diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/.gitignore b/.gitignore
index 99fc27e..d358878 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,6 @@ net-snmp-5.5.tar.gz
 /net-snmp-5.8.tar.gz
 /net-snmp-5.9.tar.gz
 /net-snmp-5.9.1.tar.gz
+/net-snmp-5.9.3.tar.gz
+/net-snmp-5.9.4.tar.gz
+/net-snmp-5.9.5.2.tar.gz
diff --git a/0001-Use-OpenSSL-accessors-for-opaque-structs.patch b/0001-Use-OpenSSL-accessors-for-opaque-structs.patch
new file mode 100644
index 0000000..fa1b973
--- /dev/null
+++ b/0001-Use-OpenSSL-accessors-for-opaque-structs.patch
@@ -0,0 +1,177 @@
+From 338d289f1e14650edf0bd7e960272871029131e1 Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Fri, 17 Apr 2026 12:47:18 -0400
+Subject: [PATCH] Use OpenSSL accessors for opaque structs
+
+Replaced direct access to `ASN1_STRING` fields with OpenSSL accessor functions
+(e.g., `ASN1_STRING_type`, `ASN1_STRING_length`, `ASN1_STRING_get0_data`) and
+updated `X509_NAME` and `X509_EXTENSION` pointers to `const`. This is required
+to maintain compatibility with newer OpenSSL versions (4.0+) where these
+structures were made opaque.
+
+Co-authored-by: Gemini <gemini@google.com>
+Signed-off-by: Simo Sorce <simo@redhat.com>
+---
+ snmplib/snmp_openssl.c | 74 ++++++++++++++++++++++--------------------
+ 1 file changed, 39 insertions(+), 35 deletions(-)
+
+diff --git a/snmplib/snmp_openssl.c b/snmplib/snmp_openssl.c
+index 4471a7a..658841a 100644
+--- a/snmplib/snmp_openssl.c
++++ b/snmplib/snmp_openssl.c
+@@ -147,7 +147,7 @@ void netsnmp_init_openssl(void) {
+ static char *
+ _cert_get_name(X509 *ocert, int which, char **buf, int *len, int flags)
+ {
+-    X509_NAME       *osubj_name;
++    const X509_NAME *osubj_name;
+     int              space;
+     char            *buf_ptr;
+ 
+@@ -187,7 +187,7 @@ _cert_get_name(X509 *ocert, int which, char **buf, int *len, int flags)
+ char *
+ netsnmp_openssl_cert_get_subjectName(X509 *ocert, char **buf, int *len)
+ {
+-    X509_NAME       *osubj_name;
++    const X509_NAME *osubj_name;
+     int              space;
+     char            *buf_ptr;
+ 
+@@ -233,11 +233,11 @@ netsnmp_openssl_cert_get_commonName(X509 *ocert, char **buf, int *len)
+ void
+ netsnmp_openssl_cert_dump_names(X509 *ocert)
+ {
+-    int              i, onid;
+-    X509_NAME_ENTRY *oname_entry;
+-    ASN1_STRING     *oname_value;
+-    X509_NAME       *osubj_name;
+-    const char      *prefix_short, *prefix_long;
++    int                   i, onid;
++    const X509_NAME_ENTRY *oname_entry;
++    const ASN1_STRING     *oname_value;
++    const X509_NAME       *osubj_name;
++    const char            *prefix_short, *prefix_long;
+ 
+     if (NULL == ocert)
+         return;
+@@ -253,7 +253,7 @@ netsnmp_openssl_cert_dump_names(X509 *ocert)
+         netsnmp_assert(NULL != oname_entry);
+         oname_value = X509_NAME_ENTRY_get_data(oname_entry);
+ 
+-        if (oname_value->type != V_ASN1_PRINTABLESTRING)
++        if (ASN1_STRING_type(oname_value) != V_ASN1_PRINTABLESTRING)
+             continue;
+ 
+         /** get NID */
+@@ -268,7 +268,7 @@ netsnmp_openssl_cert_dump_names(X509 *ocert)
+ 
+         DEBUGMSGT(("9:cert:dump:names",
+                    "[%02d] NID type %d, ASN type %d\n", i, onid,
+-                   oname_value->type));
++                   ASN1_STRING_type(oname_value)));
+         DEBUGMSGT(("9:cert:dump:names", "%s/%s: '%s'\n", prefix_long,
+                    prefix_short, ASN1_STRING_get0_data(oname_value)));
+     }
+@@ -276,7 +276,7 @@ netsnmp_openssl_cert_dump_names(X509 *ocert)
+ #endif /* NETSNMP_FEATURE_REMOVE_CERT_DUMP_NAMES */
+ 
+ static char *
+-_cert_get_extension(X509_EXTENSION  *oext, char **buf, int *len, int flags)
++_cert_get_extension(const X509_EXTENSION *oext, char **buf, int *len, int flags)
+ {
+     int              space;
+     char            *buf_ptr = NULL;
+@@ -327,10 +327,10 @@ out:
+  */
+ /** instead of exposing this function, make helper functions for each
+  * field, like netsnmp_openssl_cert_get_subjectAltName, below */
+-X509_EXTENSION  *
++const X509_EXTENSION  *
+ _cert_get_extension_at(X509 *ocert, int pos, char **buf, int *len, int flags)
+ {
+-    X509_EXTENSION  *oext;
++    const X509_EXTENSION  *oext;
+ 
+     if ((NULL == ocert) || ((buf && !len) || (len && !buf)))
+         return NULL;
+@@ -354,7 +354,7 @@ static char *
+ _cert_get_extension_str_at(X509 *ocert, int pos, char **buf, int *len,
+                            int flags)
+ {
+-    X509_EXTENSION  *oext;
++    const X509_EXTENSION  *oext;
+ 
+     if ((NULL == ocert) || ((buf && !len) || (len && !buf)))
+         return NULL;
+@@ -374,7 +374,7 @@ _cert_get_extension_str_at(X509 *ocert, int pos, char **buf, int *len,
+  */
+ /** instead of exposing this function, make helper functions for each
+  * field, like netsnmp_openssl_cert_get_subjectAltName, below */
+-X509_EXTENSION *
++const X509_EXTENSION *
+ _cert_get_extension_id(X509 *ocert, int which, char **buf, int *len, int flags)
+ {
+     int pos;
+@@ -434,27 +434,31 @@ _extract_oname(const GENERAL_NAME *oname)
+             break;
+ 
+         case GEN_IPADD:
+-            if (oname->d.iPAddress->length == 4) {
+-                sprintf(ipbuf, "%d.%d.%d.%d", oname->d.iPAddress->data[0],
+-                        oname->d.iPAddress->data[1],
+-                        oname->d.iPAddress->data[2],
+-                        oname->d.iPAddress->data[3]);
+-                rtn = strdup(ipbuf);
+-            }
+-            else if ((oname->d.iPAddress->length == 16) ||
+-                     (oname->d.iPAddress->length == 20)) {
+-                char *pos = ipbuf;
+-                int   j;
+-                for(j = 0; j < oname->d.iPAddress->length; ++j) {
+-                    *pos++ = VAL2HEX(oname->d.iPAddress->data[j]);
+-                    *pos++ = ':';
++            {
++                int ipaddr_len = ASN1_STRING_length(oname->d.iPAddress);
++                const unsigned char *ipaddr_data = ASN1_STRING_get0_data(oname->d.iPAddress);
++                if (ipaddr_len == 4) {
++                    sprintf(ipbuf, "%d.%d.%d.%d", ipaddr_data[0],
++                            ipaddr_data[1],
++                            ipaddr_data[2],
++                            ipaddr_data[3]);
++                    rtn = strdup(ipbuf);
++                }
++                else if ((ipaddr_len == 16) ||
++                         (ipaddr_len == 20)) {
++                    char *pos = ipbuf;
++                    int   j;
++                    for(j = 0; j < ipaddr_len; ++j) {
++                        *pos++ = VAL2HEX(ipaddr_data[j]);
++                        *pos++ = ':';
++                    }
++                    *pos = '\0';
++                    rtn = strdup(ipbuf);
+                 }
+-                *pos = '\0';
+-                rtn = strdup(ipbuf);
++                else
++                    NETSNMP_LOGONCE((LOG_WARNING, "unexpected ip addr length %d\n",
++                           ipaddr_len));
+             }
+-            else
+-                NETSNMP_LOGONCE((LOG_WARNING, "unexpected ip addr length %d\n",
+-                       oname->d.iPAddress->length));
+ 
+             break;
+         default:
+@@ -485,7 +489,7 @@ netsnmp_openssl_cert_get_subjectAltNames(X509 *ocert, char **buf, int *len)
+ void
+ netsnmp_openssl_cert_dump_extensions(X509 *ocert)
+ {
+-    X509_EXTENSION  *extension;
++    const X509_EXTENSION  *extension;
+     const char      *extension_name;
+     char             buf[SNMP_MAXBUF], *buf_ptr = buf, *str, *lf;
+     int              i, num_extensions, buf_len, nid;
+-- 
+2.53.0
+
diff --git a/net-snmp-5.7.3-iterator-fix.patch b/net-snmp-5.7.3-iterator-fix.patch
index fb34caf..0afd8bc 100644
--- a/net-snmp-5.7.3-iterator-fix.patch
+++ b/net-snmp-5.7.3-iterator-fix.patch
@@ -1,7 +1,8 @@
-diff -urNp old/agent/mibgroup/host/data_access/swrun.c new/agent/mibgroup/host/data_access/swrun.c
---- old/agent/mibgroup/host/data_access/swrun.c	2017-07-18 09:44:00.626109526 +0200
-+++ new/agent/mibgroup/host/data_access/swrun.c	2017-07-19 15:27:50.452255836 +0200
-@@ -102,6 +102,10 @@ swrun_count_processes_by_name( char *nam
+diff --git a/agent/mibgroup/host/data_access/swrun.c b/agent/mibgroup/host/data_access/swrun.c
+index 7b278eb..5f10ade 100644
+--- a/agent/mibgroup/host/data_access/swrun.c
++++ b/agent/mibgroup/host/data_access/swrun.c
+@@ -143,6 +143,10 @@ swrun_count_processes_by_name( char *name )
          return 0;    /* or -1 */
  
      it = CONTAINER_ITERATOR( swrun_container );
diff --git a/net-snmp-5.8-clientaddr-error-message.patch b/net-snmp-5.8-clientaddr-error-message.patch
index ef851b1..8de6386 100644
--- a/net-snmp-5.8-clientaddr-error-message.patch
+++ b/net-snmp-5.8-clientaddr-error-message.patch
@@ -1,7 +1,8 @@
-diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
---- a/snmplib/snmp_api.c	2020-11-26 11:05:51.084788775 +0100
-+++ b/snmplib/snmp_api.c	2020-11-26 11:08:27.850751397 +0100
-@@ -235,7 +235,7 @@ static const char *api_errors[-SNMPERR_M
+diff --git a/snmplib/snmp_api.c b/snmplib/snmp_api.c
+index ad30397..307253a 100644
+--- a/snmplib/snmp_api.c
++++ b/snmplib/snmp_api.c
+@@ -231,7 +231,7 @@ static const char *api_errors[-SNMPERR_MAX + 1] = {
      "No error",                 /* SNMPERR_SUCCESS */
      "Generic error",            /* SNMPERR_GENERR */
      "Invalid local port",       /* SNMPERR_BAD_LOCPORT */
@@ -10,7 +11,7 @@ diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
      "Unknown session",          /* SNMPERR_BAD_SESSION */
      "Too long",                 /* SNMPERR_TOO_LONG */
      "No socket",                /* SNMPERR_NO_SOCKET */
-@@ -1662,7 +1662,9 @@ _sess_open(netsnmp_session * in_session)
+@@ -1718,7 +1718,9 @@ _sess_open(netsnmp_session * in_session)
          DEBUGMSGTL(("_sess_open", "couldn't interpret peername\n"));
          in_session->s_snmp_errno = SNMPERR_BAD_ADDRESS;
          in_session->s_errno = errno;
@@ -21,10 +22,11 @@ diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
          return NULL;
      }
  
-diff -ruNp a/snmplib/transports/snmpUDPIPv4BaseDomain.c b/snmplib/transports/snmpUDPIPv4BaseDomain.c
---- a/snmplib/transports/snmpUDPIPv4BaseDomain.c	2021-01-06 12:51:51.948106797 +0100
-+++ b/snmplib/transports/snmpUDPIPv4BaseDomain.c	2021-01-06 14:17:31.029745744 +0100
-@@ -209,6 +209,8 @@ netsnmp_udpipv4base_transport_bind(netsn
+diff --git a/snmplib/transports/snmpUDPIPv4BaseDomain.c b/snmplib/transports/snmpUDPIPv4BaseDomain.c
+index 1e15a2f..47ac42e 100644
+--- a/snmplib/transports/snmpUDPIPv4BaseDomain.c
++++ b/snmplib/transports/snmpUDPIPv4BaseDomain.c
+@@ -224,6 +224,8 @@ netsnmp_udpipv4base_transport_bind(netsnmp_transport *t,
          DEBUGMSGTL(("netsnmp_udpbase",
                      "failed to bind for clientaddr: %d %s\n",
                      errno, strerror(errno)));
diff --git a/net-snmp-5.8-duplicate-ipAddress.patch b/net-snmp-5.8-duplicate-ipAddress.patch
index 075976a..8c833a7 100644
--- a/net-snmp-5.8-duplicate-ipAddress.patch
+++ b/net-snmp-5.8-duplicate-ipAddress.patch
@@ -1,7 +1,8 @@
-diff -urNp a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c
---- a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c	2020-06-10 13:27:03.213904398 +0200
-+++ b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c	2020-06-10 13:28:41.025863050 +0200
-@@ -121,6 +121,7 @@ _remove_duplicates(netsnmp_container *co
+diff --git a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c
+index 675d4ea..8d3708d 100644
+--- a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c
++++ b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c
+@@ -120,6 +120,7 @@ _remove_duplicates(netsnmp_container *container, u_int container_flags)
  	for (entry = ITERATOR_FIRST(it); entry; entry = ITERATOR_NEXT(it)) {
  		if (prev_entry && _access_ipaddress_entry_compare_addr(prev_entry, entry) == 0) {
  			/* 'entry' is duplicate of the previous one -> delete it */
diff --git a/net-snmp-5.8-expand-SNMPCONFPATH.patch b/net-snmp-5.8-expand-SNMPCONFPATH.patch
index a812cf4..f9132fe 100644
--- a/net-snmp-5.8-expand-SNMPCONFPATH.patch
+++ b/net-snmp-5.8-expand-SNMPCONFPATH.patch
@@ -1,7 +1,8 @@
-diff -ruNp a/snmplib/read_config.c b/snmplib/read_config.c
---- a/snmplib/read_config.c	2020-06-10 09:51:57.184786510 +0200
-+++ b/snmplib/read_config.c	2020-06-10 09:53:13.257507112 +0200
-@@ -1642,7 +1642,7 @@ snmp_save_persistent(const char *type)
+diff --git a/snmplib/read_config.c b/snmplib/read_config.c
+index 159f4be..fa8fcba 100644
+--- a/snmplib/read_config.c
++++ b/snmplib/read_config.c
+@@ -1688,7 +1688,7 @@ snmp_save_persistent(const char *type)
       * save a warning header to the top of the new file 
       */
      snprintf(fileold, sizeof(fileold),
diff --git a/net-snmp-5.8-ipAddress-faster-load.patch b/net-snmp-5.8-ipAddress-faster-load.patch
index db95998..32f9b60 100644
--- a/net-snmp-5.8-ipAddress-faster-load.patch
+++ b/net-snmp-5.8-ipAddress-faster-load.patch
@@ -1,7 +1,8 @@
-diff -urNp a/agent/mibgroup/mibII/ipAddr.c b/agent/mibgroup/mibII/ipAddr.c
---- a/agent/mibgroup/mibII/ipAddr.c	2020-06-10 14:14:30.113696471 +0200
-+++ b/agent/mibgroup/mibII/ipAddr.c	2020-06-10 14:27:15.345354018 +0200
-@@ -495,14 +495,16 @@ Address_Scan_Next(Index, Retin_ifaddr)
+diff --git a/agent/mibgroup/mibII/ipAddr.c b/agent/mibgroup/mibII/ipAddr.c
+index a89255f..ef67f5f 100644
+--- a/agent/mibgroup/mibII/ipAddr.c
++++ b/agent/mibgroup/mibII/ipAddr.c
+@@ -498,14 +498,16 @@ Address_Scan_Next(Index, Retin_ifaddr)
  }
  
