diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/.gitignore b/.gitignore index c2dc451..e16a3d0 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ /*.asc -/*.xz +/*.xz \ No newline at end of file diff --git a/cache_swap.sh b/cache_swap.sh index 77d06ac..89f3478 100644 --- a/cache_swap.sh +++ b/cache_swap.sh @@ -17,5 +17,8 @@ done if [ $init_cache_dirs -ne 0 ]; then echo "" - squid --foreground -z -f "$SQUID_CONF" >> /var/log/squid/squid.out 2>&1 + if ! squid --foreground -z -f "$SQUID_CONF" >> /var/log/squid/squid.out 2>&1; then + echo "init_cache_dir failed, see /var/log/squid/squid.out for more information" + exit 1 + fi fi diff --git a/gating.yaml b/gating.yaml new file mode 100644 index 0000000..d2f0c2e --- /dev/null +++ b/gating.yaml @@ -0,0 +1,16 @@ +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_testing] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} + +#gating rawhide +--- !Policy +product_versions: + - fedora-* +decision_contexts: [bodhi_update_push_stable] +subject_type: koji_build +rules: + - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional} diff --git a/pgp.asc b/pgp.asc deleted file mode 100644 index 2f74573..0000000 Binary files a/pgp.asc and /dev/null differ diff --git a/plans/all.fmf b/plans/all.fmf new file mode 100644 index 0000000..cdfc481 --- /dev/null +++ b/plans/all.fmf @@ -0,0 +1,6 @@ +summary: Test plan with all beakerlib tests +discover: + how: fmf + url: https://src.fedoraproject.org/tests/squid.git +execute: + how: tmt diff --git a/sources b/sources index 1f508a5..0ab49b2 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ -SHA512 (squid-4.12.tar.xz) = 96fa700a0c28711eb1ec5e44e1d324dc8d3accdddbc675def8babe057e2cc71083bd3817bc37cbd9f3c03772743df578573ee3698bbd6131df68c3580ad31ef4 -SHA512 (squid-4.12.tar.xz.asc) = 3283912319f5a027b4c9302f3ed26082d7f22e3797b39edd7eaa3df10904fb170352745a0dc1eda50c4c669b2037d9c596a8163f827f5060ec3ecfe0d6b22b27 +SHA512 (squid-7.6.tar.xz) = e1cf55c0ba55b6cddbc8ef9b1522622040327ec85ea454cdac8c3a7c6e5430a9f32e69b9b964f4689f19d924e90b06f4fb7c44cfbabcb06f3762844f4ba48b3a +SHA512 (squid-7.6.tar.xz.asc) = f4fed611ce64f5409741c3eaaa61b3ddb543afcb7adca3ccf336636b716065370b67443cf0afaad463e79f362acb3fc9cca72f629d8c244408a0b90a006c78e4 +SHA512 (pgp.asc) = b1e1dd5ead34711f064a12a324b2f156ad4835330d861eae4032926b8a6cd07c0eacc76f52518d47ed5a8ead4695f5abd02f2b4190af8e7833bd3ea31453569d diff --git a/squid-3.5.9-include-guards.patch b/squid-3.5.9-include-guards.patch deleted file mode 100644 index e2d4ff9..0000000 --- a/squid-3.5.9-include-guards.patch +++ /dev/null @@ -1,95 +0,0 @@ ------------------------------------------------------------- -revno: 14311 -revision-id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4 -parent: squid3@treenet.co.nz-20150924032241-6cx3g6hwz9xfoybr ------------------------------------------------------------- -revno: 14311 -revision-id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4 -parent: squid3@treenet.co.nz-20150924032241-6cx3g6hwz9xfoybr -fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4323 -author: Francesco Chemolli -committer: Amos Jeffries -branch nick: trunk -timestamp: Thu 2015-09-24 06:05:37 -0700 -message: - Bug 4323: Netfilter broken cross-includes with Linux 4.2 ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4 -# target_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/ -# testament_sha1: c67cfca81040f3845d7c4caf2f40518511f14d0b -# timestamp: 2015-09-24 13:06:33 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/trunk -# base_revision_id: squid3@treenet.co.nz-20150924032241-\ -# 6cx3g6hwz9xfoybr -# -# Begin patch -=== modified file 'compat/os/linux.h' ---- compat/os/linux.h 2015-01-13 07:25:36 +0000 -+++ compat/os/linux.h 2015-09-24 13:05:37 +0000 -@@ -30,6 +30,21 @@ - #endif - - /* -+ * Netfilter header madness. (see Bug 4323) -+ * -+ * Netfilter have a history of defining their own versions of network protocol -+ * primitives without sufficient protection against the POSIX defines which are -+ * aways present in Linux. -+ * -+ * netinet/in.h must be included before any other sys header in order to properly -+ * activate include guards in the kernel maintainers added -+ * to workaround it. -+ */ -+#if HAVE_NETINET_IN_H -+#include -+#endif -+ -+/* - * sys/capability.h is only needed in Linux apparently. - * - * HACK: LIBCAP_BROKEN Ugly glue to get around linux header madness colliding with glibc -fixes bug: http://bugs.squid-cache.org/show_bug.cgi?id=4323 -author: Francesco Chemolli -committer: Amos Jeffries -branch nick: trunk -timestamp: Thu 2015-09-24 06:05:37 -0700 -message: - Bug 4323: Netfilter broken cross-includes with Linux 4.2 ------------------------------------------------------------- -# Bazaar merge directive format 2 (Bazaar 0.90) -# revision_id: squid3@treenet.co.nz-20150924130537-lqwzd1z99a3l9gt4 -# target_branch: http://bzr.squid-cache.org/bzr/squid3/trunk/ -# testament_sha1: c67cfca81040f3845d7c4caf2f40518511f14d0b -# timestamp: 2015-09-24 13:06:33 +0000 -# source_branch: http://bzr.squid-cache.org/bzr/squid3/trunk -# base_revision_id: squid3@treenet.co.nz-20150924032241-\ -# 6cx3g6hwz9xfoybr -# -# Begin patch -=== modified file 'compat/os/linux.h' ---- compat/os/linux.h 2015-01-13 07:25:36 +0000 -+++ compat/os/linux.h 2015-09-24 13:05:37 +0000 -@@ -30,6 +30,21 @@ - #endif - - /* -+ * Netfilter header madness. (see Bug 4323) -+ * -+ * Netfilter have a history of defining their own versions of network protocol -+ * primitives without sufficient protection against the POSIX defines which are -+ * aways present in Linux. -+ * -+ * netinet/in.h must be included before any other sys header in order to properly -+ * activate include guards in the kernel maintainers added -+ * to workaround it. -+ */ -+#if HAVE_NETINET_IN_H -+#include -+#endif -+ -+/* - * sys/capability.h is only needed in Linux apparently. - * - * HACK: LIBCAP_BROKEN Ugly glue to get around linux header madness colliding with glibc - diff --git a/squid-4.0.21-large-acl.patch b/squid-4.0.21-large-acl.patch deleted file mode 100644 index 8aacf38..0000000 --- a/squid-4.0.21-large-acl.patch +++ /dev/null @@ -1,178 +0,0 @@ -diff --git a/src/acl/RegexData.cc b/src/acl/RegexData.cc -index 01a4c12..b5c1679 100644 ---- a/src/acl/RegexData.cc -+++ b/src/acl/RegexData.cc -@@ -22,6 +22,7 @@ - #include "ConfigParser.h" - #include "Debug.h" - #include "sbuf/List.h" -+#include "sbuf/Algorithms.h" - - ACLRegexData::~ACLRegexData() - { -@@ -129,6 +130,18 @@ compileRE(std::list &curlist, const char * RE, int flags) - return true; - } - -+static bool -+compileRE(std::list &curlist, const SBufList &RE, int flags) -+{ -+ if (RE.empty()) -+ return curlist.empty(); // XXX: old code did this. It looks