[rpms/trafficserver] f43: Test build for 10.2.x branch

[Jered Floyd <jered@redhat.com>]

A new commit has been pushed.

Repo   : rpms/trafficserver
Branch : f43
Commit : 061b5835972a419e36e019a59d4db476b7cf2a24
Author : Jered Floyd <jered@redhat.com>
Date   : 2026-07-28T12:37:28+00:00
Stats  : +204/-6 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/trafficserver/c/061b5835972a419e36e019a59d4db476b7cf2a24?branch=f43

Log:
Test build for 10.2.x branch

---
diff --git a/openssl4.patch b/openssl4.patch
new file mode 100644
index 0000000..b83a241
--- /dev/null
+++ b/openssl4.patch
@@ -0,0 +1,199 @@
+--- src/tscore/X509HostnameValidator.cc.orig	2026-07-25 02:15:34.822042537 +0000
++++ src/tscore/X509HostnameValidator.cc	2026-07-25 02:15:32.185006059 +0000
+@@ -205,12 +205,12 @@
+ {
+   bool retval = false;
+ 
+-  if (!a->data || !a->length || cmp_type != a->type) {
++  if (!ASN1_STRING_get0_data(a) || !ASN1_STRING_length(a) || cmp_type != ASN1_STRING_type(a)) {
+     return false;
+   }
+-  retval = equal(a->data, a->length, b, blen);
++  retval = equal(ASN1_STRING_get0_data(a), ASN1_STRING_length(a), b, blen);
+   if (retval && peername) {
+-    *peername = ats_strndup((char *)a->data, a->length);
++    *peername = ats_strndup((char *)ASN1_STRING_get0_data(a), ASN1_STRING_length(a));
+   }
+   return retval;
+ }
+@@ -218,11 +218,11 @@
+ bool
+ validate_hostname(X509 *x, const unsigned char *hostname, bool is_ip, char **peername)
+ {
+-  GENERAL_NAMES *gens = nullptr;
+-  X509_NAME     *name = nullptr;
+-  int            i;
+-  int            alt_type;
+-  bool           retval = false;
++  GENERAL_NAMES   *gens = nullptr;
++  const X509_NAME *name = nullptr;
++  int             i;
++  int             alt_type;
++  bool            retval = false;
+   ;
+   equal_fn equal;
+   size_t   hostname_len = strlen((char *)hostname);
+@@ -267,9 +267,9 @@
+   name = X509_get_subject_name(x);
+ 
+   while ((i = X509_NAME_get_index_by_NID(name, NID_commonName, i)) >= 0) {
+-    ASN1_STRING   *str;
+-    int            astrlen;
+-    unsigned char *astr;
++    const ASN1_STRING   *str;
++    int                 astrlen;
++    unsigned char       *astr;
+     str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, i));
+     // Convert to UTF-8
+     astrlen = ASN1_STRING_to_UTF8(&astr, str);
+--- src/iocore/net/SSLNetVConnection.cc.orig	2026-07-25 02:24:07.789952688 +0000
++++ src/iocore/net/SSLNetVConnection.cc	2026-07-25 02:25:36.161167556 +0000
+@@ -167,7 +167,7 @@
+ }
+ 
+ static void
+-debug_certificate_name(const char *msg, X509_NAME *name)
++debug_certificate_name(const char *msg, const X509_NAME *name)
+ {
+   BIO *bio;
+ 
+--- src/iocore/net/SSLUtils.cc.orig	2026-07-25 02:25:58.022467139 +0000
++++ src/iocore/net/SSLUtils.cc	2026-07-25 02:37:47.633108283 +0000
+@@ -1104,7 +1104,7 @@
+ } /* CheckServerCertNow() */
+ 
+ static char *
+-asn1_strdup(ASN1_STRING *s)
++asn1_strdup(const ASN1_STRING *s)
+ {
+   // Make sure we have an 8-bit encoding.
+   ink_assert(ASN1_STRING_type(s) == V_ASN1_IA5STRING || ASN1_STRING_type(s) == V_ASN1_UTF8STRING ||
+@@ -2407,7 +2407,7 @@
+ 
+     std::set<std::string> name_set;
+     // Grub through the names in the certs
+-    X509_NAME *subject = nullptr;
++    const X509_NAME *subject = nullptr;
+ 
+     // Insert a key for the subject CN.
+     subject = X509_get_subject_name(cert);
+@@ -2420,8 +2420,8 @@
+           break;
+         }
+ 
+-        X509_NAME_ENTRY *e  = X509_NAME_get_entry(subject, pos);
+-        ASN1_STRING     *cn = X509_NAME_ENTRY_get_data(e);
++        const X509_NAME_ENTRY *e  = X509_NAME_get_entry(subject, pos);
++        const ASN1_STRING     *cn = X509_NAME_ENTRY_get_data(e);
+         subj_name           = asn1_strdup(cn);
+ 
+         Dbg(dbg_ctl_ssl_load, "subj '%s' in certificate %s %p", subj_name.get(), data.cert_names_list[i].c_str(), cert);
+--- src/iocore/net/OCSPStapling.cc.orig	2026-07-25 02:41:18.458968716 +0000
++++ src/iocore/net/OCSPStapling.cc	2026-07-25 02:42:21.478823756 +0000
+@@ -489,7 +489,7 @@
+   }
+ 
+   /* Calculate the issuerKey hash, excluding tag and length */
+-  if (!EVP_Digest(issuerKey->data, issuerKey->length, md, &i, dgst, nullptr)) {
++  if (!EVP_Digest(ASN1_STRING_get0_data(issuerKey), ASN1_STRING_length(issuerKey), md, &i, dgst, nullptr)) {
+     goto err;
+   }
+ 
+@@ -515,7 +515,7 @@
+ {
+   const X509_NAME    *iname;
+   const ASN1_INTEGER *serial;
+-  ASN1_BIT_STRING    *ikey;