  #elif defined(linux)
@@ -19,7 +20,7 @@ diff -urNp a/agent/mibgroup/mibII/ipAddr.c b/agent/mibgroup/mibII/ipAddr.c
  
      /* get info about all interfaces */
  
-@@ -510,28 +512,45 @@ Address_Scan_Init(void)
+@@ -513,28 +515,45 @@ Address_Scan_Init(void)
      SNMP_FREE(ifc.ifc_buf);
      ifr_counter = 0;
  
diff --git a/net-snmp-5.8-man-page.patch b/net-snmp-5.8-man-page.patch
deleted file mode 100644
index dc78e14..0000000
--- a/net-snmp-5.8-man-page.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff -urNp a/man/net-snmp-create-v3-user.1.def b/man/net-snmp-create-v3-user.1.def
---- a/man/net-snmp-create-v3-user.1.def	2020-06-10 13:43:18.443070961 +0200
-+++ b/man/net-snmp-create-v3-user.1.def	2020-06-10 13:49:25.975363441 +0200
-@@ -3,7 +3,7 @@
- net-snmp-create-v3-user \- create a SNMPv3 user in net-snmp configuration file
- .SH SYNOPSIS
- .PP
--.B net-snmp-create-v3-user [-ro] [-a authpass] [-x privpass] [-X DES|AES]
-+.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass] [-x DES|AES]
- .B [username]
- .SH DESCRIPTION
- .PP
-@@ -16,13 +16,16 @@ new user in net-snmp configuration file
- displays the net-snmp version number
- .TP
- \fB\-ro\fR
--create an user with read-only permissions
-+creates a user with read-only permissions
- .TP
--\fB\-a authpass\fR
--specify authentication password
-+\fB\-A authpass\fR
-+specifies the authentication password
- .TP
--\fB\-x privpass\fR
--specify encryption password
-+\fB\-a MD5|SHA\fR
-+specifies the authentication password hashing algorithm
- .TP
--\fB\-X DES|AES\fR
--specify encryption algorithm
-+\fB\-X privpass\fR
-+specifies the encryption password
-+.TP
-+\fB\-x DES|AES\fR
-+specifies the encryption algorithm
diff --git a/net-snmp-5.8-rpm-memory-leak.patch b/net-snmp-5.8-rpm-memory-leak.patch
deleted file mode 100644
index 33b8d29..0000000
--- a/net-snmp-5.8-rpm-memory-leak.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff -urNp a/agent/mibgroup/host/data_access/swinst_rpm.c b/agent/mibgroup/host/data_access/swinst_rpm.c
---- a/agent/mibgroup/host/data_access/swinst_rpm.c	2020-06-10 14:32:43.330486233 +0200
-+++ b/agent/mibgroup/host/data_access/swinst_rpm.c	2020-06-10 14:35:46.672298741 +0200
-@@ -75,6 +75,9 @@ netsnmp_swinst_arch_init(void)
-     snprintf( pkg_directory, SNMP_MAXPATH, "%s/Packages", dbpath );
-     SNMP_FREE(rpmdbpath);
-     dbpath = NULL;
-+#ifdef HAVE_RPMGETPATH
-+    rpmFreeRpmrc();
-+#endif
-     if (-1 == stat( pkg_directory, &stat_buf )) {
-         snmp_log(LOG_ERR, "Can't find directory of RPM packages");
-         pkg_directory[0] = '\0';
-diff -urNp a/agent/mibgroup/host/hr_swinst.c b/agent/mibgroup/host/hr_swinst.c
---- a/agent/mibgroup/host/hr_swinst.c	2020-06-10 14:32:43.325486184 +0200
-+++ b/agent/mibgroup/host/hr_swinst.c	2020-06-10 14:36:44.423872418 +0200
-@@ -231,6 +231,9 @@ init_hr_swinst(void)
-             snprintf(path, sizeof(path), "%s/packages.rpm", swi->swi_dbpath);
-         path[ sizeof(path)-1 ] = 0;
-         swi->swi_directory = strdup(path);
-+#ifdef HAVE_RPMGETPATH
-+        rpmFreeRpmrc();
-+#endif
-     }
- #else
- #  ifdef _PATH_HRSW_directory
diff --git a/net-snmp-5.9-ECC-cert.patch b/net-snmp-5.9-ECC-cert.patch
deleted file mode 100644
index 5d43d4d..0000000
--- a/net-snmp-5.9-ECC-cert.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From a1968db524e087a36a19a351b89bf6f1633819aa Mon Sep 17 00:00:00 2001
-From: minfrin <minfrin@users.noreply.github.com>
-Date: Tue, 5 Jan 2021 23:17:14 +0000
-Subject: [PATCH] Add support for digests detected from ECC certificates
-
-Previously, the digest could be detected on RSA certificates only. This
-patch adds detection for ECC certificates.
-
-[ bvanassche: changed _htmap2 into a two-dimensional array and renamed _htmap2
-  back to _htmap ]
----
- snmplib/snmp_openssl.c | 60 +++++++++++++++++++++++++++++++++++-------
- 1 file changed, 50 insertions(+), 10 deletions(-)
-
-diff --git a/snmplib/snmp_openssl.c b/snmplib/snmp_openssl.c
-index c092a007a..432cb5c27 100644
---- a/snmplib/snmp_openssl.c
-+++ b/snmplib/snmp_openssl.c
-@@ -521,18 +521,54 @@ netsnmp_openssl_cert_dump_extensions(X509 *ocert)
-     }
- }
- 
--static int _htmap[NS_HASH_MAX + 1] = {
--    0, NID_md5WithRSAEncryption, NID_sha1WithRSAEncryption,
--    NID_sha224WithRSAEncryption, NID_sha256WithRSAEncryption,
--    NID_sha384WithRSAEncryption, NID_sha512WithRSAEncryption };
-+static const struct {
-+    uint16_t nid;
-+    uint16_t ht;
-+} _htmap[] = {
-+    { 0, NS_HASH_NONE },
-+#ifdef NID_md5WithRSAEncryption
-+    { NID_md5WithRSAEncryption, NS_HASH_MD5 },
-+#endif
-+#ifdef NID_sha1WithRSAEncryption
-+    { NID_sha1WithRSAEncryption, NS_HASH_SHA1 },
-+#endif
-+#ifdef NID_ecdsa_with_SHA1
-+    { NID_ecdsa_with_SHA1, NS_HASH_SHA1 },
-+#endif
-+#ifdef NID_sha224WithRSAEncryption
-+    { NID_sha224WithRSAEncryption, NS_HASH_SHA224 },
-+#endif
-+#ifdef NID_ecdsa_with_SHA224
-+    { NID_ecdsa_with_SHA224, NS_HASH_SHA224 },
-+#endif
-+#ifdef NID_sha256WithRSAEncryption
-+    { NID_sha256WithRSAEncryption, NS_HASH_SHA256 },
-+#endif
-+#ifdef NID_ecdsa_with_SHA256
-+    { NID_ecdsa_with_SHA256, NS_HASH_SHA256 },
-+#endif
-+#ifdef NID_sha384WithRSAEncryption
-+    { NID_sha384WithRSAEncryption, NS_HASH_SHA384 },
-+#endif
-+#ifdef NID_ecdsa_with_SHA384
-+    { NID_ecdsa_with_SHA384, NS_HASH_SHA384 },
-+#endif
-+#ifdef NID_sha512WithRSAEncryption
-+    { NID_sha512WithRSAEncryption, NS_HASH_SHA512 },
-+#endif
-+#ifdef NID_ecdsa_with_SHA512
-+    { NID_ecdsa_with_SHA512, NS_HASH_SHA512 },
-+#endif
-+};
- 
- int
- _nid2ht(int nid)
- {
-     int i;
--    for (i=1; i<= NS_HASH_MAX; ++i) {
--        if (nid == _htmap[i])
--            return i;
-+
-+    for (i = 0; i < sizeof(_htmap) / sizeof(_htmap[0]); i++) {
-+        if (_htmap[i].nid == nid)
-+            return _htmap[i].ht;
-     }
-     return 0;
- }
-@@ -541,9 +577,13 @@ _nid2ht(int nid)
- int
- _ht2nid(int ht)
- {
--    if ((ht < 0) || (ht > NS_HASH_MAX))
--        return 0;
--    return _htmap[ht];
-+    int i;
-+
-+    for (i = 0; i < sizeof(_htmap) / sizeof(_htmap[0]); i++) {
-+        if (_htmap[i].ht == ht)
-+            return _htmap[i].nid;
-+    }
-+    return 0;
- }
- #endif /* NETSNMP_FEATURE_REMOVE_OPENSSL_HT2NID */
- 
-
diff --git a/net-snmp-5.9-autofs-skip.patch b/net-snmp-5.9-autofs-skip.patch
index 0d054b2..bd5c560 100644
--- a/net-snmp-5.9-autofs-skip.patch
+++ b/net-snmp-5.9-autofs-skip.patch
@@ -1,5 +1,5 @@
 diff --git a/agent/mibgroup/host/hr_filesys.c b/agent/mibgroup/host/hr_filesys.c
-index 4f78df3..fd25b3f 100644
+index e7ca92f..80b3e0d 100644
 --- a/agent/mibgroup/host/hr_filesys.c
 +++ b/agent/mibgroup/host/hr_filesys.c
 @@ -704,6 +704,7 @@ static const char *HRFS_ignores[] = {
@@ -10,37 +10,3 @@ index 4f78df3..fd25b3f 100644
      "usbdevfs",
      "usbfs",
  #endif
-diff --git a/agent/mibgroup/host/hr_storage.c b/agent/mibgroup/host/hr_storage.c
-index 6b459ec..f7a376b 100644
---- a/agent/mibgroup/host/hr_storage.c
-+++ b/agent/mibgroup/host/hr_storage.c
-@@ -540,9 +540,10 @@ really_try_next:
- 
-         store_idx = name[ HRSTORE_ENTRY_NAME_LENGTH ];
-         if (store_idx > NETSNMP_MEM_TYPE_MAX ) {
--            if ( netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
-+            if ( (netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
-                                         NETSNMP_DS_AGENT_SKIPNFSINHOSTRESOURCES) &&
--                 Check_HR_FileSys_NFS())
-+                 Check_HR_FileSys_NFS()) ||
-+                 Check_HR_FileSys_AutoFs())
-                 return NULL;  /* or goto try_next; */
-             if (Check_HR_FileSys_AutoFs())
-                 return NULL;
-diff --git a/agent/mibgroup/host/hrh_storage.c b/agent/mibgroup/host/hrh_storage.c
-index 8967d35..9bf2659 100644
---- a/agent/mibgroup/host/hrh_storage.c
-+++ b/agent/mibgroup/host/hrh_storage.c
-@@ -366,9 +366,10 @@ really_try_next:
-         store_idx = name[ HRSTORE_ENTRY_NAME_LENGTH ];
-         if (HRFS_entry &&
- 	    store_idx > NETSNMP_MEM_TYPE_MAX &&
--            netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
-+            ((netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
-                                    NETSNMP_DS_AGENT_SKIPNFSINHOSTRESOURCES) &&
--            Check_HR_FileSys_NFS())
-+            Check_HR_FileSys_NFS()) ||
-+            Check_HR_FileSys_AutoFs()))
-             return NULL;
-         if (HRFS_entry && Check_HR_FileSys_AutoFs())
-             return NULL;
diff --git a/net-snmp-5.9-cflags.patch b/net-snmp-5.9-cflags.patch
index ef8604f..a48e9ca 100644
--- a/net-snmp-5.9-cflags.patch
+++ b/net-snmp-5.9-cflags.patch
@@ -1,17 +1,19 @@
-diff -urNp a/perl/Makefile.PL b/perl/Makefile.PL
---- a/perl/Makefile.PL	2020-08-26 08:32:52.498909823 +0200
-+++ b/perl/Makefile.PL	2020-08-26 09:30:45.584951552 +0200
+diff --git a/perl/Makefile.PL b/perl/Makefile.PL
+index 63e6333..82cedca 100644
+--- a/perl/Makefile.PL
++++ b/perl/Makefile.PL
 @@ -1,3 +1,4 @@
 +use lib '.';
  use strict;
  use warnings;
  use ExtUtils::MakeMaker;
-diff -urNp a/perl/MakefileSubs.pm b/perl/MakefileSubs.pm
---- a/perl/MakefileSubs.pm	2020-08-26 08:32:52.498909823 +0200
-+++ b/perl/MakefileSubs.pm	2020-08-26 08:36:44.097218448 +0200
-@@ -116,7 +116,7 @@ sub AddCommonParams {
- 	append($Params->{'CCFLAGS'}, $cflags);
- 	append($Params->{'CCFLAGS'}, $Config{'ccflags'});
+diff --git a/perl/MakefileSubs.pm b/perl/MakefileSubs.pm
+index 804b20e..25c5d67 100644
+--- a/perl/MakefileSubs.pm
++++ b/perl/MakefileSubs.pm
+@@ -126,7 +126,7 @@ sub AddCommonParams {
+ 	# Suppress warnings about old-style function definitions.
+ 	append($Params->{'CCFLAGS'}, '-Wno-old-style-definition');
  	# Suppress known Perl header shortcomings.
 -	$Params->{'CCFLAGS'} =~ s/ -W(cast-qual|write-strings)//g;
 +	$Params->{'CCFLAGS'} =~ s/ -W(inline|strict-prototypes|write-strings|cast-qual|no-char-subscripts)//g;
diff --git a/net-snmp-5.9-coverity.patch b/net-snmp-5.9-coverity.patch
deleted file mode 100644
index fa3e043..0000000
--- a/net-snmp-5.9-coverity.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff --git a/agent/mibgroup/disman/event/mteTrigger.c b/agent/mibgroup/disman/event/mteTrigger.c
-index e9a8831..5a1d8e7 100644
---- a/agent/mibgroup/disman/event/mteTrigger.c
-+++ b/agent/mibgroup/disman/event/mteTrigger.c
-@@ -1012,7 +1012,7 @@ mteTrigger_run( unsigned int reg, void *clientarg)
-                      * Similarly, if no fallEvent is configured,
-                      *  there's no point in trying to fire it either.
-                      */
--                    if (entry->mteTThRiseEvent[0] != '\0' ) {
-+                    if (entry->mteTThFallEvent[0] != '\0' ) {
-                         entry->mteTriggerXOwner   = entry->mteTThObjOwner;
-                         entry->mteTriggerXObjects = entry->mteTThObjects;
-                         entry->mteTriggerFired    = vp1;
-@@ -1105,7 +1105,7 @@ mteTrigger_run( unsigned int reg, void *clientarg)
-                      * Similarly, if no fallEvent is configured,
-                      *  there's no point in trying to fire it either.
-                      */
--                    if (entry->mteTThDRiseEvent[0] != '\0' ) {
-+                    if (entry->mteTThDFallEvent[0] != '\0' ) {
-                         entry->mteTriggerXOwner   = entry->mteTThObjOwner;
-                         entry->mteTriggerXObjects = entry->mteTThObjects;
-                         entry->mteTriggerFired    = vp1;
diff --git a/net-snmp-5.9-dir-fix.patch b/net-snmp-5.9-dir-fix.patch
index 00d531f..f7311ca 100644
--- a/net-snmp-5.9-dir-fix.patch
+++ b/net-snmp-5.9-dir-fix.patch
@@ -1,8 +1,8 @@
 diff --git a/net-snmp-create-v3-user.in b/net-snmp-create-v3-user.in
-index 452c269..afd6fa4 100644
+index 19895a1..ac3c60f 100644
 --- a/net-snmp-create-v3-user.in
 +++ b/net-snmp-create-v3-user.in
-@@ -16,6 +16,10 @@ Xalgorithm="DES"
+@@ -14,6 +14,10 @@ Xalgorithm="DES"
  token=rwuser
  