wrong. -+ SBuf regexp; -+ static const SBuf openparen("("), closeparen(")"), separator(")|("); -+ JoinContainerIntoSBuf(regexp, RE.begin(), RE.end(), separator, openparen, -+ closeparen); -+ return compileRE(curlist, regexp.c_str(), flags); -+} -+ - /** Compose and compile one large RE from a set of (small) REs. - * The ultimate goal is to have only one RE per ACL so that match() is - * called only once per ACL. -@@ -137,16 +150,11 @@ static int - compileOptimisedREs(std::list &curlist, const SBufList &sl) - { - std::list newlist; -- int numREs = 0; -+ SBufList accumulatedRE; -+ int numREs = 0, reSize = 0; - int flags = REG_EXTENDED | REG_NOSUB; -- int largeREindex = 0; -- char largeRE[BUFSIZ]; -- *largeRE = 0; - - for (const SBuf & configurationLineWord : sl) { -- int RElen; -- RElen = configurationLineWord.length(); -- - static const SBuf minus_i("-i"); - static const SBuf plus_i("+i"); - if (configurationLineWord == minus_i) { -@@ -155,10 +163,11 @@ compileOptimisedREs(std::list &curlist, const SBufList &sl) - debugs(28, 2, "optimisation of -i ... -i" ); - } else { - debugs(28, 2, "-i" ); -- if (!compileRE(newlist, largeRE, flags)) -+ if (!compileRE(newlist, accumulatedRE, flags)) - return 0; - flags |= REG_ICASE; -- largeRE[largeREindex=0] = '\0'; -+ accumulatedRE.clear(); -+ reSize = 0; - } - } else if (configurationLineWord == plus_i) { - if ((flags & REG_ICASE) == 0) { -@@ -166,37 +175,34 @@ compileOptimisedREs(std::list &curlist, const SBufList &sl) - debugs(28, 2, "optimisation of +i ... +i"); - } else { - debugs(28, 2, "+i"); -- if (!compileRE(newlist, largeRE, flags)) -+ if (!compileRE(newlist, accumulatedRE, flags)) - return 0; - flags &= ~REG_ICASE; -- largeRE[largeREindex=0] = '\0'; -+ accumulatedRE.clear(); -+ reSize = 0; - } -- } else if (RElen + largeREindex + 3 < BUFSIZ-1) { -+ } else if (reSize < 1024) { - debugs(28, 2, "adding RE '" << configurationLineWord << "'"); -- if (largeREindex > 0) { -- largeRE[largeREindex] = '|'; -- ++largeREindex; -- } -- largeRE[largeREindex] = '('; -- ++largeREindex; -- configurationLineWord.copy(largeRE+largeREindex, BUFSIZ-largeREindex); -- largeREindex += configurationLineWord.length(); -- largeRE[largeREindex] = ')'; -- ++largeREindex; -- largeRE[largeREindex] = '\0'; -+ accumulatedRE.push_back(configurationLineWord); - ++numREs; -+ reSize += configurationLineWord.length(); - } else { - debugs(28, 2, "buffer full, generating new optimised RE..." ); -- if (!compileRE(newlist, largeRE, flags)) -+ accumulatedRE.push_back(configurationLineWord); -+ if (!compileRE(newlist, accumulatedRE, flags)) - return 0; -- largeRE[largeREindex=0] = '\0'; -+ accumulatedRE.clear(); -+ reSize = 0; - continue; /* do the loop again to add the RE to largeRE */ - } - } - -- if (!compileRE(newlist, largeRE, flags)) -+ if (!compileRE(newlist, accumulatedRE, flags)) - return 0; - -+ accumulatedRE.clear(); -+ reSize = 0; -+ - /* all was successful, so put the new list at the tail */ - curlist.splice(curlist.end(), newlist); - -diff --git a/src/sbuf/Algorithms.h b/src/sbuf/Algorithms.h -index 21ee889..338e9c0 100644 ---- a/src/sbuf/Algorithms.h -+++ b/src/sbuf/Algorithms.h -@@ -81,6 +81,57 @@ SBufContainerJoin(const Container &items, const SBuf& separator) - return rv; - } - -+/** Join container of SBufs and append to supplied target -+ * -+ * append to the target SBuf all elements