entry != nullptr) {

diff --git a/remove-openssl-engine.patch b/remove-openssl-engine.patch
deleted file mode 100644
index 0361ee5..0000000
--- a/remove-openssl-engine.patch
+++ /dev/null
@@ -1,28 +0,0 @@
---- src/iocore/net/SSLUtils.cc	2025-01-09 22:39:31.823534630 +0000
-+++ src/iocore/net/SSLUtils.cc	2025-01-09 22:40:21.834084401 +0000
-@@ -65,7 +65,6 @@
- #include <openssl/conf.h>
- #include <openssl/dh.h>
- #include <openssl/ec.h>
--#include <openssl/engine.h>
- #include <openssl/err.h>
- #include <openssl/evp.h>
- #include <openssl/pem.h>
-@@ -866,16 +865,7 @@
- SSLPostConfigInitialize()
- {
-   if (SSLConfigParams::engine_conf_file) {
--#if HAVE_ENGINE_LOAD_DYNAMIC
--    ENGINE_load_dynamic();
--#endif
--
--    OPENSSL_load_builtin_modules();
--    if (CONF_modules_load_file(SSLConfigParams::engine_conf_file, nullptr, 0) <= 0) {
--      char err_buf[256] = {0};
--      ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf));
--      Error("Could not load SSL engine configuration file %s: %s", SSLConfigParams::engine_conf_file, err_buf);
--    }
-+    Error("OpenSSL engines no longer supported; please remove engine_conf_file.");
-   }
- }
- 

diff --git a/remove-rpath.patch b/remove-rpath.patch
deleted file mode 100644
index ade6e28..0000000
--- a/remove-rpath.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- CMakeLists.txt	2024-11-15 23:55:31.179190618 +0000
-+++ CMakeLists.txt	2024-11-15 23:55:53.939278178 +0000
-@@ -588,10 +588,6 @@
-   set(THREADS_PREFER_PTHREAD_FLAG ON)
- endif()
- 
--# Set the rpath for installed binaries
--set(CMAKE_INSTALL_RPATH "${CMAKE_INSTALL_PREFIX}/lib;${CMAKE_INSTALL_PREFIX}/lib64")
--set(CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
--
- add_compile_definitions(${HOST_OS} PACKAGE_NAME="Apache Traffic Server" PACKAGE_VERSION="${TS_VERSION_STRING}")
- add_compile_options($<$<COMPILE_LANGUAGE:CXX>:-Wno-invalid-offsetof>)
- 

diff --git a/trafficserver.spec b/trafficserver.spec
index 67715e0..8f85495 100644
--- a/trafficserver.spec
+++ b/trafficserver.spec
@@ -10,6 +10,7 @@ Summary:        Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy 
 License:        Apache-2.0
 URL:            https://trafficserver.apache.org/
 Source0:        http://www.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2
+Source1:        http://www.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2.asc
 Source2:        https://downloads.apache.org/trafficserver/KEYS
 Source3:        %{name}.service
 Source4:        %{name}.sysusers
@@ -23,10 +24,9 @@ Source10:       %{name}-10-update.service
 # Use Crypto Policies, don't set rpath as per Fedora policy
 Patch0:         trafficserver-crypto-policy.patch
 Patch1:         fix-rpath.patch
-# Patch2:         remove-openssl-engine.patch
-Patch3:         config-path-fix.patch
-# Patch4:         convert-ip-to-bind.patch
-Patch5:         openssl4.patch
+Patch2:         config-path-fix.patch
+Patch3:         kernel-72-errno.patch
+Patch4:         fastlz-cast.patch
 
 # Upstream does not support 32-bit architectures:
 # https://github.com/apache/trafficserver/issues/4432
@@ -41,22 +41,12 @@ BuildRequires:  cmake
 BuildRequires:  libcap-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  openssl-devel
-# pcre is removed from RHEL 10
-%if 0%{?rhel} >= 10 || 0%{?fedora} >= 44
-%else
-BuildRequires:  pcre-devel
-%endif
 BuildRequires:  yaml-cpp-devel
 
 Requires:       expat hwloc pcre2 xz ncurses pkgconfig
 Requires:       openssl
 Requires:       systemd
 Requires(postun): systemd
-# pcre is removed from RHEL 10
-%if 0%{?rhel} >= 10
-%else
-Requires:  pcre
-%endif
 # For convert2yaml.py
 Requires:       python3 python3-colorama python3-jsonschema python3-pyyaml
 
@@ -65,7 +55,7 @@ Requires:       (%{name}-selinux = %{version}-%{release} if selinux-policy-%{sel
 %endif
 
 # swoc is not separately packaged for Fedora -- literally nothing else uses this
-Provides:       bundled(swoc) =  1.5.12
+Provides:       bundled(swoc) =  1.5.15
 
 # Exclude our own internal libraries from requires
 %global __requires_exclude ^lib(swoc.*|ts.*)\\.so.*$
@@ -124,19 +114,13 @@ hadling ESI requests to providing a different caching algorithm.
 
 
 %prep
+%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 
 %autosetup -p0
 rm -r lib/yamlcpp
 
 %build
 
-# This is not working properly with cmake for an unclear reason; linking fails
-%define _lto_cflags %{nil}
-# GCC 16 is finding something maybe bad but impossible to debu
-%if 0%{?fedora} >= 44
-%define  _pkg_extra_cxxflags -Wno-error=maybe-uninitialized
-%endif
-
 %cmake \
     -DCMAKE_BUILD_TYPE=Release \
     -DCMAKE_INSTALL_PREFIX=/usr \
@@ -284,6 +268,9 @@ fi
 
 
 %changelog
+* Tue Aug 11 2026 Jered Floyd <jered@redhat.com> - 10.2.0-1
+- Update to upstream 10.2.0
+
 * Wed Jul 15 2026 Jered Floyd <jered@redhat.com> - 10.1.3-1
 - Update to upstream 10.1.3