  while test "x$done" = "x" -a "x$1" != "x" -a "x$usage" != "xyes"; do
@@ -13,11 +13,17 @@ index 452c269..afd6fa4 100644
  
  unset shifted
  case $1 in
-@@ -136,7 +140,7 @@ fi
+@@ -134,11 +138,9 @@ if test ! -d "$outfile"; then
+     touch "$outfile"
+ fi
  echo "$line" >> "$outfile"
- # Avoid that configure complains that this script ignores @datarootdir@
- echo "@datarootdir@" >/dev/null
+-prefix=@prefix@
+-datarootdir=@datarootdir@
+-# To suppress shellcheck complaints about $prefix and $datarootdir.
+-: "$prefix" "$datarootdir"
 -outfile="@datadir@/snmp/snmpd.conf"
++# Avoid that configure complains that this script ignores @datarootdir@
++echo "@datarootdir@" >/dev/null
 +outfile="/etc/snmp/snmpd.conf"
  line="$token $user"
  echo "adding the following line to $outfile:"
diff --git a/net-snmp-5.9-dskTable-dynamic.patch b/net-snmp-5.9-dskTable-dynamic.patch
deleted file mode 100644
index 035bf55..0000000
--- a/net-snmp-5.9-dskTable-dynamic.patch
+++ /dev/null
@@ -1,179 +0,0 @@
-diff -urNp a/agent/mibgroup/ucd-snmp/disk.c b/agent/mibgroup/ucd-snmp/disk.c
---- a/agent/mibgroup/ucd-snmp/disk.c	2021-05-26 08:56:39.678900275 +0200
-+++ b/agent/mibgroup/ucd-snmp/disk.c	2021-05-26 09:09:32.308731157 +0200
-@@ -153,9 +153,10 @@ static void       disk_free_config(void)
- static void       disk_parse_config(const char *, char *);
- static void       disk_parse_config_all(const char *, char *);
- #if HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS
--static void       find_and_add_allDisks(int minpercent);
-+static void       refresh_disk_table(int addNewDisks, int minpercent);
- static void       add_device(char *path, char *device,
--	                     int minspace, int minpercent, int override);
-+	                     int minspace, int minpercent, int addNewDisks,
-+                         int override);
- static void       modify_disk_parameters(int index, int minspace,
- 	                                 int minpercent);
- static int        disk_exists(char *path);
-@@ -167,6 +168,7 @@ struct diskpart {
-     char            path[STRMAX];
-     int             minimumspace;
-     int             minpercent;
-+    int             alive;
- };
- 
- #define MAX_INT_32 0x7fffffff
-@@ -174,6 +176,7 @@ struct diskpart {
- 
- unsigned int    numdisks;
- int             allDisksIncluded = 0;
-+int             allDisksMinPercent = 0;
- unsigned int    maxdisks = 0;
- struct diskpart *disks;
- 
-@@ -238,6 +241,7 @@ init_disk(void)
- 				disk_free_config,
- 				"minpercent%");
-   allDisksIncluded = 0;
-+  allDisksMinPercent = 0;
- }
- 
- static void
-@@ -253,6 +257,7 @@ disk_free_config(void)
-     disks[i].minpercent = -1;
-   }
-   allDisksIncluded = 0;
-+  allDisksMinPercent = 0;
- }
- 
- static void 
-@@ -313,7 +318,7 @@ disk_parse_config(const char *token, cha
-    * check if the disk already exists, if so then modify its
-    * parameters. if it does not exist then add it
-    */
--  add_device(path, find_device(path), minspace, minpercent, 1);
-+  add_device(path, find_device(path), minspace, minpercent, 1, 1);
- #endif /* HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS */
- }
- 
-@@ -372,7 +377,7 @@ disk_parse_config_all(const char *token,
- 
- #if HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS
- static void
--add_device(char *path, char *device, int minspace, int minpercent, int override) 
-+add_device(char *path, char *device, int minspace, int minpercent, int addNewDisks, int override) 
- {
-   int index;
- 
-@@ -402,10 +407,16 @@ add_device(char *path, char *device, int
-   }
- 
-   index = disk_exists(path);
--  if((index != -1) && (index < maxdisks) && (override==1)) {
--    modify_disk_parameters(index, minspace, minpercent);
-+  if((index != -1) && (index < maxdisks)) {
-+    /* the path is already in the table */
-+    disks[index].alive = 1;
-+    /* -> update its device */
-+    strlcpy(disks[index].device, device, sizeof(disks[index].device));
-+    if (override == 1) {
-+        modify_disk_parameters(index, minspace, minpercent);
-+    }
-   }
--  else if(index == -1){
-+  else if(index == -1 && addNewDisks){
-     /* add if and only if the device was found */
-     if(device[0] != 0) {
-       /* The following buffers are cleared above, no need to add '\0' */
-@@ -413,6 +424,7 @@ add_device(char *path, char *device, int
-       strlcpy(disks[numdisks].device, device, sizeof(disks[numdisks].device));
-       disks[numdisks].minimumspace = minspace;
-       disks[numdisks].minpercent   = minpercent;
-+      disks[numdisks].alive        = 1;
-       numdisks++;  
-     }
-     else {
-@@ -420,6 +432,7 @@ add_device(char *path, char *device, int
-       disks[numdisks].minpercent = -1;
-       disks[numdisks].path[0] = 0;
-       disks[numdisks].device[0] = 0;
-+      disks[numdisks].alive = 0;
-     }
-   }
- }
-@@ -444,7 +457,7 @@ int disk_exists(char *path)
- }
- 
- static void 
--find_and_add_allDisks(int minpercent)
-+refresh_disk_table(int addNewDisks, int minpercent)
- {
- #if HAVE_GETMNTENT
- #if HAVE_SYS_MNTTAB_H
-@@ -480,7 +493,7 @@ find_and_add_allDisks(int minpercent)
-       return;
-   }
-   while (mntfp && NULL != (mntent = getmntent(mntfp))) {
--    add_device(mntent->mnt_dir, mntent->mnt_fsname, -1, minpercent, 0);
-+    add_device(mntent->mnt_dir, mntent->mnt_fsname, -1, minpercent, addNewDisks, 0);
-     dummy = 1;
-   }
-   if (mntfp)
-@@ -497,7 +510,7 @@ find_and_add_allDisks(int minpercent)
-       return;
-   }
-   while ((i = getmntent(mntfp, &mnttab)) == 0) {
--    add_device(mnttab.mnt_mountp, mnttab.mnt_special, -1, minpercent, 0);
-+    add_device(mnttab.mnt_mountp, mnttab.mnt_special, -1, minpercent, addNewDisks, 0);
-     dummy = 1;
-   }
-   fclose(mntfp);
-@@ -514,13 +527,13 @@ find_and_add_allDisks(int minpercent)
-     mntsize = getmntinfo(&mntbuf, MNT_NOWAIT);
-     for (i = 0; i < mntsize; i++) {
- 	add_device(mntbuf[i].f_mntonname, mntbuf[i].f_mntfromname, -1,
--                   minpercent, 0);
-+                   minpercent, addNewDisks, 0);
-     }
-   }
- #elif HAVE_FSTAB_H
-   setfsent();			/* open /etc/fstab */
-   while((fstab1 = getfsent()) != NULL) {
--    add_device(fstab1->fs_file, fstab1->fs_spec, -1, minpercent, 0);
-+    add_device(fstab1->fs_file, fstab1->fs_spec, -1, minpercent, addNewDisks, 0);
-     dummy = 1;
-   }
-   endfsent();			/* close /etc/fstab */
-@@ -535,7 +548,7 @@ find_and_add_allDisks(int minpercent)
-    * statfs we default to the root partition "/"
-    */
-   if (statfs("/", &statf) == 0) {
--    add_device("/", statf.f_mntfromname, -1, minpercent, 0);
-+    add_device("/", statf.f_mntfromname, -1, minpercent, addNewDisks, 0);
-   }
- #endif
-   else {
-@@ -694,6 +707,10 @@ fill_dsk_entry(int disknum, struct dsk_e
- #endif
- #endif
- 
-+    if (disks[disknum].alive == 0){
-+        return -1;
-+    }
-+
-     entry->dskPercentInode = -1;
- 
- #if defined(HAVE_STATVFS) || defined(HAVE_STATFS)
-@@ -825,6 +842,13 @@ var_extensible_disk(struct variable *vp,
-     static char    *errmsg;
-     static char     empty_str[1];
- 
-+    int i;
-+    for (i = 0; i < numdisks; i++){
-+        disks[i].alive = 0;
-+    }
-+    /* dynamically add new disks + update alive flag */
-+    refresh_disk_table(allDisksIncluded, allDisksMinPercent);
-+
- tryAgain:
-     if (header_simple_table
-         (vp, name, length, exact, var_len, write_method, numdisks))
diff --git a/net-snmp-5.9-intermediate-certs.patch b/net-snmp-5.9-intermediate-certs.patch
index 89815ef..ab5b7a0 100644
--- a/net-snmp-5.9-intermediate-certs.patch
+++ b/net-snmp-5.9-intermediate-certs.patch
@@ -1,7 +1,8 @@
-diff -urNp a/include/net-snmp/library/cert_util.h b/include/net-snmp/library/cert_util.h
---- a/include/net-snmp/library/cert_util.h	2021-05-26 09:17:40.338156603 +0200
-+++ b/include/net-snmp/library/cert_util.h	2021-05-26 09:19:25.396109268 +0200
-@@ -55,7 +55,8 @@ extern "C" {
+diff --git a/include/net-snmp/library/cert_util.h b/include/net-snmp/library/cert_util.h
+index 305e367..6117b9a 100644
+--- a/include/net-snmp/library/cert_util.h
++++ b/include/net-snmp/library/cert_util.h
+@@ -48,7 +48,8 @@ extern "C" {
          char           *common_name;
  
          u_char          hash_type;
@@ -11,7 +12,7 @@ diff -urNp a/include/net-snmp/library/cert_util.h b/include/net-snmp/library/cer
      } netsnmp_cert;
  
  /** types */
-@@ -100,6 +101,7 @@ extern "C" {
+@@ -93,6 +94,7 @@ extern "C" {
  
      NETSNMP_IMPORT
      netsnmp_cert *netsnmp_cert_find(int what, int where, void *hint);
@@ -19,9 +20,10 @@ diff -urNp a/include/net-snmp/library/cert_util.h b/include/net-snmp/library/cer
  
      int netsnmp_cert_check_vb_fingerprint(const netsnmp_variable_list *var);
  
-diff -urNp a/include/net-snmp/library/dir_utils.h b/include/net-snmp/library/dir_utils.h
---- a/include/net-snmp/library/dir_utils.h	2021-05-26 09:17:40.337156594 +0200
-+++ b/include/net-snmp/library/dir_utils.h	2021-05-26 09:19:59.236416127 +0200
+diff --git a/include/net-snmp/library/dir_utils.h b/include/net-snmp/library/dir_utils.h
+index 471bb0b..ac7f69a 100644
+--- a/include/net-snmp/library/dir_utils.h
++++ b/include/net-snmp/library/dir_utils.h
 @@ -53,7 +53,8 @@ extern "C" {
  #define NETSNMP_DIR_NSFILE                            0x0010
  /** load stats in netsnmp_file */
@@ -32,10 +34,22 @@ diff -urNp a/include/net-snmp/library/dir_utils.h b/include/net-snmp/library/dir
      
          
  #ifdef __cplusplus
-diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
---- a/snmplib/cert_util.c	2021-05-26 09:17:40.182155189 +0200
-+++ b/snmplib/cert_util.c	2021-05-26 09:28:23.533539371 +0200
-@@ -100,7 +100,7 @@ netsnmp_feature_child_of(tls_fingerprint
+diff --git a/snmplib/cert_util.c b/snmplib/cert_util.c
+index 5b5aaaa..7c07048 100644
+--- a/snmplib/cert_util.c
++++ b/snmplib/cert_util.c
+@@ -42,9 +42,7 @@ netsnmp_feature_child_of(tls_fingerprint_build, cert_util_all);
+ 
+ #include <ctype.h>
+ 
+-#include <stddef.h>
+-
+-#if HAVE_STDLIB_H
++#ifdef HAVE_STDLIB_H
+ #include <stdlib.h>
+ #endif
+ 
+@@ -102,7 +100,7 @@ netsnmp_feature_child_of(tls_fingerprint_build, cert_util_all);
   * bump this value whenever cert index format changes, so indexes
   * will be regenerated with new format.
   */
@@ -44,8 +58,28 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  
  static netsnmp_container *_certs = NULL;
  static netsnmp_container *_keys = NULL;
-@@ -126,6 +126,8 @@ static int  _cert_fn_ncompare(netsnmp_ce
-                               netsnmp_cert_common *rhs);
+@@ -116,16 +114,20 @@ static netsnmp_container *_trusted_certs = NULL;
+ static void _setup_containers(void);
+ 
+ static void _cert_indexes_load(void);
+-static void _cert_free(void *cert, void *context);
+-static void _key_free(void *key, void *context);
+-static int  _cert_compare(const void *p, const void *q);
+-static int  _cert_sn_compare(const void *p, const void *q);
+-static int  _cert_sn_ncompare(const void *p, const void *q);
+-static int  _cert_cn_compare(const void *p, const void *q);
+-static int  _cert_fn_compare(const void *p, const void *q);
+-static int  _cert_fn_ncompare(const void *p, const void *q);
++static void _cert_free(netsnmp_cert *cert, void *context);
++static void _key_free(netsnmp_key *key, void *context);
++static int  _cert_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);
++static int  _cert_sn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);
++static int  _cert_sn_ncompare(netsnmp_cert *lhs, netsnmp_cert *rhs);
++static int  _cert_cn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs);
++static int  _cert_fn_compare(netsnmp_cert_common *lhs,
++                             netsnmp_cert_common *rhs);
++static int  _cert_fn_ncompare(netsnmp_cert_common *lhs,
++                              netsnmp_cert_common *rhs);
  static void _find_partner(netsnmp_cert *cert, netsnmp_key *key);
  static netsnmp_cert *_find_issuer(netsnmp_cert *cert);
 +static netsnmp_void_array *_cert_reduce_subset_first(netsnmp_void_array *matching);
@@ -53,7 +87,16 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  static netsnmp_void_array *_cert_find_subset_fn(const char *filename,
                                                  const char *directory);
  static netsnmp_void_array *_cert_find_subset_sn(const char *subject);
-@@ -345,6 +347,8 @@ _get_cert_container(const char *use)
+@@ -200,7 +202,7 @@ _setup_trusted_certs(void)
+         return;
+     }
+     _trusted_certs->container_name = strdup("trusted certificates");
+-    _trusted_certs->compare = netsnmp_str_compare;
++    _trusted_certs->compare = (netsnmp_container_compare*) strcmp;
+ }
+ 
+ /*
+@@ -345,14 +347,18 @@ _get_cert_container(const char *use)
  {
      netsnmp_container *c;
  
@@ -62,49 +105,61 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      c = netsnmp_container_find("certs:binary_array");
      if (NULL == c) {
          snmp_log(LOG_ERR, "could not create container for %s\n", use);
-@@ -354,6 +358,8 @@ _get_cert_container(const char *use)
-     c->free_item = (netsnmp_container_obj_func*)_cert_free;
-     c->compare = (netsnmp_container_compare*)_cert_compare;
- 
-+    CONTAINER_SET_OPTIONS(c, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
+         return NULL;
+     }
+     c->container_name = strdup(use);
+-    c->free_item = _cert_free;
+-    c->compare = _cert_compare;
++    c->free_item = (netsnmp_container_obj_func*)_cert_free;
++    c->compare = (netsnmp_container_compare*)_cert_compare;
 +
++    CONTAINER_SET_OPTIONS(c, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
+ 
      return c;
  }
- 
-@@ -362,6 +368,8 @@ _setup_containers(void)
- {
-     netsnmp_container *additional_keys;
- 
-+    int rc;
-+
-     _certs = _get_cert_container("netsnmp certificates");
-     if (NULL == _certs)
-         return;
-@@ -376,6 +384,7 @@ _setup_containers(void)
+@@ -377,7 +383,7 @@ _setup_containers(void)
+     }
      additional_keys->container_name = strdup("certs_cn");
      additional_keys->free_item = NULL;
-     additional_keys->compare = (netsnmp_container_compare*)_cert_cn_compare;
-+    CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
+-    additional_keys->compare = _cert_cn_compare;
++    additional_keys->compare = (netsnmp_container_compare*)_cert_cn_compare;
+     CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
      netsnmp_container_add_index(_certs, additional_keys);
  