++  const ASN1_BIT_STRING    *ikey;
+ 
+   if (!dgst) {
+     dgst = EVP_sha1();
+--- src/api/InkAPI.cc.orig	2026-07-25 02:59:52.703119493 +0000
++++ src/api/InkAPI.cc	2026-07-25 03:00:42.523798053 +0000
+@@ -8307,9 +8307,9 @@
+     }
+ 
+     // Extract common name
+-    int              pos              = X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName, -1);
+-    X509_NAME_ENTRY *common_name      = X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
+-    ASN1_STRING     *common_name_asn1 = X509_NAME_ENTRY_get_data(common_name);
++    const int              pos              = X509_NAME_get_index_by_NID(X509_get_subject_name(cert.get()), NID_commonName, -1);
++    const X509_NAME_ENTRY *common_name      = X509_NAME_get_entry(X509_get_subject_name(cert.get()), pos);
++    const ASN1_STRING     *common_name_asn1 = X509_NAME_ENTRY_get_data(common_name);
+     char *common_name_str = reinterpret_cast<char *>(const_cast<unsigned char *>(ASN1_STRING_get0_data(common_name_asn1)));
+     if (ASN1_STRING_length(common_name_asn1) != static_cast<int>(strlen(common_name_str))) {
+       // Embedded null char
+--- plugins/experimental/sslheaders/expand.cc.orig	2026-07-25 03:13:24.680182258 +0000
++++ plugins/experimental/sslheaders/expand.cc	2026-07-25 03:15:55.953244848 +0000
+@@ -49,14 +49,14 @@
+ static void
+ x509_expand_subject(X509 *x509, BIO *bio)
+ {
+-  X509_NAME *name = X509_get_subject_name(x509);
++  const X509_NAME *name = X509_get_subject_name(x509);
+   X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
+ }
+ 
+ static void
+ x509_expand_issuer(X509 *x509, BIO *bio)
+ {
+-  X509_NAME *name = X509_get_issuer_name(x509);
++  const X509_NAME *name = X509_get_issuer_name(x509);
+   X509_NAME_print_ex(bio, name, 0 /* indent */, XN_FLAG_ONELINE);
+ }
+ 
+@@ -72,8 +72,8 @@
+ {
+   const ASN1_BIT_STRING *sig;
+   X509_get0_signature(&sig, nullptr, x509);
+-  const char *ptr = reinterpret_cast<const char *>(sig->data);
+-  const char *end = ptr + sig->length;
++  const char *ptr = reinterpret_cast<const char *>(ASN1_STRING_get0_data(sig));
++  const char *end = ptr + ASN1_STRING_length(sig);
+ 
+   // The canonical OpenSSL way to format the signature seems to be
+   // X509_signature_dump(). However that separates each byte with a ':', which is
+--- plugins/certifier/certifier.cc.orig	2026-07-25 03:26:32.808935744 +0000
++++ plugins/certifier/certifier.cc	2026-07-25 04:02:32.880866169 +0000
+@@ -372,12 +372,18 @@
+   X509_gmtime_adj(X509_get_notAfter(cert.get()), static_cast<long>(3650) * 24 * 3600);
+ 
+   // Get handle to subject name
+-  X509_NAME *n = X509_get_subject_name(cert.get());
++  X509_NAME *n = X509_NAME_dup(X509_get_subject_name(cert.get()));
+   // Set common name field
+   if (X509_NAME_add_entry_by_txt(n, "CN", MBSTRING_ASC, (unsigned char *)commonName.c_str(), -1, -1, 0) != 1) {
+     TSError("[%s] %s: failed to add certificate subject CN", PLUGIN_NAME, __func__);
+     return nullptr;
+   }
++  if (X509_set_subject_name(cert.get(), n) != 1) {
++    TSError("[%s] %s: failed to set certificate subject", PLUGIN_NAME, __func__);
++    X509_NAME_free(n);
++    return nullptr;
++  }
++  X509_NAME_free(n);
+ 
+   // Set Traffic Server public key
+   if (X509_set_pubkey(cert.get(), ca_pkey_scoped.get()) == 0) {
+--- plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc.orig	2026-07-25 04:25:19.072669506 +0000
++++ plugins/experimental/cert_reporting_tool/cert_reporting_tool.cc	2026-07-25 04:26:01.238251075 +0000
+@@ -65,7 +65,7 @@
+         // expiration date, serial number, common name, and subject alternative names
+         const ASN1_TIME    *not_after    = X509_get_notAfter(cert);
+         const ASN1_INTEGER *serial       = X509_get_serialNumber(cert);
+-        X509_NAME          *subject_name = X509_get_subject_name(cert);
++        const X509_NAME    *subject_name = X509_get_subject_name(cert);
+ 
+         // Subject name
+         BIO *subject_bio = BIO_new(BIO_s_mem());
+--- plugins/experimental/txn_box/plugin/src/ts_util.cc.orig	2026-07-25 04:37:47.324945887 +0000
++++ plugins/experimental/txn_box/plugin/src/ts_util.cc	2026-07-25 04:39:21.571239702 +0000
+@@ -1106,7 +1106,7 @@
+ namespace
+ {
+   TextView
+-  ssl_value_for(X509_NAME *name, int nid)
++  ssl_value_for(const X509_NAME *name, int nid)
+   {
+     if (int loc = X509_NAME_get_index_by_NID(name, nid, -1); loc >= 0) {
+       if (auto entry = X509_NAME_get_entry(name, loc); entry != nullptr) {