in the [begin,end) range from -+ * an iterable container, prefixed by prefix, separated by separator and -+ * followed by suffix. Prefix and suffix are added also in case of empty -+ * iterable -+ * -+ * \return the modified dest -+ */ -+template -+SBuf& -+JoinContainerIntoSBuf(SBuf &dest, const ContainerIterator &begin, -+ const ContainerIterator &end, const SBuf& separator, -+ const SBuf& prefix = SBuf(), const SBuf& suffix = SBuf()) -+{ -+ if (begin == end) { -+ dest.append(prefix).append(suffix); -+ return dest; -+ } -+ -+ // optimization: pre-calculate needed storage -+ const SBuf::size_type totalContainerSize = -+ std::accumulate(begin, end, 0, SBufAddLength(separator)) + -+ dest.length() + prefix.length() + suffix.length(); -+ SBufReservationRequirements req; -+ req.minSpace = totalContainerSize; -+ dest.reserve(req); -+ -+ auto i = begin; -+ dest.append(prefix); -+ dest.append(*i); -+ ++i; -+ for (; i != end; ++i) -+ dest.append(separator).append(*i); -+ dest.append(suffix); -+ return dest; -+} -+ -+ -+/// convenience wrapper of JoinContainerIntoSBuf with no caller-supplied SBuf -+template -+SBuf -+JoinContainerToSBuf(const ContainerIterator &begin, -+ const ContainerIterator &end, const SBuf& separator, -+ const SBuf& prefix = SBuf(), const SBuf& suffix = SBuf()) -+{ -+ SBuf rv; -+ return JoinContainerIntoSBuf(rv, begin, end, separator, prefix, suffix); -+} -+ -+ - namespace std { - /// default hash functor to support std::unordered_map - template <> diff --git a/squid-4.0.11-config.patch b/squid-6.1-config.patch similarity index 61% rename from squid-4.0.11-config.patch rename to squid-6.1-config.patch index a4faae8..9d2b192 100644 --- a/squid-4.0.11-config.patch +++ b/squid-6.1-config.patch @@ -1,7 +1,8 @@ -diff -up squid-4.0.11/src/cf.data.pre.config squid-4.0.11/src/cf.data.pre ---- squid-4.0.11/src/cf.data.pre.config 2016-06-09 22:32:57.000000000 +0200 -+++ squid-4.0.11/src/cf.data.pre 2016-07-11 21:08:35.090976840 +0200 -@@ -4658,7 +4658,7 @@ DOC_END +diff --git a/src/cf.data.pre b/src/cf.data.pre +index 44aa34d..12225bc 100644 +--- a/src/cf.data.pre ++++ b/src/cf.data.pre +@@ -5453,7 +5453,7 @@ DOC_END NAME: logfile_rotate TYPE: int @@ -10,7 +11,7 @@ diff -up squid-4.0.11/src/cf.data.pre.config squid-4.0.11/src/cf.data.pre LOC: Config.Log.rotateNumber DOC_START Specifies the default number of logfile rotations to make when you -@@ -6444,11 +6444,11 @@ COMMENT_END +@@ -7447,11 +7447,11 @@ COMMENT_END NAME: cache_mgr TYPE: string diff --git a/squid-3.1.0.9-location.patch b/squid-6.1-location.patch similarity index 100% rename from squid-3.1.0.9-location.patch rename to squid-6.1-location.patch diff --git a/squid-3.0.STABLE1-perlpath.patch b/squid-6.1-perlpath.patch similarity index 69% rename from squid-3.0.STABLE1-perlpath.patch rename to squid-6.1-perlpath.patch index 087469d..b441540 100644 --- a/squid-3.0.STABLE1-perlpath.patch +++ b/squid-6.1-perlpath.patch @@ -1,10 +1,10 @@ diff --git a/contrib/url-normalizer.pl b/contrib/url-normalizer.pl -index 4cb0480..4b89910 100755 +index e965e9e..ed5ffcb 100755 --- a/contrib/url-normalizer.pl +++ b/contrib/url-normalizer.pl @@ -1,4 +1,4 @@ -#!/usr/local/bin/perl -Tw +#!