-     /** additional keys: subject name */
-@@ -389,6 +398,7 @@ _setup_containers(void)
+@@ -390,8 +396,8 @@ _setup_containers(void)
+     }
+     additional_keys->container_name = strdup("certs_sn");
      additional_keys->free_item = NULL;
-     additional_keys->compare = (netsnmp_container_compare*)_cert_sn_compare;
-     additional_keys->ncompare = (netsnmp_container_compare*)_cert_sn_ncompare;
-+    CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
+-    additional_keys->compare = _cert_sn_compare;
+-    additional_keys->ncompare = _cert_sn_ncompare;
++    additional_keys->compare = (netsnmp_container_compare*)_cert_sn_compare;
++    additional_keys->ncompare = (netsnmp_container_compare*)_cert_sn_ncompare;
+     CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
      netsnmp_container_add_index(_certs, additional_keys);
  
-     /** additional keys: file name */
-@@ -402,6 +412,7 @@ _setup_containers(void)
+@@ -404,8 +410,8 @@ _setup_containers(void)
+     }
+     additional_keys->container_name = strdup("certs_fn");
      additional_keys->free_item = NULL;
-     additional_keys->compare = (netsnmp_container_compare*)_cert_fn_compare;
-     additional_keys->ncompare = (netsnmp_container_compare*)_cert_fn_ncompare;
-+    CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
+-    additional_keys->compare = _cert_fn_compare;
+-    additional_keys->ncompare = _cert_fn_ncompare;
++    additional_keys->compare = (netsnmp_container_compare*)_cert_fn_compare;
++    additional_keys->ncompare = (netsnmp_container_compare*)_cert_fn_ncompare;
+     CONTAINER_SET_OPTIONS(additional_keys, CONTAINER_KEY_ALLOW_DUPLICATES, rc);
      netsnmp_container_add_index(_certs, additional_keys);
  
-     _keys = netsnmp_container_find("cert_keys:binary_array");
-@@ -424,7 +435,7 @@ netsnmp_cert_map_container(void)
+@@ -416,8 +422,8 @@ _setup_containers(void)
+         return;
+     }
+     _keys->container_name = strdup("netsnmp certificate keys");
+-    _keys->free_item = _key_free;
+-    _keys->compare = _cert_fn_compare;
++    _keys->free_item = (netsnmp_container_obj_func*)_key_free;
++    _keys->compare = (netsnmp_container_compare*)_cert_fn_compare;
+ 
+     _setup_trusted_certs();
+ }
+@@ -429,7 +435,7 @@ netsnmp_cert_map_container(void)
  }
  
  static netsnmp_cert *
@@ -113,7 +168,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
            int hashType, const char *fingerprint, const char *common_name,
            const char *subject)
  {
-@@ -446,8 +457,10 @@ _new_cert(const char *dirname, const cha
+@@ -451,8 +457,10 @@ _new_cert(const char *dirname, const char *filename, int certType,
  
      cert->info.dir = strdup(dirname);
      cert->info.filename = strdup(filename);
@@ -125,7 +180,112 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      if (fingerprint) {
          cert->hash_type = hashType;
          cert->fingerprint = strdup(fingerprint);
-@@ -884,14 +897,86 @@ _certindex_new( const char *dirname )
+@@ -553,22 +561,20 @@ netsnmp_key_free(netsnmp_key *key)
+ }
+ 
+ static void
+-_cert_free(void *cert, void *context)
++_cert_free(netsnmp_cert *cert, void *context)
+ {
+     netsnmp_cert_free(cert);
+ }
+ 
+ static void
+-_key_free(void *key, void *context)
++_key_free(netsnmp_key *key, void *context)
+ {
+     netsnmp_key_free(key);
+ }
+ 
+ static int
+-_cert_compare(const void *p, const void *q)
++_cert_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)
+ {
+-    const netsnmp_cert *lhs = p, *rhs = q;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+     netsnmp_assert((lhs->fingerprint != NULL) &&
+                    (rhs->fingerprint != NULL));
+@@ -578,8 +584,7 @@ _cert_compare(const void *p, const void *q)
+ }
+ 
+ static int
+-_cert_path_compare(const netsnmp_cert_common *lhs,
+-                   const netsnmp_cert_common *rhs)
++_cert_path_compare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)
+ {
+     int rc;
+ 
+@@ -595,9 +600,8 @@ _cert_path_compare(const netsnmp_cert_common *lhs,
+ }
+ 
+ static int
+-_cert_cn_compare(const void *p, const void *q)
++_cert_cn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)
+ {
+-    const netsnmp_cert *lhs = p, *rhs = q;
+     int rc;
+     const char *lhcn, *rhcn;
+ 
+@@ -617,13 +621,13 @@ _cert_cn_compare(const void *p, const void *q)
+         return rc;
+ 
+     /** in case of equal common names, sub-sort by path */
+-    return _cert_path_compare(&lhs->info, &rhs->info);
++    return _cert_path_compare((netsnmp_cert_common*)lhs,
++                              (netsnmp_cert_common*)rhs);
+ }
+ 
+ static int
+-_cert_sn_compare(const void *p, const void *q)
++_cert_sn_compare(netsnmp_cert *lhs, netsnmp_cert *rhs)
+ {
+-    const netsnmp_cert *lhs = p, *rhs = q;
+     int rc;
+     const char *lhsn, *rhsn;
+ 
+@@ -643,13 +647,13 @@ _cert_sn_compare(const void *p, const void *q)
+         return rc;
+ 
+     /** in case of equal common names, sub-sort by path */
+-    return _cert_path_compare(&lhs->info, &rhs->info);
++    return _cert_path_compare((netsnmp_cert_common*)lhs,
++                              (netsnmp_cert_common*)rhs);
+ }
+ 
+ static int
+-_cert_fn_compare(const void *p, const void *q)
++_cert_fn_compare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)
+ {
+-    const netsnmp_cert_common *lhs = p, *rhs = q;
+     int rc;
+ 
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+@@ -663,10 +667,8 @@ _cert_fn_compare(const void *p, const void *q)
+ }
+ 
+ static int
+-_cert_fn_ncompare(const void *p, const void *q)
++_cert_fn_ncompare(netsnmp_cert_common *lhs, netsnmp_cert_common *rhs)
+ {
+-    const netsnmp_cert_common *lhs = p, *rhs = q;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+     netsnmp_assert((lhs->filename != NULL) && (rhs->filename != NULL));
+ 
+@@ -674,10 +676,8 @@ _cert_fn_ncompare(const void *p, const void *q)
+ }
+ 
+ static int
+-_cert_sn_ncompare(const void *p, const void *q)
++_cert_sn_ncompare(netsnmp_cert *lhs, netsnmp_cert *rhs)
+ {
+-    const netsnmp_cert *lhs = p, *rhs = q;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+     netsnmp_assert((lhs->subject != NULL) && (rhs->subject != NULL));
+ 
+@@ -897,14 +897,86 @@ _certindex_new( const char *dirname )
   * certificate utility functions
   *
   */
@@ -214,7 +374,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  
      if (NULL == cert)
          return NULL;
-@@ -908,51 +993,33 @@ netsnmp_ocert_get(netsnmp_cert *cert)
+@@ -921,51 +993,33 @@ netsnmp_ocert_get(netsnmp_cert *cert)
          }
      }
  
@@ -274,7 +434,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
                  if (NULL != okey) {
                      netsnmp_key  *key;
                      DEBUGMSGT(("cert:read:key", "found key with cert in %s\n",
-@@ -979,7 +1046,7 @@ netsnmp_ocert_get(netsnmp_cert *cert)
+@@ -992,7 +1046,7 @@ netsnmp_ocert_get(netsnmp_cert *cert)
              break;
  #ifdef CERT_PKCS12_SUPPORT_MAYBE_LATER
          case NS_CERT_TYPE_PKCS12:
@@ -283,7 +443,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
              PKCS12 *p12 = d2i_PKCS12_bio(certbio, NULL);
              if ( (NULL != p12) && (PKCS12_verify_mac(p12, "", 0) ||
                                     PKCS12_verify_mac(p12, NULL, 0)))
-@@ -999,46 +1066,7 @@ netsnmp_ocert_get(netsnmp_cert *cert)
+@@ -1012,46 +1066,7 @@ netsnmp_ocert_get(netsnmp_cert *cert)
          return NULL;
      }
  
@@ -317,7 +477,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
 -    }
 -    
 -    if (NULL == cert->fingerprint) {
--        cert->hash_type = netsnmp_openssl_cert_get_hash_type(ocert);
+-        cert->hash_type = NS_HASH_SHA1;
 -        cert->fingerprint =
 -            netsnmp_openssl_cert_get_fingerprint(ocert, cert->hash_type);
 -    }
@@ -331,7 +491,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  
      return ocert;
  }
-@@ -1048,7 +1076,6 @@ netsnmp_okey_get(netsnmp_key  *key)
+@@ -1061,7 +1076,6 @@ netsnmp_okey_get(netsnmp_key  *key)
  {
      BIO            *keybio;
      EVP_PKEY       *okey;
@@ -339,7 +499,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  
      if (NULL == key)
          return NULL;
-@@ -1056,19 +1083,8 @@ netsnmp_okey_get(netsnmp_key  *key)
+@@ -1069,19 +1083,8 @@ netsnmp_okey_get(netsnmp_key  *key)
      if (key->okey)
          return key->okey;
  
@@ -361,7 +521,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
          return NULL;
      }
  
-@@ -1154,7 +1170,7 @@ netsnmp_cert_load_x509(netsnmp_cert *cer
+@@ -1167,7 +1170,7 @@ netsnmp_cert_load_x509(netsnmp_cert *cert)
              cert->issuer_cert =  _find_issuer(cert);
              if (NULL == cert->issuer_cert) {
                  DEBUGMSGT(("cert:load:warn",
@@ -370,7 +530,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
                             cert->info.filename));
                  rc = CERT_LOAD_PARTIAL;
                  break;
-@@ -1163,7 +1179,7 @@ netsnmp_cert_load_x509(netsnmp_cert *cer
+@@ -1176,7 +1179,7 @@ netsnmp_cert_load_x509(netsnmp_cert *cert)
          /** get issuer ocert */
          if ((NULL == cert->issuer_cert->ocert) &&
              (netsnmp_ocert_get(cert->issuer_cert) == NULL)) {
@@ -379,7 +539,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
                         cert->info.filename));
              rc = CERT_LOAD_PARTIAL;
              break;
-@@ -1184,7 +1200,7 @@ _find_partner(netsnmp_cert *cert, netsnm
+@@ -1197,7 +1200,7 @@ _find_partner(netsnmp_cert *cert, netsnmp_key *key)
          return;
      }
  
@@ -388,7 +548,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
          if (key->cert) {
              DEBUGMSGT(("cert:partner", "key already has partner\n"));
              return;
-@@ -1197,7 +1213,8 @@ _find_partner(netsnmp_cert *cert, netsnm
+@@ -1210,7 +1213,8 @@ _find_partner(netsnmp_cert *cert, netsnmp_key *key)
              return;
          *pos = 0;
  
@@ -398,7 +558,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
          if (!matching)
              return;
          if (1 == matching->size) {
-@@ -1217,7 +1234,7 @@ _find_partner(netsnmp_cert *cert, netsnm
+@@ -1230,7 +1234,7 @@ _find_partner(netsnmp_cert *cert, netsnmp_key *key)
              DEBUGMSGT(("cert:partner", "%s matches multiple certs\n",
                            key->info.filename));
      }
@@ -407,7 +567,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
          if (cert->key) {
              DEBUGMSGT(("cert:partner", "cert already has partner\n"));
              return;
-@@ -1255,76 +1272,182 @@ _find_partner(netsnmp_cert *cert, netsnm
+@@ -1268,76 +1272,182 @@ _find_partner(netsnmp_cert *cert, netsnmp_key *key)
      }
  }
  
@@ -643,7 +803,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      }
  
      return 0;
-@@ -1338,7 +1461,8 @@ _cert_read_index(const char *dirname, st
+@@ -1351,7 +1461,8 @@ _cert_read_index(const char *dirname, struct stat *dirstat)
      struct stat     idx_stat;
      char            tmpstr[SNMP_MAXPATH + 5], filename[NAME_MAX];
      char            fingerprint[EVP_MAX_MD_SIZE*3], common_name[64+1], type_str[15];
@@ -653,7 +813,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      int             count = 0, type, hash, version;
      netsnmp_cert    *cert;
      netsnmp_key     *key;
-@@ -1381,7 +1505,8 @@ _cert_read_index(const char *dirname, st
+@@ -1394,7 +1505,8 @@ _cert_read_index(const char *dirname, struct stat *dirstat)
          netsnmp_directory_container_read_some(NULL, dirname,
                                                _time_filter, &idx_stat,
                                                NETSNMP_DIR_NSFILE |
@@ -663,7 +823,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      if (newer) {
          DEBUGMSGT(("cert:index:parse", "Index outdated; files modified\n"));
          CONTAINER_FREE_ALL(newer, NULL);
-@@ -1425,6 +1550,7 @@ _cert_read_index(const char *dirname, st
+@@ -1439,6 +1551,7 @@ _cert_read_index(const char *dirname, struct stat *dirstat)
              pos = &tmpstr[2];
              if ((NULL == (pos=copy_nword(pos, filename, sizeof(filename)))) ||
                  (NULL == (pos=copy_nword(pos, type_str, sizeof(type_str)))) ||
@@ -671,7 +831,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
                  (NULL == (pos=copy_nword(pos, hash_str, sizeof(hash_str)))) ||
                  (NULL == (pos=copy_nword(pos, fingerprint,
                                           sizeof(fingerprint)))) ||
-@@ -1437,8 +1563,9 @@ _cert_read_index(const char *dirname, st
+@@ -1451,8 +1564,9 @@ _cert_read_index(const char *dirname, struct stat *dirstat)
                  break;
              }
              type = atoi(type_str);
@@ -682,7 +842,7 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
                               common_name, subject);
              if (cert && 0 == CONTAINER_INSERT(found, cert))
                  ++count;
-@@ -1543,7 +1670,8 @@ _add_certdir(const char *dirname)
+@@ -1559,7 +1673,8 @@ _add_certdir(const char *dirname)
          netsnmp_directory_container_read_some(NULL, dirname,
                                                _cert_cert_filter, NULL,
                                                NETSNMP_DIR_RELATIVE_PATH |
@@ -692,7 +852,15 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      if (NULL == cert_container) {
          DEBUGMSGT(("cert:index:dir",
                      "error creating container for cert files\n"));
-@@ -1631,7 +1759,7 @@ _cert_print(netsnmp_cert *c, void *conte
+@@ -1642,14 +1757,12 @@ _cert_indexes_load(void)
+ }
+ 
+ static void
+-_cert_print(void *p, void *context)
++_cert_print(netsnmp_cert *c, void *context)
+ {
+-    netsnmp_cert *c = p;
+-
      if (NULL == c)
          return;
  
@@ -701,7 +869,39 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
      DEBUGMSGT(("cert:dump", "   type %d flags 0x%x (%s)\n",
               c->info.type, c->info.allowed_uses,
                _mode_str(c->info.allowed_uses)));
-@@ -1835,7 +1963,8 @@ netsnmp_cert_find(int what, int where, v
+@@ -1676,10 +1789,8 @@ _cert_print(void *p, void *context)
+ }
+ 
+ static void
+-_key_print(void *p, void *context)
++_key_print(netsnmp_key *k, void *context)
+ {
+-    netsnmp_key *k = p;
+-
+     if (NULL == k)
+         return;
+ 
+@@ -1691,8 +1802,8 @@ _key_print(void *p, void *context)
+ void
+ netsnmp_cert_dump_all(void)
+ {
+-    CONTAINER_FOR_EACH(_certs, _cert_print, NULL);
+-    CONTAINER_FOR_EACH(_keys, _key_print, NULL);
++    CONTAINER_FOR_EACH(_certs, (netsnmp_container_obj_func*)_cert_print, NULL);
++    CONTAINER_FOR_EACH(_keys, (netsnmp_container_obj_func*)_key_print, NULL);
+ }
+ 
+ #ifdef CERT_MAIN
+@@ -1726,6 +1837,8 @@ main(int argc, char** argv)
+ 
+ #endif /* CERT_MAIN */
+ 
++static netsnmp_cert *_cert_find_fp(const char *fingerprint);
++
+ void
+ netsnmp_fp_lowercase_and_strip_colon(char *fp)
+ {
+@@ -1853,7 +1966,8 @@ netsnmp_cert_find(int what, int where, void *hint)
          netsnmp_void_array *matching;
  