diff --git a/trafficserver.spec b/trafficserver.spec
index d578b37..67715e0 100644
--- a/trafficserver.spec
+++ b/trafficserver.spec
@@ -3,14 +3,13 @@
 %global selinuxtype targeted
 
 Name:           trafficserver
-Version:        10.1.3
+Version:        10.2.0
 Release:        1%{?dist}
 Summary:        Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server
 
 License:        Apache-2.0
 URL:            https://trafficserver.apache.org/
 Source0:        http://www.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2
-Source1:        http://www.apache.org/dist/%{name}/%{name}-%{version}.tar.bz2.asc
 Source2:        https://downloads.apache.org/trafficserver/KEYS
 Source3:        %{name}.service
 Source4:        %{name}.sysusers
@@ -24,9 +23,10 @@ Source10:       %{name}-10-update.service
 # Use Crypto Policies, don't set rpath as per Fedora policy
 Patch0:         trafficserver-crypto-policy.patch
 Patch1:         fix-rpath.patch
-Patch2:         remove-openssl-engine.patch
+# Patch2:         remove-openssl-engine.patch
 Patch3:         config-path-fix.patch
-Patch4:         convert-ip-to-bind.patch
+# Patch4:         convert-ip-to-bind.patch
+Patch5:         openssl4.patch
 
 # Upstream does not support 32-bit architectures:
 # https://github.com/apache/trafficserver/issues/4432
@@ -42,7 +42,7 @@ BuildRequires:  libcap-devel
 BuildRequires:  systemd-rpm-macros
 BuildRequires:  openssl-devel
 # pcre is removed from RHEL 10
-%if 0%{?rhel} >= 10
+%if 0%{?rhel} >= 10 || 0%{?fedora} >= 44
 %else
 BuildRequires:  pcre-devel
 %endif
@@ -124,7 +124,6 @@ hadling ESI requests to providing a different caching algorithm.
 
 
 %prep
-%{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}'
 
 %autosetup -p0
 rm -r lib/yamlcpp