          DEBUGMSGT(("cert:find:params", " hint = %s\n", (char *)hint));
@@ -711,7 +911,16 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
          if (!matching)
              return NULL;
          if (1 == matching->size)
-@@ -2278,6 +2407,124 @@ _reduce_subset_dir(netsnmp_void_array *m
+@@ -2061,7 +2175,7 @@ netsnmp_cert_trust(SSL_CTX *ctx, netsnmp_cert *thiscert)
+                                 SNMPERR_GENERR);
+ 
+     /* Put the certificate into the store */
+-    fingerprint = netsnmp_openssl_cert_get_fingerprint(cert, NS_HASH_SHA1);
++    fingerprint = netsnmp_openssl_cert_get_fingerprint(cert, -1);
+     DEBUGMSGTL(("cert:trust",
+                 "putting trusted cert %p = %s in certstore %p\n", cert,
+                 fingerprint, certstore));
+@@ -2296,6 +2410,124 @@ _reduce_subset_dir(netsnmp_void_array *matching, const char *directory)
      }
  }
  
@@ -836,10 +1045,95 @@ diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
  static netsnmp_void_array *
  _cert_find_subset_common(const char *filename, netsnmp_container *container)
  {
-diff -urNp a/snmplib/dir_utils.c b/snmplib/dir_utils.c
---- a/snmplib/dir_utils.c	2021-05-26 09:17:40.203155379 +0200
-+++ b/snmplib/dir_utils.c	2021-05-26 09:27:39.721867913 +0200
-@@ -107,6 +107,9 @@ netsnmp_directory_container_read_some(ne
+@@ -2433,7 +2665,7 @@ _time_filter(const void *text, void *ctx)
+  * ***************************************************************************/
+ #define MAP_CONFIG_TOKEN "certSecName"
+ static void _parse_map(const char *token, char *line);
+-static void _map_free(void *map, void *ctx);
++static void _map_free(netsnmp_cert_map* entry, void *ctx);
+ static void _purge_config_entries(void);
+ 
+ static void
+@@ -2538,16 +2770,14 @@ netsnmp_cert_map_find(netsnmp_cert_map *map)
+ #endif /* NETSNMP_FEATURE_REMOVE_CERT_MAP_FIND */
+ 
+ static void
+-_map_free(void *map, void *context)
++_map_free(netsnmp_cert_map *map, void *context)
+ {
+     netsnmp_cert_map_free(map);
+ }
+ 
+ static int
+-_map_compare(const void *p, const void *q)
++_map_compare(netsnmp_cert_map *lhs, netsnmp_cert_map *rhs)
+ {
+-    const netsnmp_cert_map *lhs = p, *rhs = q;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+ 
+     if (lhs->priority < rhs->priority)
+@@ -2559,11 +2789,9 @@ _map_compare(const void *p, const void *q)
+ }
+ 
+ static int
+-_map_fp_compare(const void *p, const void *q)
++_map_fp_compare(netsnmp_cert_map *lhs, netsnmp_cert_map *rhs)
+ {
+-    const netsnmp_cert_map *lhs = p, *rhs = q;
+     int rc;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+ 
+     if ((rc = strcmp(lhs->fingerprint, rhs->fingerprint)) != 0)
+@@ -2578,10 +2806,8 @@ _map_fp_compare(const void *p, const void *q)
+ }
+ 
+ static int
+-_map_fp_ncompare(const void *p, const void *q)
++_map_fp_ncompare(netsnmp_cert_map *lhs, netsnmp_cert_map *rhs)
+ {
+-    const netsnmp_cert_map *lhs = p, *rhs = q;
+-
+     netsnmp_assert((lhs != NULL) && (rhs != NULL));
+ 
+     return strncmp(lhs->fingerprint, rhs->fingerprint,
+@@ -2600,8 +2826,8 @@ netsnmp_cert_map_container_create(int with_fp)
+     }
+ 
+     chain_map->container_name = strdup("cert_map");
+-    chain_map->free_item = _map_free;
+-    chain_map->compare = _map_compare;
++    chain_map->free_item = (netsnmp_container_obj_func*)_map_free;
++    chain_map->compare = (netsnmp_container_compare*)_map_compare;
+ 
+     if (!with_fp)
+         return chain_map;
+@@ -2617,8 +2843,8 @@ netsnmp_cert_map_container_create(int with_fp)
+         return NULL;
+     }
+     fp->container_name = strdup("cert2sn_fp");
+-    fp->compare = _map_fp_compare;
+-    fp->ncompare = _map_fp_ncompare;
++    fp->compare = (netsnmp_container_compare*)_map_fp_compare;
++    fp->ncompare = (netsnmp_container_compare*)_map_fp_ncompare;
+     netsnmp_container_add_index(chain_map, fp);
+ 
+     return chain_map;
+@@ -2769,7 +2995,7 @@ netsnmp_certToTSN_parse_common(char **line)
+         map->fingerprint = strdup(buf);
+     } else {
+         map->fingerprint =
+-            netsnmp_openssl_cert_get_fingerprint(tmpcert->ocert, NS_HASH_SHA1);
++            netsnmp_openssl_cert_get_fingerprint(tmpcert->ocert, -1);
+     }
+     
+     if (NULL == *line) {
+diff --git a/snmplib/dir_utils.c b/snmplib/dir_utils.c
+index 48c1a0f..32426f8 100644
+--- a/snmplib/dir_utils.c
++++ b/snmplib/dir_utils.c
+@@ -105,6 +105,9 @@ netsnmp_directory_container_read_some(netsnmp_container *user_container,
          /** default to unsorted */
          if (! (flags & NETSNMP_DIR_SORTED))
              CONTAINER_SET_OPTIONS(container, CONTAINER_KEY_UNSORTED, rc);
diff --git a/net-snmp-5.9-ipv6-disable-leak.patch b/net-snmp-5.9-ipv6-disable-leak.patch
new file mode 100644
index 0000000..f8c20fd
--- /dev/null
+++ b/net-snmp-5.9-ipv6-disable-leak.patch
@@ -0,0 +1,12 @@
+diff -urNp a/snmplib/snmp_logging.c b/snmplib/snmp_logging.c
+--- a/snmplib/snmp_logging.c	2023-02-15 10:19:15.691827254 +0100
++++ b/snmplib/snmp_logging.c	2023-02-15 10:24:41.006642974 +0100
+@@ -490,7 +490,7 @@ snmp_log_options(char *optarg, int argc,
+ char *
+ snmp_log_syslogname(const char *pstr)
+ {
+-  if (pstr)
++  if (pstr && (pstr != syslogname))
+     strlcpy (syslogname, pstr, sizeof(syslogname));
+ 
+   return syslogname;
diff --git a/net-snmp-5.9-libnetsnmptrapd-against-MYSQL_LIBS.patch b/net-snmp-5.9-libnetsnmptrapd-against-MYSQL_LIBS.patch
deleted file mode 100644
index 8f1f2ed..0000000
--- a/net-snmp-5.9-libnetsnmptrapd-against-MYSQL_LIBS.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/apps/Makefile.in b/apps/Makefile.in
-index d4529d3..175242b 100644
---- a/apps/Makefile.in
-+++ b/apps/Makefile.in
-@@ -237,7 +237,7 @@ snmppcap$(EXEEXT):    snmppcap.$(OSUFFIX) $(USELIBS)
- 	$(LINK) ${CFLAGS} -o $@ snmppcap.$(OSUFFIX) ${LDFLAGS} ${LIBS} -lpcap
- 
- libnetsnmptrapd.$(LIB_EXTENSION)$(LIB_VERSION): $(LLIBTRAPD_OBJS)
--	$(LIB_LD_CMD) $@ ${LLIBTRAPD_OBJS} $(MIBLIB) $(USELIBS) $(PERLLDOPTS_FOR_LIBS) $(LDFLAGS)
-+	$(LIB_LD_CMD) $@ ${LLIBTRAPD_OBJS} $(MIBLIB) $(USELIBS) $(PERLLDOPTS_FOR_LIBS) $(LIB_LD_LIBS) $(MYSQL_LIBS)
- 	$(RANLIB) $@
- 
- snmpinforminstall:
diff --git a/net-snmp-5.9-mail-sender.patch b/net-snmp-5.9-mail-sender.patch
new file mode 100644
index 0000000..2f6e28b
--- /dev/null
+++ b/net-snmp-5.9-mail-sender.patch
@@ -0,0 +1,24 @@
+diff -up ./local/checkbandwidth.orig ./local/checkbandwidth
+--- ./local/checkbandwidth.orig	2023-08-15 16:32:01.000000000 -0400
++++ ./local/checkbandwidth	2025-03-20 16:31:14.062432316 -0400
+@@ -326,7 +326,6 @@ See the Net-SNMP COPYING file for licens
+ 
+ use JSON;
+ use Data::Dumper;
+-use Mail::Sender;
+ use SNMP;
+ use Fcntl ':flock';
+ 
+@@ -744,6 +743,12 @@ sub send_rate_message($$$$$$) {
+ sub send_message($$$) {
+ 	my ($to, $subject, $text) = @_;
+ 
++	if (! eval {require Mail::Sender;}) {
++		Log("Failed to send mail with error code -1: Mail::Sender is not available");
++                return();
++        }
++
++	import Mail::Sender;
+ 	my $sender = new Mail::Sender { smtp => $opts{'S'} ,
+ 	                                port => $opts{'P'},
+ 	                                from => $opts{'F'},
diff --git a/net-snmp-5.9-multilib.patch b/net-snmp-5.9-multilib.patch
index ffd8da8..2dfd9a6 100644
--- a/net-snmp-5.9-multilib.patch
+++ b/net-snmp-5.9-multilib.patch
@@ -1,5 +1,5 @@
 diff --git a/man/netsnmp_config_api.3.def b/man/netsnmp_config_api.3.def
-index 90b20d9..bd5abe1 100644
+index d4e0c1a..9e3a166 100644
 --- a/man/netsnmp_config_api.3.def
 +++ b/man/netsnmp_config_api.3.def
 @@ -295,7 +295,7 @@ for one particular machine.
@@ -11,7 +11,7 @@ index 90b20d9..bd5abe1 100644
  followed by \fC $HOME/.snmp\fP.
  This list can be changed by setting the environmental variable
  .I SNMPCONFPATH
-@@ -367,7 +367,7 @@ A colon separated list of directories to search for configuration
+@@ -367,7 +367,7 @@ A colon-separated list of directories to search for configuration
  files in.
  Default:
  .br
@@ -34,10 +34,10 @@ index fd30873..c3437d6 100644
  snmptrapd.conf, as well as snmp.local.conf, snmpd.local.conf
  and/or snmptrapd.local.conf. *.local.conf are always
 diff --git a/man/snmpd.conf.5.def b/man/snmpd.conf.5.def
-index 7ce8a46..a4000f9 100644
+index 6acd8c7..0a8b9fa 100644
 --- a/man/snmpd.conf.5.def
 +++ b/man/snmpd.conf.5.def
-@@ -1593,7 +1593,7 @@ filename), and call the initialisation routine \fIinit_NAME\fR.
+@@ -1609,7 +1609,7 @@ filename), and call the initialisation routine \fIinit_NAME\fR.
  .RS
  .IP "Note:"
  If the specified PATH is not a fully qualified filename, it will
diff --git a/net-snmp-5.9-pie.patch b/net-snmp-5.9-pie.patch
index cb2793d..a792904 100644
--- a/net-snmp-5.9-pie.patch
+++ b/net-snmp-5.9-pie.patch
@@ -1,8 +1,8 @@
 diff --git a/agent/Makefile.in b/agent/Makefile.in
-index b5d692d..1a30209 100644
+index 047d880..38d40aa 100644
 --- a/agent/Makefile.in
 +++ b/agent/Makefile.in
-@@ -297,7 +297,7 @@ getmibstat.o: mibgroup/kernel_sunos5.c
+@@ -300,7 +300,7 @@ getmibstat.o: mibgroup/kernel_sunos5.c
  	$(CC) $(CFLAGS) -o $@ -D_GETMIBSTAT_TEST -DDODEBUG -c $? 
  
  snmpd$(EXEEXT):	${LAGENTOBJS} $(USELIBS) $(AGENTLIB) $(HELPERLIB) $(MIBLIB) $(LIBTARG) 
@@ -10,9 +10,9 @@ index b5d692d..1a30209 100644
 +	$(LINK) $(CFLAGS) -o $@ -pie ${LAGENTOBJS} ${LDFLAGS} ${OUR_AGENT_LIBS}
  
  libnetsnmpagent.$(LIB_EXTENSION)$(LIB_VERSION):    ${LLIBAGENTOBJS} $(USELIBS)
- 	$(LIB_LD_CMD) $(AGENTLIB) ${LLIBAGENTOBJS} $(USELIBS) ${LAGENTLIBS} @LD_NO_UNDEFINED@ $(LDFLAGS) $(PERLLDOPTS_FOR_LIBS) @AGENTLIBS@
+ 	$(LIB_LD_CMD) $(AGENTLIB) ${LLIBAGENTOBJS} $(USELIBS) ${LAGENTLIBS} $(LDFLAGS) $(PERLLDOPTS_FOR_LIBS) @AGENTLIBS@
 diff --git a/apps/Makefile.in b/apps/Makefile.in
-index 43f3b9c..d4529d3 100644
+index 3dbb1d1..48ed23a 100644
 --- a/apps/Makefile.in
 +++ b/apps/Makefile.in
 @@ -190,7 +190,7 @@ snmptest$(EXEEXT):    snmptest.$(OSUFFIX) $(USELIBS)
diff --git a/net-snmp-5.9-python3.patch b/net-snmp-5.9-python3.patch
index 98de4ca..c7eda61 100644
--- a/net-snmp-5.9-python3.patch
+++ b/net-snmp-5.9-python3.patch
@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index 912f6b2..862fb5f 100644
+index bb4ada9..69ce4f0 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -227,7 +227,7 @@ perlcleanfeatures:
diff --git a/net-snmp-5.9-usage-exit.patch b/net-snmp-5.9-usage-exit.patch
deleted file mode 100644
index c43c846..0000000
--- a/net-snmp-5.9-usage-exit.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/agent/snmpd.c b/agent/snmpd.c
-index ae73eda..f01b890 100644
---- a/agent/snmpd.c
-+++ b/agent/snmpd.c
-@@ -289,6 +289,7 @@ usage(char *prog)
-            "  -S d|i|0-7\t\tuse -Ls <facility> instead\n"
-            "\n"
-            );
-+           exit(1);
- }
- 
- static void
diff --git a/net-snmp-5.9.1-python-usenumeric.patch b/net-snmp-5.9.1-python-usenumeric.patch
deleted file mode 100644
index 2f1d1ae..0000000
--- a/net-snmp-5.9.1-python-usenumeric.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 8c1dad23301692799749d75a3c039b8ae7c07f8e Mon Sep 17 00:00:00 2001
-From: Bart Van Assche <bvanassche@acm.org>
-Date: Wed, 9 Jun 2021 14:19:46 -0700
-Subject: [PATCH] Python: Fix snmpwalk with UseNumeric=1
-
-Fixes: c744be5ffed6 ("Python: Introduce build_python_varbind()")
-Fixes: https://github.com/net-snmp/net-snmp/issues/303
----
- python/netsnmp/client_intf.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
-diff --git a/python/netsnmp/client_intf.c b/python/netsnmp/client_intf.c
-index e5e7372303..94da39fe34 100644
---- a/python/netsnmp/client_intf.c
-+++ b/python/netsnmp/client_intf.c
-@@ -1316,7 +1316,7 @@ netsnmp_delete_session(PyObject *self, PyObject *args)
- 
- static int build_python_varbind(PyObject *varbind, netsnmp_variable_list *vars,
-                                 int varlist_ind, int sprintval_flag, int *len,
--                                char **str_buf)
-+                                char **str_buf, int getlabel_flag)
- {
-     struct tree *tp;
-     int type;
-@@ -1326,7 +1326,6 @@ static int build_python_varbind(PyObject *varbind, netsnmp_variable_list *vars,
-     int buf_over = 0;
-     const char *tag;
-     const char *iid;
--    int getlabel_flag = NO_FLAGS;
- 
-     if (!PyObject_HasAttrString(varbind, "tag"))
-         return TYPE_OTHER;
-@@ -1523,7 +1522,7 @@ netsnmp_get_or_getnext(PyObject *self, PyObject *args, int pdu_type,
- 
-       varbind = PySequence_GetItem(varlist, varlist_ind);
-       type = build_python_varbind(varbind, vars, varlist_ind, sprintval_flag,
--                                  &len, &str_buf);
-+                                  &len, &str_buf, getlabel_flag);
-       if (type != TYPE_OTHER) {
-           /* save in return tuple as well */
-           if ((type == SNMP_ENDOFMIBVIEW) ||
-@@ -1832,7 +1831,7 @@ netsnmp_walk(PyObject *self, PyObject *args)
- 
-               varbind = py_netsnmp_construct_varbind();
-               if (varbind && build_python_varbind(varbind, vars, varlist_ind,
--                                       sprintval_flag, &len, &str_buf) !=
-+                                       sprintval_flag, &len, &str_buf, getlabel_flag) !=
-                   TYPE_OTHER) {
-                   const int hex = is_hex(str_buf, len);
- 
-@@ -2055,7 +2054,7 @@ netsnmp_getbulk(PyObject *self, PyObject *args)
- 
- 	  varbind = py_netsnmp_construct_varbind();
-           if (varbind && build_python_varbind(varbind, vars, varbind_ind,
--                              sprintval_flag, &len, &str_buf) != TYPE_OTHER) {
-+                              sprintval_flag, &len, &str_buf, getlabel_flag) != TYPE_OTHER) {
-             const int hex = is_hex(str_buf, len);
- 
-             /* push varbind onto varbinds */
-
diff --git a/net-snmp-5.9.1-remove-des.patch b/net-snmp-5.9.1-remove-des.patch
index 60fd30f..4618655 100644
--- a/net-snmp-5.9.1-remove-des.patch
+++ b/net-snmp-5.9.1-remove-des.patch
@@ -1,6 +1,6 @@
 diff -urNp a/man/net-snmp-config.1.def b/man/net-snmp-config.1.def
---- a/man/net-snmp-config.1.def	2021-05-26 09:30:07.430790003 +0200
-+++ b/man/net-snmp-config.1.def	2021-05-26 09:35:36.703673542 +0200
+--- a/man/net-snmp-config.1.def	2026-01-12 12:42:08.018134877 +0100
++++ b/man/net-snmp-config.1.def	2026-01-12 12:43:26.749846227 +0100
 @@ -30,7 +30,7 @@ code for a list of available debug token
  SNMP Setup commands:
  .TP
@@ -11,27 +11,27 @@ diff -urNp a/man/net-snmp-config.1.def b/man/net-snmp-config.1.def
  These options produce the various compilation flags needed when
  building external SNMP applications:
 diff -urNp a/man/net-snmp-create-v3-user.1.def b/man/net-snmp-create-v3-user.1.def
---- a/man/net-snmp-create-v3-user.1.def	2021-05-26 09:30:07.430790003 +0200
-+++ b/man/net-snmp-create-v3-user.1.def	2021-05-26 09:34:23.702034230 +0200
+--- a/man/net-snmp-create-v3-user.1.def	2026-01-12 12:42:08.017134868 +0100
++++ b/man/net-snmp-create-v3-user.1.def	2026-01-12 12:44:16.263005034 +0100
 @@ -3,7 +3,7 @@
  net-snmp-create-v3-user \- create a SNMPv3 user in net-snmp configuration file
  .SH SYNOPSIS
  .PP
--.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass] [-x DES|AES]
-+.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass] [-x AES]
+-.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-X privpass] [-x DES|AES|AES128]
++.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-X privpass] [-x AES|AES128]
  .B [username]
  .SH DESCRIPTION
  .PP
-@@ -27,5 +27,5 @@ specifies the authentication password ha
+@@ -27,5 +27,5 @@ specify authentication algorithm
  \fB\-X privpass\fR
- specifies the encryption password
+ specify encryption password
  .TP
--\fB\-x DES|AES\fR
-+\fB\-x AES\fR
- specifies the encryption algorithm
+-\fB\-x DES|AES|AES128\fR
++\fB\-x AES|AES128\fR
+ specify encryption algorithm
 diff -urNp a/man/snmpcmd.1.def b/man/snmpcmd.1.def
---- a/man/snmpcmd.1.def	2021-05-26 09:30:07.429789994 +0200
-+++ b/man/snmpcmd.1.def	2021-05-26 09:37:51.104850500 +0200
+--- a/man/snmpcmd.1.def	2026-01-12 12:42:08.016788741 +0100
++++ b/man/snmpcmd.1.def	2026-01-12 12:45:15.040041004 +0100
 @@ -311,7 +311,7 @@ Overrides the \fIdefSecurityName\fR toke
  file.
  .TP
@@ -42,8 +42,8 @@ diff -urNp a/man/snmpcmd.1.def b/man/snmpcmd.1.def
  .I snmp.conf
  file. This option is only valid if the Net-SNMP software was build
 diff -urNp a/man/snmp.conf.5.def b/man/snmp.conf.5.def
---- a/man/snmp.conf.5.def	2021-05-26 09:30:07.429789994 +0200
-+++ b/man/snmp.conf.5.def	2021-05-26 09:40:03.730011937 +0200
+--- a/man/snmp.conf.5.def	2026-01-12 12:42:08.018134877 +0100
++++ b/man/snmp.conf.5.def	2026-01-12 12:47:26.967780683 +0100
 @@ -221,13 +221,13 @@ The
  value will be used for the authentication and/or privacy pass phrases
  if either of the other directives are not specified.
@@ -71,8 +71,8 @@ diff -urNp a/man/snmp.conf.5.def b/man/snmp.conf.5.def
  Sets the path of the \fBsshtosnmp\fR socket created by an application
  (e.g. snmpd) listening for incoming ssh connections through the
 diff -urNp a/man/snmpd.examples.5.def b/man/snmpd.examples.5.def
---- a/man/snmpd.examples.5.def	2021-05-26 09:30:07.429789994 +0200
-+++ b/man/snmpd.examples.5.def	2021-05-26 09:41:29.170761436 +0200
+--- a/man/snmpd.examples.5.def	2026-01-12 12:42:08.016788741 +0100
++++ b/man/snmpd.examples.5.def	2026-01-12 12:48:02.264211991 +0100
 @@ -87,8 +87,8 @@ the same authentication and encryption s
  .RS
  .nf
@@ -85,8 +85,8 @@ diff -urNp a/man/snmpd.examples.5.def b/man/snmpd.examples.5.def
  .RE
  Note that this defines three \fIdistinct\fR users, who could be granted
 diff -urNp a/man/snmptrapd.conf.5.def b/man/snmptrapd.conf.5.def
---- a/man/snmptrapd.conf.5.def	2021-05-26 09:30:07.428789985 +0200
-+++ b/man/snmptrapd.conf.5.def	2021-05-26 09:42:02.963064029 +0200
+--- a/man/snmptrapd.conf.5.def	2026-01-12 12:42:08.018134877 +0100
++++ b/man/snmptrapd.conf.5.def	2026-01-12 12:48:43.264773008 +0100
 @@ -117,7 +117,7 @@ to trigger the types of processing liste
  See
  .IR snmpd.conf (5)
@@ -97,8 +97,8 @@ diff -urNp a/man/snmptrapd.conf.5.def b/man/snmptrapd.conf.5.def
  .IR snmpd.conf (5)
  manual page for a description of how to create SNMPv3 users.  This
 diff -urNp a/man/snmpusm.1.def b/man/snmpusm.1.def
---- a/man/snmpusm.1.def	2021-05-26 09:30:07.430790003 +0200
-+++ b/man/snmpusm.1.def	2021-05-26 09:42:24.178253990 +0200
+--- a/man/snmpusm.1.def	2026-01-12 12:42:08.018134877 +0100
++++ b/man/snmpusm.1.def	2026-01-12 12:49:26.488017367 +0100
 @@ -216,7 +216,7 @@ rwuser initial
  # lets add the new user we'll create too:
  rwuser wes
@@ -109,9 +109,9 @@ diff -urNp a/man/snmpusm.1.def b/man/snmpusm.1.def
  .RE
  .PP
 diff -urNp a/net-snmp-create-v3-user.in b/net-snmp-create-v3-user.in
---- a/net-snmp-create-v3-user.in	2021-05-26 09:30:07.369789468 +0200
-+++ b/net-snmp-create-v3-user.in	2021-05-26 09:33:23.966511123 +0200
-@@ -10,7 +10,7 @@ if @PSCMD@ | egrep ' snmpd *$' > /dev/nu
+--- a/net-snmp-create-v3-user.in	2026-01-12 12:42:08.102135636 +0100
++++ b/net-snmp-create-v3-user.in	2026-01-12 12:50:35.760787628 +0100
+@@ -10,7 +10,7 @@ if @PSCMD@ | @EGREP@ ' snmpd *$' > /dev/
  fi
  
  Aalgorithm="MD5"
@@ -138,14 +138,14 @@ diff -urNp a/net-snmp-create-v3-user.in b/net-snmp-create-v3-user.in
      echo ""
      echo "Usage:"
      echo "  net-snmp-create-v3-user [-ro] [-A authpass] [-X privpass]"
--    echo "                          [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x DES|AES] [username]"
-+    echo "                          [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x AES] [username]"
+-    echo "                          [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x DES|AES|AES128] [username]"
++    echo "                          [-a MD5|SHA|SHA-512|SHA-384|SHA-256|SHA-224] [-x AES|AES128] [username]"
      echo ""
      exit
  fi
 diff -urNp a/README.snmpv3 b/README.snmpv3
---- a/README.snmpv3	2021-05-26 09:30:07.352789320 +0200
-+++ b/README.snmpv3	2021-05-26 09:44:49.109551728 +0200
+--- a/README.snmpv3	2026-01-12 12:42:08.021134904 +0100
++++ b/README.snmpv3	2026-01-12 12:51:58.767903013 +0100
 @@ -4,7 +4,7 @@ How to setup SNMPv3, a very brief docume
  do a better job on since I suck at writing documentation and he
  doesn't ;-) --Wes:
diff --git a/net-snmp-5.9.4-revert-n-snmptrapd-log.patch b/net-snmp-5.9.4-revert-n-snmptrapd-log.patch
new file mode 100644
index 0000000..981097b
--- /dev/null
+++ b/net-snmp-5.9.4-revert-n-snmptrapd-log.patch
@@ -0,0 +1,13 @@
+diff --git a/apps/snmptrapd_log.c b/apps/snmptrapd_log.c
+index 067c7f6..e6f0f1e 100644
+--- a/apps/snmptrapd_log.c
++++ b/apps/snmptrapd_log.c
+@@ -596,7 +596,7 @@ realloc_handle_time_fmt(u_char ** buf, size_t * buf_len, size_t * out_len,
+ static
+ void convert_agent_addr(struct in_addr agent_addr, char *name, size_t size)
+ {
+-    const int numeric = !netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
++    const int numeric = netsnmp_ds_get_boolean(NETSNMP_DS_APPLICATION_ID,
+                                                 NETSNMP_DS_APP_NUMERIC_IP);
+     struct sockaddr_in sin;
+ 
diff --git a/net-snmp-5.9.4-tls.patch b/net-snmp-5.9.4-tls.patch
new file mode 100644
index 0000000..1f46abb
--- /dev/null
+++ b/net-snmp-5.9.4-tls.patch
@@ -0,0 +1,150 @@
+diff --git a/include/net-snmp/library/default_store.h b/include/net-snmp/library/default_store.h
+index 1b1978e..dd590be 100644
+--- a/include/net-snmp/library/default_store.h
++++ b/include/net-snmp/library/default_store.h
+@@ -183,6 +183,8 @@ extern          "C" {
+ #define NETSNMP_DS_LIB_SSH_PUBKEY        33
+ #define NETSNMP_DS_LIB_SSH_PRIVKEY       34
+ #define NETSNMP_DS_LIB_OUTPUT_PRECISION  35
++#define NETSNMP_DS_LIB_TLS_MIN_VERSION   36
++#define NETSNMP_DS_LIB_TLS_MAX_VERSION   37
+ #define NETSNMP_DS_LIB_MAX_STR_ID        48 /* match NETSNMP_DS_MAX_SUBIDS */
+ 
+     /*
+diff --git a/man/snmpd.conf.5.def b/man/snmpd.conf.5.def
+index 0a8b9fa..d9641cc 100644
+--- a/man/snmpd.conf.5.def
++++ b/man/snmpd.conf.5.def
+@@ -203,6 +203,12 @@ HIGH:!AES128\-SHA
+ .RE
+ .IP
+ The default value is whatever openssl itself was configured with.
++.IP "tlsMinVersion STRING"
++The function sets the minimum supported TLS protocol version. 
++OPTION can be one of < tls1 | tls1_1| tls1_2 | tls1_3 >.
++.IP "tlsMaxVersion STRING"
++The function sets the maximum supported TLS protocol version. 
++OPTION can be one of < tls1 | tls1_1| tls1_2 | tls1_3 >.
+ .IP "[snmp] x509CRLFile"
+ If you are using a Certificate Authority (CA) that publishes a
+ Certificate Revocation List (CRL) then this token can be used to
+diff --git a/snmplib/transports/snmpTLSBaseDomain.c b/snmplib/transports/snmpTLSBaseDomain.c
+index e301de4..7ae2db7 100644
+--- a/snmplib/transports/snmpTLSBaseDomain.c
++++ b/snmplib/transports/snmpTLSBaseDomain.c
+@@ -490,6 +490,9 @@ SSL_CTX *
+ _sslctx_common_setup(SSL_CTX *the_ctx, _netsnmpTLSBaseData *tlsbase) {
+     char         *crlFile;
+     char         *cipherList;
++    char         *tlsMinVersion;
++    char         *tlsMaxVersion;
++    int          tlsVersion;
+     X509_LOOKUP  *lookup;
+     X509_STORE   *cert_store = NULL;
+ 
+@@ -513,6 +516,63 @@ _sslctx_common_setup(SSL_CTX *the_ctx, _netsnmpTLSBaseData *tlsbase) {
+                              X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+     }
+ 
++#ifdef SSL_CTX_set_min_proto_version
++    tlsVersion = TLS1_2_VERSION;
++    tlsMinVersion = "tls1_2";
++    tlsMinVersion = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,
++                                          NETSNMP_DS_LIB_TLS_MIN_VERSION);
++    if (NULL != tlsMinVersion) {
++        if (strcmp("tls1",tlsMinVersion) == 0) {
++           tlsVersion = TLS1_VERSION;
++        }
++        else if (strcmp("tls1_1",tlsMinVersion) == 0) {
++           tlsVersion = TLS1_1_VERSION;
++        }
++        else if (strcmp("tls1_2",tlsMinVersion) == 0) {
++           tlsVersion = TLS1_2_VERSION;
++        }
++        else if (strcmp("tls1_3",tlsMinVersion) == 0) {
++           tlsVersion = TLS1_3_VERSION;
++        }
++        else {
++            LOGANDDIE("Invalid tlsMinVersion value");
++        }
++    }
++    if (1 == SSL_CTX_set_min_proto_version(the_ctx, tlsVersion)) {
++        snmp_log(LOG_INFO,"Set tlsMinVersion to '%s'\n", tlsMinVersion);
++    }
++    else {
++        LOGANDDIE("Set tlsMinVersion failed");
++    }
++    tlsVersion = TLS1_3_VERSION;
++    tlsMaxVersion = "tls1_3";
++    tlsMaxVersion = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,
++                                          NETSNMP_DS_LIB_TLS_MAX_VERSION);
++    if (NULL != tlsMaxVersion) {
++        if (strcmp("tls1",tlsMaxVersion) == 0) {
++            tlsVersion = TLS1_VERSION;
++        }
++        else if (strcmp("tls1_1",tlsMaxVersion) == 0) {
++            tlsVersion = TLS1_1_VERSION;
++        }
++        else if (strcmp("tls1_2",tlsMaxVersion) == 0) {
++            tlsVersion = TLS1_2_VERSION;
++        }
++        else if (strcmp("tls1_3",tlsMaxVersion) == 0) {
++            tlsVersion = TLS1_3_VERSION;
++        }
++        else {
++            LOGANDDIE("Invalid tlsMaxVersion value");
++        }
++    }
++    if (1 == SSL_CTX_set_max_proto_version(the_ctx, tlsVersion)) {
++        snmp_log(LOG_INFO,"Set tlsMaxVersion to '%s'\n", tlsMaxVersion);
++    }
++    else {
++        LOGANDDIE("Set tlsMaxVersion failed");
++    }
++#endif
++
+     cipherList = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,
+                                        NETSNMP_DS_LIB_TLS_ALGORITMS);
+     if (NULL != cipherList) {
+@@ -858,6 +918,15 @@ netsnmp_tlsbase_ctor(void) {
+                                NETSNMP_DS_LIBRARY_ID,
+                                NETSNMP_DS_LIB_TLS_ALGORITMS);
+ 
++    /* What TLS version should be used at least */
++    netsnmp_ds_register_config(ASN_OCTET_STR, "snmp", "tlsMinVersion",
++                               NETSNMP_DS_LIBRARY_ID,
++                               NETSNMP_DS_LIB_TLS_MIN_VERSION);
++    /* What TLS version should be used at max */
++    netsnmp_ds_register_config(ASN_OCTET_STR, "snmp", "tlsMaxVersion",
++                               NETSNMP_DS_LIBRARY_ID,
++                               NETSNMP_DS_LIB_TLS_MAX_VERSION);
++
+     /*
+      * for the client
+      */
+diff --git a/snmplib/transports/snmpTLSTCPDomain.c b/snmplib/transports/snmpTLSTCPDomain.c
+index 0ddf023..e0133f9 100644
+--- a/snmplib/transports/snmpTLSTCPDomain.c
++++ b/snmplib/transports/snmpTLSTCPDomain.c
+@@ -718,10 +718,6 @@ netsnmp_tlstcp_open_client(netsnmp_transport *t)
+         return NULL;
+     }
+ 
+-#ifdef SSL_CTX_set_max_proto_version
+-    SSL_CTX_set_max_proto_version(tlsdata->ssl_context, 0);
+-#endif
+-
+     /* RFC5953 Section 5.3.1:  Establishing a Session as a Client
+        3)  Using the destTransportDomain and destTransportAddress values,
+        the client will initiate the (D)TLS handshake protocol to
+@@ -917,10 +913,6 @@ netsnmp_tlstcp_open_server(netsnmp_transport *t)
+ 
+     /* create the OpenSSL TLS context */
+     tlsdata->ssl_context = sslctx_server_setup(TLS_method());
+-#ifdef SSL_CTX_set_max_proto_version
+-    if (tlsdata->ssl_context)
+-        SSL_CTX_set_max_proto_version(tlsdata->ssl_context, 0);
+-#endif
+ 
+     t->sock = BIO_get_fd(tlsdata->accept_bio, NULL);
+     t->flags |= NETSNMP_TRANSPORT_FLAG_LISTEN;
diff --git a/net-snmp-libs-misunderstanding.patch b/net-snmp-libs-misunderstanding.patch
new file mode 100644
index 0000000..5e09b4b
--- /dev/null
+++ b/net-snmp-libs-misunderstanding.patch
@@ -0,0 +1,59 @@
+Libs.private should contain a list of libraries the library that the package
+exposes is linked too. So let's filter out unrelated link flags.
+
+diff --git net-snmp-5.9.1/netsnmp.pc.in~ net-snmp-5.9.1/netsnmp.pc.in
+index 0a1f5785a4..524ca91d82 100644
+--- net-snmp-5.9.1/netsnmp.pc.in~
++++ net-snmp-5.9.1/netsnmp.pc.in
+@@ -9,4 +9,4 @@ URL: http://www.net-snmp.org
+ Version: @PACKAGE_VERSION@
+ Cflags: -I${includedir}
+ Libs: -L${libdir} -lnetsnmp
+-Libs.private: @LDFLAGS@ @LNETSNMPLIBS@ @LIBS@ @PERLLDOPTS_FOR_APPS@
++Libs.private: @LNETSNMPLIBS@ @LIBS@
+diff --git net-snmp-5.9.1/netsnmp-agent.pc.in~ net-snmp-5.9.1/netsnmp-agent.pc.in
+index 3a1c77bbf8..3d3b308d21 100644
+--- net-snmp-5.9.1/netsnmp-agent.pc.in~
++++ net-snmp-5.9.1/netsnmp-agent.pc.in
+@@ -9,4 +9,4 @@ URL: http://www.net-snmp.org
+ Version: @PACKAGE_VERSION@
+ Cflags: -I${includedir}
+ Libs: -L${libdir} -lnetsnmpmibs -lnetsnmpagent -lnetsnmp
+-Libs.private: @LDFLAGS@ @LMIBLIBS@ @LAGENTLIBS@ @PERLLDOPTS_FOR_APPS@ @LNETSNMPLIBS@ @LIBS@
++Libs.private: @LMIBLIBS@ @LAGENTLIBS@ @LNETSNMPLIBS@ @LIBS@
+diff --git net-snmp-5.9.1/net-snmp-config.in~ net-snmp-5.9.1/net-snmp-config.in
+index 6b5abf8f83..ee81ce98fa 100644
+--- net-snmp-5.9.1/net-snmp-config.in~
++++ net-snmp-5.9.1/net-snmp-config.in
+@@ -193,13 +193,13 @@ else
+     #################################################### client lib
+     --libs)
+       # use this one == --netsnmp-libs + --external-libs
+-      echo $NSC_LDFLAGS $NSC_LIBDIR $NSC_SNMPLIBS $NSC_LIBS
++      echo $NSC_LIBDIR $NSC_SNMPLIBS $NSC_LIBS
+       ;;
+     --netsnmp-libs)
+       echo $NSC_LIBDIR $NSC_BASE_SNMP_LIBS
+       ;;
+     --external-libs)
+-      echo $NSC_LDFLAGS $NSC_LNETSNMPLIBS $NSC_LIBS @PERLLDOPTS_FOR_APPS@
++      echo $NSC_LNETSNMPLIBS $NSC_LIBS
+       ;;
+     #################################################### agent lib
+     --base-agent-libs)
+@@ -210,13 +210,13 @@ else
+       ;;
+     --agent-libs)
+       # use this one == --netsnmp-agent-libs + --external-libs
+-      echo $NSC_LDFLAGS $NSC_LIBDIR $NSC_AGENTLIBS $NSC_LIBS
++      echo $NSC_LIBDIR $NSC_AGENTLIBS $NSC_LIBS
+       ;;
+     --netsnmp-agent-libs)
+       echo $NSC_LIBDIR $NSC_BASE_AGENT_LIBS
+       ;;
+     --external-agent-libs)
+-      echo $NSC_LDFLAGS $NSC_LMIBLIBS $NSC_LAGENTLIBS $NSC_LNETSNMPLIBS $NSC_LIBS
++      echo $NSC_LMIBLIBS $NSC_LAGENTLIBS $NSC_LNETSNMPLIBS $NSC_LIBS
+       ;;
+     ####################################################
+     --version|--ver*)
diff --git a/net-snmp.spec b/net-snmp.spec
index f10fabe..c762558 100644
--- a/net-snmp.spec
+++ b/net-snmp.spec
@@ -5,15 +5,15 @@
 %global multilib_arches %{ix86} ia64 ppc ppc64 s390 s390x x86_64 sparc sparcv9 sparc64 aarch64
 
 # actual soname version
-%global soname  40
+%global soname  45
 
 Summary:    A collection of SNMP protocol tools and libraries
 Name:       net-snmp
-Version:    5.9.1
-Release:    4%{?dist}
+Version:    5.9.5.2
+Release:    10%{?dist}
 Epoch:      1
 
-License:    BSD
+License:    MIT-CMU AND BSD-3-Clause AND MIT
 URL:        http://net-snmp.sourceforge.net/
 Source0:    https://downloads.sourceforge.net/project/net-snmp/net-snmp/%{version}/net-snmp-%{version}.tar.gz
 Source1:    net-snmp.redhat.conf
@@ -34,30 +34,32 @@ Patch4:     net-snmp-5.9-test-debug.patch
 Patch5:     net-snmp-5.7.2-cert-path.patch
 Patch6:     net-snmp-5.9-cflags.patch
 Patch7:     net-snmp-5.8-Remove-U64-typedef.patch
-Patch8:     net-snmp-5.9-libnetsnmptrapd-against-MYSQL_LIBS.patch
-Patch9:     net-snmp-5.7.3-iterator-fix.patch
-Patch10:    net-snmp-5.9-autofs-skip.patch
-Patch11:    net-snmp-5.9-usage-exit.patch
-Patch12:    net-snmp-5.9-coverity.patch
-Patch13:    net-snmp-5.9-dskTable-dynamic.patch
-Patch14:    net-snmp-5.8-expand-SNMPCONFPATH.patch
-Patch15:    net-snmp-5.8-duplicate-ipAddress.patch
-Patch16:    net-snmp-5.9-memory-reporting.patch
-Patch17:    net-snmp-5.8-man-page.patch
-Patch18:    net-snmp-5.8-ipAddress-faster-load.patch
-Patch19:    net-snmp-5.8-rpm-memory-leak.patch
-Patch20:    net-snmp-5.9-aes-config.patch
-Patch21:    net-snmp-5.8-clientaddr-error-message.patch
-Patch22:    net-snmp-5.9-ECC-cert.patch
-Patch23:    net-snmp-5.9-intermediate-certs.patch
-#Patch24:    net-snmp-5.9.1-remove-des.patch
+Patch8:     net-snmp-5.7.3-iterator-fix.patch
+Patch9:     net-snmp-5.9-autofs-skip.patch
+Patch11:    net-snmp-5.8-expand-SNMPCONFPATH.patch
+Patch12:    net-snmp-5.8-duplicate-ipAddress.patch
+Patch13:    net-snmp-5.9-memory-reporting.patch
+Patch15:    net-snmp-5.8-ipAddress-faster-load.patch
+Patch17:    net-snmp-5.9-aes-config.patch
+Patch18:    net-snmp-5.8-clientaddr-error-message.patch
+Patch19:    net-snmp-5.9-intermediate-certs.patch
+Patch20:    net-snmp-5.9.1-remove-des.patch
+Patch21:    net-snmp-libs-misunderstanding.patch
+Patch22:    net-snmp-5.9-ipv6-disable-leak.patch
+Patch26:    net-snmp-5.9.4-tls.patch
+Patch27:    net-snmp-5.9.4-revert-n-snmptrapd-log.patch
 
 # Modern RPM API means at least EL6
 Patch101:   net-snmp-5.8-modern-rpm-api.patch
 
 #disable this patch due compatibility issues
 Patch102:   net-snmp-5.9-python3.patch
-Patch103:   net-snmp-5.9.1-python-usenumeric.patch
+
+# make Mail::Sender optional
+Patch103:   net-snmp-5.9-mail-sender.patch
+
+# Openssl 4 build fixes
+Patch104:    0001-Use-OpenSSL-accessors-for-opaque-structs.patch
 
 Requires:        %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires:        %{name}-agent-libs%{?_isa} = %{epoch}:%{version}-%{release}
@@ -66,6 +68,7 @@ Requires:        %{name}-agent-libs%{?_isa} = %{epoch}:%{version}-%{release}
 # should fire just after this package is installed.
 %{?systemd_requires}
 BuildRequires: make
+BuildRequires: libxcrypt-devel
 BuildRequires:   systemd
 BuildRequires:   gcc
 BuildRequires:   openssl-devel, bzip2-devel, elfutils-devel
@@ -74,6 +77,7 @@ BuildRequires:   perl-devel, perl(ExtUtils::Embed), procps
 BuildRequires:   python3-devel, python3-setuptools
 BuildRequires:   chrpath
 BuildRequires:   mariadb-connector-c-devel
+BuildRequires:   libnl3-devel
 # for netstat, needed by 'make test'
 BuildRequires:   net-tools
 # for make test
@@ -88,10 +92,8 @@ BuildRequires:   perl(strict)
 BuildRequires:   perl(TAP::Harness)
 BuildRequires:   perl(vars)
 BuildRequires:   perl(warnings)
-%ifnarch s390 s390x ppc64le
 BuildRequires:   lm_sensors-devel >= 3
-%endif
-BuildRequires:   autoconf, automake
+BuildRequires:   autoconf, automake, libtool
 
 %description
 SNMP (Simple Network Management Protocol) is a protocol used for
@@ -123,9 +125,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: %{name}-agent-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires: elfutils-devel, rpm-devel, elfutils-libelf-devel, openssl-devel
 Requires: redhat-rpm-config
-%ifnarch s390 s390x ppc64le
+Requires: libnl3-devel
 Requires: lm_sensors-devel
-%endif
 # pull perl development libraries, net-snmp agent libraries may link to them
 Requires: perl-devel%{?_isa}
 
@@ -139,8 +140,21 @@ applications for use with the NET-SNMP project's network management
 tools. You'll also need to have the net-snmp and net-snmp-utils
 packages installed.
 
+%package perl-module
+Summary:       The perl NET-SNMP module
+Requires:      %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}, perl-interpreter
+BuildRequires: perl-interpreter
+BuildRequires: perl-generators
+
+%description perl-module
+The net-snmp-perl package contains the perl files to use SNMP from within
+Perl.
+
+Install the net-snmp-perl package, if you want to use SNMP with perl.
+	
+
 %package perl
-Summary:       The perl NET-SNMP module and the mib2c tool
+Summary:       The perl-based utilities and the mib2c tool
 Requires:      %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}, perl-interpreter
 Requires:      %{name}-agent-libs%{?_isa} = %{epoch}:%{version}-%{release}
 Requires:      %{name}-devel%{?_isa} = %{epoch}:%{version}-%{release}
@@ -148,15 +162,17 @@ BuildRequires: perl-interpreter
 BuildRequires: perl-generators
 
 %description perl
-The net-snmp-perl package contains the perl files to use SNMP from within
-Perl.
+The net-snmp-perl package contains the utilities written in perl.
 
-Install the net-snmp-perl package, if you want to use mib2c or SNMP 
-with perl.
+Install the net-snmp-perl package, if you want to use mib2c or other
+perl utilities. Use the net-snmp-perl-module package instead to get the
+SNMP perl module.
 
 %package gui
 Summary:  An interactive graphical MIB browser for SNMP
-Requires: perl-Tk, net-snmp-perl%{?_isa} = %{epoch}:%{version}-%{release}
+Requires: perl-Tk, %{name}-perl-module%{?_isa} = %{epoch}:%{version}-%{release}
+BuildRequires: perl-interpreter
+BuildRequires: perl-generators
 
 %description gui
 The net-snmp-gui package contains tkmib utility, which is a graphical user 
@@ -176,7 +192,6 @@ binaries and applications.
 %package agent-libs
 Summary:   The NET-SNMP runtime agent libraries
 # the libs link against libperl.so:
-Requires:  perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
 Requires:  %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release}
 
 %description agent-libs
@@ -202,44 +217,48 @@ Net-SNMP toolkit library.
 cp %{SOURCE10} .
 
 %ifnarch ia64
-%patch1 -p1 -b .pie
+%patch 1 -p1 -b .pie
 %endif
 
-%patch2 -p1 -b .dir-fix
-%patch3 -p1 -b .multilib
-%patch4 -p1
-%patch5 -p1 -b .cert-path
-%patch6 -p1 -b .cflags
-%patch7 -p1 -b .u64-remove
-%patch8 -p1 -b .perlfix
-%patch9 -p1 -b .iterator-fix
-%patch10 -p1 -b .autofs-skip
-%patch11 -p1 -b .usage-fix
-%patch12 -p1 -b .coverity
-%patch13 -p1 -b .dskTable-dynamic
-%patch14 -p1 -b .expand-SNMPCONFPATH
-%patch15 -p1 -b .duplicate-ipAddress
-%patch16 -p1 -b .memory-reporting
-%patch17 -p1 -b .man-page
-%patch18 -p1 -b .ipAddress-faster-load
-%patch19 -p1 -b .rpm-memory-leak
-%patch20 -p1 -b .aes-config
-%patch21 -p1 -b .clientaddr-error-message
-%patch22 -p1 -b .ECC-cert
-%patch23 -p1 -b .intermediate-certs
-#%patch24 -p1 -b .remove-des
+%patch 2 -p1 -b .dir-fix
+%patch 3 -p1 -b .multilib
+%patch 4 -p1
+%patch 5 -p1 -b .cert-path
+%patch 6 -p1 -b .cflags
+%patch 7 -p1 -b .u64-remove
+%patch 8 -p1 -b .iterator-fix
+%patch 9 -p1 -b .autofs-skip
+%patch 11 -p1 -b .expand-SNMPCONFPATH
+%patch 12 -p1 -b .duplicate-ipAddress
+%patch 13 -p1 -b .memory-reporting
+%patch 15 -p1 -b .ipAddress-faster-load
+%patch 17 -p1 -b .aes-config
+%patch 18 -p1 -b .clientaddr-error-message
+%patch 19 -p1 -b .intermediate-certs
+%patch 20 -p1 -b .remove-des
+%patch 21 -p1
+%patch 22 -p1 -b .ipv6-disable-leak
+%patch 26 -p1 -b .tls
+%patch 27 -p1 -b .revert-n-snmptrapd-log
 
-%patch101 -p1 -b .modern-rpm-api
-%patch102 -p1
-%patch103 -p1
+%patch 101 -p1 -b .modern-rpm-api
+%patch 102 -p1
+%if 0%{?rhel}
+%patch 103 -p1
+%endif
+%patch 104 -p1
 
 # disable failing test - see https://bugzilla.redhat.com/show_bug.cgi?id=680697
 rm testing/fulltests/default/T200*
 
+# Autoreconf is run during build, which may be a different version than upstream used,
+# resulting in a mismatch during "Checking the Net-SNMP configure script validity" test
+autoconf --version | awk 'NR==1 {print $4}' > dist/autoconf-version
+
 %build
 
 # Autoreconf to get autoconf 2.69 for ARM (#926223)
-autoreconf
+autoreconf -fiv
 
 MIBS="host agentx smux \
      ucd-snmp/diskio tcp-mib udp-mib mibII/mta_sendmail \
@@ -247,12 +266,7 @@ MIBS="host agentx smux \
      ip-mib/ipAddressPrefixTable/ipAddressPrefixTable \
      ip-mib/ipDefaultRouterTable/ipDefaultRouterTable \
      ip-mib/ipv6ScopeZoneIndexTable ip-mib/ipIfStatsTable \
-     sctp-mib rmon-mib etherlike-mib"
-
-%ifnarch s390 s390x ppc64le
-# there are no lm_sensors on s390
-MIBS="$MIBS ucd-snmp/lmsensorsMib"
-%endif
+     sctp-mib rmon-mib etherlike-mib ucd-snmp/lmsensorsMib"
 
 %configure \
     --disable-static --enable-shared \
@@ -263,6 +277,7 @@ MIBS="$MIBS ucd-snmp/lmsensorsMib"
     --enable-local-smux \
     --enable-mfd-rewrites \
     --enable-ucd-snmp-compatibility \
+    --disable-des \
     --sysconfdir=%{_sysconfdir} \
     --with-cflags="$RPM_OPT_FLAGS -fPIE" \
     --with-ldflags="$RPM_LD_FLAGS -lm" \
@@ -342,6 +357,7 @@ rm -f %{buildroot}/%{_mandir}/man1/fixproc*
 rm -f %{buildroot}/%{_bindir}/ipf-mod.pl
 rm -f %{buildroot}/%{_libdir}/*.la
 rm -f %{buildroot}/%{_libdir}/libsnmp*
+rm -f %{buildroot}/%{_libdir}/perl5/vendor_perl/Bundle/MakefileSubs.pm
 
 # remove special perl files
 find %{buildroot} -name perllocal.pod \
@@ -419,7 +435,8 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %config(noreplace) %attr(0600,root,root) %{_sysconfdir}/snmp/snmptrapd.conf
 %{_bindir}/snmpconf
 %{_bindir}/net-snmp-create-v3-user
-%{_sbindir}/*
+%{_sbindir}/snmpd
+%{_sbindir}/snmptrapd
 %attr(0644,root,root) %{_mandir}/man[58]/snmp*d*
 %attr(0644,root,root) %{_mandir}/man5/snmp_config.5.gz
 %attr(0644,root,root) %{_mandir}/man5/variables*
@@ -451,6 +468,12 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %attr(0755,root,root) %{_bindir}/net-snmp-config*
 %attr(0644,root,root) %{_mandir}/man1/net-snmp-config*.1.*
 
+%files perl-module
+%attr(0644,root,root) %{_mandir}/man3/*.3pm.*
+%{perl_vendorarch}/*SNMP*
+%{perl_vendorarch}/auto/*SNMP*
+%{perl_vendorarch}/auto/Bundle/*SNMP*
+
 %files perl
 %{_bindir}/mib2c-update
 %{_bindir}/mib2c
@@ -462,13 +485,8 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %{_datadir}/snmp/*.pl
 %{_bindir}/traptoemail
 %attr(0644,root,root) %{_mandir}/man[15]/mib2c*
-%attr(0644,root,root) %{_mandir}/man3/*.3pm.*
 %attr(0644,root,root) %{_mandir}/man1/traptoemail*.1*
 %attr(0644,root,root) %{_mandir}/man1/snmp-bridge-mib.1*
-%{perl_vendorarch}/*SNMP*
-%{perl_vendorarch}/auto/*SNMP*
-%{perl_vendorarch}/auto/Bundle/*SNMP*
-%{perl_vendorarch}/Bundle/MakefileSubs.pm
 
 %files -n python3-net-snmp
 %doc README
@@ -496,13 +514,166 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %{_libdir}/libnetsnmptrapd*.so.%{soname}*
 
 %changelog
-* Fri Jul 30 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-4
+* Fri Jul 24 2026 Python Maint <python-maint@redhat.com> - 1:5.9.5.2-10
+- Rebuilt for Python 3.15.0b4 ABI change
+
+* Thu Jul 23 2026 Jitka Plesnikova <jplesnik@redhat.com> - 1:5.9.5.2-9
+- Perl 5.44 rebuild
+
+* Wed Jul 22 2026 Python Maint <python-maint@redhat.com> - 1:5.9.5.2-8
+- Rebuilt for Python 3.15.0b4 ABI change
+
+* Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.5.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Fri Jun 12 2026 Simo Sorce <ssorce@redhat.com> - 1:5.9.5.2-6
+- Openssl 4 and autoconf build fixes
+
+* Wed Jun 03 2026 Python Maint <python-maint@redhat.com> - 1:5.9.5.2-5
+- Rebuilt for Python 3.15
+
+* Thu Jan 29 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:5.9.5.2-4
+- Add net-snmp-devel dependency on libnl3-devel
+
+* Fri Jan 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.5.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Mon Jan 12 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:5.9.5.2-2
+- Enable lm_sensors on all arches
+
+* Mon Jan 12 2026 Josef Ridky <jridky@redhat.com> - 1:5.9.5.2-1
+- New upstream release 5.9.5.2
+
+* Mon Oct 13 2025 Josef Ridky <jridky@redhat.com> - 1:5.9.4-18
+- Enable PQC in net-snmp
+- Fix inverted use of -n in snmptrapd_log.c
+
+* Fri Sep 19 2025 Python Maint <python-maint@redhat.com> - 1:5.9.4-17
+- Rebuilt for Python 3.14.0rc3 bytecode
+
+* Fri Aug 15 2025 Python Maint <python-maint@redhat.com> - 1:5.9.4-16
+- Rebuilt for Python 3.14.0rc2 bytecode
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.4-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Mon Jul 07 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:5.9.4-14
+- Perl 5.42 rebuild
+
+* Mon Jun 02 2025 Python Maint <python-maint@redhat.com> - 1:5.9.4-13
+- Rebuilt for Python 3.14
+
+* Thu Mar 20 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 1:5.9.4-12
+- Avoid Mail::Sender dependency on RHEL
+
+* Sat Feb 01 2025 Björn Esser <besser82@fedoraproject.org> - 1:5.9.4-11
+- Add explicit BR: libxcrypt-devel
+
+* Thu Jan 23 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 1:5.9.4-10
+- Fix file listings for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.4-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.4-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Wed Jun 12 2024 Jitka Plesnikova <jplesnik@redhat.com> - 1:5.9.4-7
+- Perl 5.40 rebuild
+
+* Fri Jun 07 2024 Python Maint <python-maint@redhat.com> - 1:5.9.4-6
+- Rebuilt for Python 3.13
+
+* Tue Mar 12 2024 Josef Ridky <jridky@redhat.com> - 1:5.9.4-5
+- Fix parsing issue for kernel 6.7+ (#2266893)
+
+* Fri Feb 16 2024 Josef Ridky <jridky@redhat.com> - 1:5.9.4-4
+- Autoconf upgrade (#2256768)
+
+* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Aug 16 2023 Josef Ridky <jridky@redhat.com> - 1:5.9.4-1
+- New upstream release 5.9.4 (#2184202)
+
+* Mon Aug 14 2023 Josef Ridky <jridky@redhat.com> - 1:5.9.3-8
+- Fix warning for RPM DB
+- split perl module into separate package that doesn't pull in gcc and
+  other build dependencies (thanks Chris Adams)
+- don't install MakefileSubs.pm - it's just needed at module build time
+  (thanks Chris Adams)
+
+* Tue Aug 01 2023 Josef Ridky <jridky@redhat.com> - 1:5.9.3-7
+- Sync fixes with RHEL
+- Fix sendmesg error code change for new kernel
+
+* Wed Jul 19 2023 Josef Ridky <jridky@redhat.com> - 1:5.9.3-6
+- Migrate to SPDX license format
+
+* Tue Jul 11 2023 Jitka Plesnikova <jplesnik@redhat.com> - 1:5.9.3-5
+- Perl 5.38 rebuild
+
+* Tue Jun 13 2023 Python Maint <python-maint@redhat.com> - 1:5.9.3-4
+- Rebuilt for Python 3.12
+
+* Fri May 19 2023 Petr Pisar <ppisar@redhat.com> - 1:5.9.3-3
+- Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19)
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Aug 04 2022 Josef Ridky <jridky@redhat.com> - 1:5.9.3-1
+- New upstream release 5.9.3 (#2072230)
+
+* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.1-17
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Jun 13 2022 Python Maint <python-maint@redhat.com> - 1:5.9.1-16
+- Rebuilt for Python 3.11
+
+* Mon May 30 2022 Jitka Plesnikova <jplesnik@redhat.com> - 1:5.9.1-15
+- Perl 5.36 rebuild
+
+* Sat Jan 29 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:5.9.1-14
+- Remove linker flags from Libs.private (#2043092)
+
+* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.1-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Mon Oct 04 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-12
+- fix FTBFS of ERR_get_error (#2008781)
+
+* Wed Sep 15 2021 Sahana Prasad <sahana@redhat.com> - 1:5.9.1-11
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Sep 15 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-10
+- Remove ERR_GET_FUNC from code (#2004351)
+
+* Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1:5.9.1-9
+- Rebuilt with OpenSSL 3.0.0
+
+* Wed Sep 01 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-8
+- fix FTBFS (#1999475)
+
+* Thu Jul 29 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-7
 - revert cflags modification in net-snmp-config as was reverted in upstream
   and add proper dependency to net-snmp-devel sub-package (#1544527)
 
-* Mon Jul 19 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-3
+* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:5.9.1-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Mon Jul 19 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-5
 - fix UseNumeric in Python library (#1970937)
 
+* Fri Jun 04 2021 Python Maint <python-maint@redhat.com> - 1:5.9.1-4
+- Rebuilt for Python 3.10
+
+* Tue Jun 01 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-3
+- disable DES for F35+
+
 * Tue Jun 01 2021 Josef Ridky <jridky@redhat.com> - 1:5.9.1-2
 - restore DES for F34 and F33
 
diff --git a/plans/ci.fmf b/plans/ci.fmf
new file mode 100644
index 0000000..c1627f9
--- /dev/null
+++ b/plans/ci.fmf
@@ -0,0 +1,5 @@
+summary: Basic smoke test
+discover:
+    how: fmf
+execute:
+    how: tmt
diff --git a/sources b/sources
index 30f421d..fb75aae 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (net-snmp-5.9.1.tar.gz) = 7d73b2085863b1c063d7eaee488d806cc07da79c070f702068846e43d8e5c67673b86357600f2c1f774c30c24b0561cb566c64ea4588b073bf6906a9c6949ab7
+SHA512 (net-snmp-5.9.5.2.tar.gz) = c320c90e01377651fdff3aa9c373b9013f142fab23810d821174e546716ef2fa6499a805728710c67ca7fe238679111df392754c24ea4e01768faa5535ac7db2
diff --git a/tests/integration-tests/Makefile b/tests/integration-tests/Makefile
index 2f27fbf..9e49696 100644
--- a/tests/integration-tests/Makefile
+++ b/tests/integration-tests/Makefile
@@ -27,7 +27,7 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          net-snmp" >> $(METADATA)
-	@echo "Requires:        net=snmp" >> $(METADATA)
+	@echo "Requires:        net-snmp net-snmp-utils iproute python3 python3-pyroute2" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
diff --git a/tests/integration-tests/main.fmf b/tests/integration-tests/main.fmf
new file mode 100644
index 0000000..64426d7
--- /dev/null
+++ b/tests/integration-tests/main.fmf
@@ -0,0 +1,16 @@
+summary: Test snmpd
+description: ''
+contact: Susant Sahani<susant@redhat.com>
+component:
+  - net-snmp
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+  - net-snmp
+  - net-snmp-utils
+  - iproute
+  - python3
+  - python3-pyroute2
+duration: 5m
+extra-summary: /CoreOS/net-snmp
+extra-task: /CoreOS/net-snmp
diff --git a/tests/integration-tests/net-snmp-tests.py b/tests/integration-tests/net-snmp-tests.py
index 4cb19eb..746c9d8 100755
--- a/tests/integration-tests/net-snmp-tests.py
+++ b/tests/integration-tests/net-snmp-tests.py
@@ -15,12 +15,10 @@ import unittest
 import subprocess
 import signal
 import shutil
-import psutil
 import socket
 import platform
 import re
 from pyroute2 import IPRoute
-from psutil import virtual_memory
 from collections import OrderedDict
 
 HOST='192.168.111.50'
@@ -140,11 +138,7 @@ class SnmpdTests(unittest.TestCase, GenericUtilities):
 
         # 1.3.6.1.2.1.1.1 - sysDescr
         output=subprocess.check_output(['snmpwalk', '-v2c', '-c', 'public', HOST, '1.3.6.1.2.1.1.1']).rstrip().decode('utf-8')
-        self.assertRegex(output, platform.machine())
-        self.assertRegex(output, platform.node())
-        self.assertRegex(output, platform.processor())
-        self.assertRegex(output, platform.release())
-        self.assertRegex(output, platform.version())
+        self.assertRegex(output, " ".join(platform.uname()).strip())
 
         # 1.3.6.1.2.1.1.2 - sysObjectID
         subprocess.check_output(['snmpwalk', '-v2c', '-c', 'public', HOST, '1.3.6.1.2.1.1.2'])
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index f600628..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-- hosts: localhost
-  roles:
-    - role: standard-test-beakerlib
-      tags:
-      - classic
-      tests:
-      - integration-tests
-      required_packages:
-      - python3
-      - systemd
-      - iproute
-      - python3-pyroute2
-      - net-snmp
-      - net-snmp-utils