/usr/bin/perl -Tw # - # * Copyright (C) 1996-2020 The Squid Software Foundation and contributors + # * Copyright (C) 1996-2026 The Squid Software Foundation and contributors # * diff --git a/squid-6.1-symlink-lang-err.patch b/squid-6.1-symlink-lang-err.patch new file mode 100644 index 0000000..a29274b --- /dev/null +++ b/squid-6.1-symlink-lang-err.patch @@ -0,0 +1,26 @@ +diff --git a/errors/aliases b/errors/aliases +index c256106..38c123a 100644 +--- a/errors/aliases ++++ b/errors/aliases +@@ -14,8 +14,7 @@ da da-dk + de de-at de-ch de-de de-li de-lu + el el-gr + en en-au en-bz en-ca en-cn en-gb en-ie en-in en-jm en-nz en-ph en-sg en-tt en-uk en-us en-za en-zw +-es es-ar es-bo es-cl es-cu es-co es-do es-ec es-es es-pe es-pr es-py es-us es-uy es-ve es-xl spq +-es-mx es-bz es-cr es-gt es-hn es-ni es-pa es-sv ++es es-ar es-bo es-cl es-co es-cr es-do es-ec es-es es-gt es-hn es-mx es-ni es-pa es-pe es-pr es-py es-sv es-us es-uy es-ve es-xl + et et-ee + fa fa-fa fa-ir + fi fi-fi +diff --git a/errors/language.am b/errors/language.am +index a437d17..f2fe463 100644 +--- a/errors/language.am ++++ b/errors/language.am +@@ -19,7 +19,6 @@ LANGUAGE_FILES = \ + de.lang \ + el.lang \ + en.lang \ +- es-mx.lang \ + es.lang \ + et.lang \ + fa.lang \ diff --git a/squid-7.5-openssl4.patch b/squid-7.5-openssl4.patch new file mode 100644 index 0000000..8af6818 --- /dev/null +++ b/squid-7.5-openssl4.patch @@ -0,0 +1,361 @@ +From 00a8938a5561ae11c6e4d563c67ee85621499e18 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Wed, 6 May 2026 17:18:58 +0200 +Subject: [PATCH] Fix OpenSSL 4.0 compatibility + +Replace direct ASN1 structure field access with accessor functions. +and use ASN1_STRING_set() instead of direct field assignment. + +Fix issues caused by X509* API constness changes; in some cases, +casting the const away is necessary to keep compatibility with +OpenSSL 3. +--- + .../cert_generators/file/certificate_db.cc | 2 +- + src/ssl/gadgets.cc | 92 +++++++++++-------- + src/ssl/gadgets.h | 4 +- + src/ssl/support.cc | 18 ++-- + 4 files changed, 66 insertions(+), 50 deletions(-) + +diff --git a/src/security/cert_generators/file/certificate_db.cc b/src/security/cert_generators/file/certificate_db.cc +index 4b729b3..35849aa 100644 +--- a/src/security/cert_generators/file/certificate_db.cc ++++ b/src/security/cert_generators/file/certificate_db.cc +@@ -335,7 +335,7 @@ Ssl::CertificateDb::addCertAndPrivateKey(std::string const &useKey, const Securi + } + + const auto tm = X509_getm_notAfter(cert.get()); +- row.setValue(cnlExp_date, std::string(reinterpret_cast(tm->data), tm->length).c_str()); ++ row.setValue(cnlExp_date, std::string(reinterpret_cast(ASN1_STRING_get0_data(tm)), ASN1_STRING_length(tm)).c_str()); + const auto subject = OneLineSummary(*X509_get_subject_name(cert.get())); + row.setValue(cnlName, subject.get()); + row.setValue(cnlKey, useKey.c_str()); +diff --git a/src/ssl/gadgets.cc b/src/ssl/gadgets.cc +index 06b8b79..100ee6a 100644 +--- a/src/ssl/gadgets.cc ++++ b/src/ssl/gadgets.cc +@@ -259,20 +259,31 @@ static bool replaceCommonName(Security::CertPointer & cert, std::string const &r + if (cn.length() > 2 && *cn.begin() == '[' && *cn.rbegin() == ']') + cn = cn.substr(1, cn.size()-2); + +- X509_NAME *name = X509_get_subject_name(cert.get()); ++ const X509_NAME *subject = X509_get_subject_name(cert.get()); ++ if (!subject) ++ return false; ++ ++ X509_NAME *name = X509_NAME_dup(subject); + if (!name) + return false; ++ + // Remove the CN part: + int loc = X509_NAME_get_index_by_NID(name, NID_commonName, -1); +- if (loc >=0) { +- X509_NAME_ENTRY *tmp = X509_NAME_get_entry(name, loc); +- X509_NAME_delete_entry(name, loc); ++ if (loc >= 0) { ++ X509_NAME_ENTRY *tmp = X509_NAME_delete_entry(name, loc); + X509_NAME_ENTRY_free(tmp); + } + + // Add a new CN +- return X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, +- (unsigned char *)(cn.c_str()), -1, -1, 0); ++ if (!X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, ++ (unsigned char *)(cn.c_str()), -1, -1, 0)) { ++ X509_NAME_free(name); ++ return false; ++ } ++ ++ int ret = X509_set_subject_name(cert.get(), name); ++ X509_NAME_free(name); ++ return ret; + } + + const char *Ssl::CertSignAlgorithmStr[] = { +@@ -301,9 +312,9 @@ static void + printX509Signature(const Security::CertPointer &cert, std::string &out) + { + const ASN1_BIT_STRING *sig = Ssl::X509_get_signature(cert); +- if (sig && sig->data) { +- const unsigned char *s = sig->data; +- for (int i = 0; i < sig->length; ++i) { ++ if (sig && ASN1_STRING_get0_data(sig)) { ++ const unsigned char *s = ASN1_STRING_get0_data(sig); ++ for (int i = 0; i < ASN1_STRING_length(sig); ++i) { + char hex[3]; + snprintf(hex, sizeof(hex), "%02x", s[i]); + out.append(hex); +@@ -377,7 +388,7 @@ mimicAuthorityKeyId(Security::CertPointer &cert, Security::CertPointer const &mi + X509_EXTENSION *ext; + // Check if the issuer has the Subject Key Identifier extension + const int indx = X509_get_ext_by_NID(issuerCert.get(), NID_subject_key_identifier, -1); +- if (indx >= 0 && (ext = X509_get_ext(issuerCert.get(), indx))) { ++ if (indx >= 0 && (ext = const_cast(X509_get_ext(issuerCert.get(), indx)))) { + issuerKeyId.reset((ASN1_OCTET_STRING *)X509V3_EXT_d2i(ext)); + } + } +@@ -418,8 +429,7 @@ mimicAuthorityKeyId(Security::CertPointer &cert, Security::CertPointer const &mi + unsigned char *ext_der = nullptr; + int ext_len = ASN1_item_i2d((ASN1_VALUE *)theAuthKeyId.get(), &ext_der, ASN1_ITEM_ptr(method->it)); + Ssl::ASN1_OCTET_STRING_Pointer extOct(ASN1_OCTET_STRING_new()); +- extOct.get()->data = ext_der; +- extOct.get()->length = ext_len; ++ ASN1_STRING_set(extOct.get(), ext_der, ext_len); + Ssl::X509_EXTENSION_Pointer extAuthKeyId(X509_EXTENSION_create_by_NID(nullptr, NID_authority_key_identifier, 0, extOct.get())); + if (!extAuthKeyId.get()) + return false; +@@ -471,7 +481,7 @@ mimicExtensions(Security::CertPointer & cert, Security::CertPointer const &mimic + int nid; + for (int i = 0; (nid = extensions[i]) != 0; ++i) { + const int pos = X509_get_ext_by_NID(mimicCert.get(), nid, -1); +- if (X509_EXTENSION *ext = X509_get_ext(mimicCert.get(), pos)) { ++ if (X509_EXTENSION *ext = const_cast(X509_get_ext(mimicCert.get(), pos))) { + // Mimic extension exactly. + if (X509_add_ext(cert.get(), ext, -1)) + ++added; +@@ -482,7 +492,7 @@ mimicExtensions(Security::CertPointer & cert, Security::CertPointer const &mimic + // that the more stringent requirements are met. + + const int p = X509_get_ext_by_NID(cert.get(), NID_key_usage, -1); +- if ((ext = X509_get_ext(cert.get(), p)) != nullptr) { ++ if ((ext = const_cast(X509_get_ext(cert.get(), p))) != nullptr) { + ASN1_BIT_STRING *keyusage = (ASN1_BIT_STRING *)X509V3_EXT_d2i(ext); + ASN1_BIT_STRING_set_bit(keyusage, KeyEncipherment, 1); + +@@ -495,8 +505,7 @@ mimicExtensions(Security::CertPointer & cert, Security::CertPointer const &mimic + (const ASN1_ITEM *)ASN1_ITEM_ptr(method->it)); + + ASN1_OCTET_STRING *ext_oct = ASN1_OCTET_STRING_new(); +- ext_oct->data = ext_der; +- ext_oct->length = ext_len; ++ ASN1_STRING_set(ext_oct, ext_der, ext_len); + X509_EXTENSION_set_data(ext, ext_oct); + + ASN1_OCTET_STRING_free(ext_oct); +@@ -518,7 +527,7 @@ mimicExtensions(Security::CertPointer & cert, Security::CertPointer const &mimic + SBuf + Ssl::AsnToSBuf(const ASN1_STRING &buffer) + { +- return SBuf(reinterpret_cast(buffer.data), buffer.length); ++ return SBuf(reinterpret_cast(ASN1_STRING_get0_data(&buffer)), ASN1_STRING_length(&buffer)); + } + + /// OpenSSL ASN1_STRING_to_UTF8() wrapper +@@ -547,7 +556,7 @@ Ssl::ParseAsSimpleDomainNameOrIp(const SBuf &text) + } + + std::optional +-Ssl::ParseCommonNameAt(X509_NAME &name, const int cnIndex) ++Ssl::ParseCommonNameAt(const X509_NAME &name, const int cnIndex) + { + const auto cn = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(&name, cnIndex)); + if (!cn) { +@@ -576,7 +585,7 @@ Ssl::ParseCommonNameAt(X509_NAME &name, const int cnIndex) + static bool + addAltNameWithSubjectCn(Security::CertPointer &cert) + { +- X509_NAME *name = X509_get_subject_name(cert.get()); ++ const X509_NAME *name = X509_get_subject_name(cert.get()); + if (!name) + return false; + +@@ -610,7 +619,7 @@ static bool buildCertificate(Security::CertPointer & cert, Ssl::CertificatePrope + // returns a pointer to the existing subject name. Nothing to clean here. + if (properties.mimicCert.get()) { + // Leave subject empty if we cannot extract it from true cert. +- if (X509_NAME *name = X509_get_subject_name(properties.mimicCert.get())) { ++ if (const X509_NAME *name = X509_get_subject_name(properties.mimicCert.get())) { + // X509_set_subject_name will call X509_dup for name + X509_set_subject_name(cert.get(), name); + } +@@ -656,7 +665,7 @@ static bool buildCertificate(Security::CertPointer & cert, Ssl::CertificatePrope + bool useCommonNameAsAltName = true; + // mimic the alias and possibly subjectAltName + if (properties.mimicCert.get()) { +- unsigned char *alStr; ++ const unsigned char *alStr; + int alLen; + alStr = X509_alias_get0(properties.mimicCert.get(), &alLen); + if (alStr) { +@@ -667,7 +676,7 @@ static bool buildCertificate(Security::CertPointer & cert, Ssl::CertificatePrope + // certificates with CN unrelated to subjectAltNames. + if (!properties.setCommonName) { + int pos = X509_get_ext_by_NID(properties.mimicCert.get(), NID_subject_alt_name, -1); +- X509_EXTENSION *ext=X509_get_ext(properties.mimicCert.get(), pos); ++ X509_EXTENSION *ext = const_cast(X509_get_ext(properties.mimicCert.get(), pos)); + if (ext) { + if (X509_add_ext(cert.get(), ext, -1)) + ++addedExtensions; +@@ -922,20 +931,23 @@ Ssl::WritePrivateKey(Ssl::BIO_Pointer &bio, const Security::PrivateKeyPointer &p + } + + Ssl::UniqueCString +-Ssl::OneLineSummary(X509_NAME &name) ++Ssl::OneLineSummary(const X509_NAME &name) + { + return Ssl::UniqueCString(X509_NAME_oneline(&name, nullptr, 0)); + } + + bool Ssl::sslDateIsInTheFuture(char const * date) + { +- ASN1_UTCTIME tm; +- tm.flags = 0; +- tm.type = 23; +- tm.data = (unsigned char *)date; +- tm.length = strlen(date); +- +- return (X509_cmp_current_time(&tm) > 0); ++ ASN1_UTCTIME *tm = ASN1_UTCTIME_new(); ++ if (!tm) ++ return false; ++ if (!ASN1_UTCTIME_set_string(tm, date)) { ++ ASN1_UTCTIME_free(tm); ++ return false; ++ } ++ int result = X509_cmp_current_time(tm); ++ ASN1_UTCTIME_free(tm); ++ return (result > 0); + } + + /// Print the time represented by a ASN1_TIME struct to a string using GeneralizedTime format +@@ -945,14 +957,18 @@ static bool asn1timeToGeneralizedTimeStr(ASN1_TIME *aTime, char *buf, int bufLen + // UTCTime has the form YYMMDDHHMMSS[Z | [+|-]offset] + // GeneralizedTime has the form YYYYMMDDHHMMSS[Z | [+|-] offset] + ++ const unsigned char *data = ASN1_STRING_get0_data(aTime); ++ int length = ASN1_STRING_length(aTime); ++ int type = ASN1_STRING_type(aTime); ++ + // length should have space for data plus 2 extra bytes for the two extra year fields + // plus the '\0' char. +- if ((aTime->length + 3) > bufLen) ++ if ((length + 3) > bufLen) + return false; + + char *str; +- if (aTime->type == V_ASN1_UTCTIME) { +- if (aTime->data[0] > '5') { // RFC 2459, section 4.1.2.5.1 ++ if (type == V_ASN1_UTCTIME) { ++ if (data[0] > '5') { // RFC 2459, section 4.1.2.5.1 + buf[0] = '1'; + buf[1] = '9'; + } else { +@@ -960,11 +976,11 @@ static bool asn1timeToGeneralizedTimeStr(ASN1_TIME *aTime, char *buf, int bufLen + buf[1] = '0'; + } + str = buf +2; +- } else // if (aTime->type == V_ASN1_GENERALIZEDTIME) ++ } else // if (type == V_ASN1_GENERALIZEDTIME) + str = buf; + +- memcpy(str, aTime->data, aTime->length); +- str[aTime->length] = '\0'; ++ memcpy(str, data, length); ++ str[length] = '\0'; + return true; + } + +@@ -996,8 +1012,8 @@ bool Ssl::certificateMatchesProperties(X509 *cert, CertificateProperties const & + return true; + + if (!properties.setCommonName) { +- X509_NAME *cert1_name = X509_get_subject_name(cert); +- X509_NAME *cert2_name = X509_get_subject_name(cert2); ++ const X509_NAME *cert1_name = X509_get_subject_name(cert); ++ const X509_NAME *cert2_name = X509_get_subject_name(cert2); + if (X509_NAME_cmp(cert1_name, cert2_name) != 0) + return false; + } else if (properties.commonName != CommonHostName(cert)) +diff --git a/src/ssl/gadgets.h b/src/ssl/gadgets.h +index e0c60c3..4c48759 100644 +--- a/src/ssl/gadgets.h ++++ b/src/ssl/gadgets.h +@@ -160,7 +160,7 @@ bool WriteX509Certificate(BIO_Pointer &bio, const Security::CertPointer & cert); + bool WritePrivateKey(BIO_Pointer &bio, const Security::PrivateKeyPointer &pkey); + + /// a RAII wrapper for the memory-allocating flavor of X509_NAME_oneline() +-UniqueCString OneLineSummary(X509_NAME &); ++UniqueCString OneLineSummary(const X509_NAME &); + + /** + \ingroup SslCrtdSslAPI +@@ -285,7 +285,7 @@ const char *CommonHostName(X509 *x509); + SBuf AsnToSBuf(const ASN1_STRING &); + + /// interprets X.509 Subject or Issuer name entry (at the given position) as CN +-std::optional ParseCommonNameAt(X509_NAME &, int); ++std::optional ParseCommonNameAt(const X509_NAME &, int); + + /// interprets the given buffer as either a textual representation of an IP + /// address (if possible) or a domain name without wildcard support (otherwise) +diff --git a/src/ssl/support.cc b/src/ssl/support.cc +index e787203..09f268a 100644 +--- a/src/ssl/support.cc ++++ b/src/ssl/support.cc +@@ -272,23 +272,23 @@ ParseSubjectAltName(const GENERAL_NAME &san) + + // RFC 5280 section 4.2.1.6 signals IPv4/IPv6 address family using data length + +- if (san.d.iPAddress->length == 4) { ++ if (ASN1_STRING_length(san.d.iPAddress) == 4) { + struct in_addr addr; + static_assert(sizeof(addr.s_addr) == 4); +- memcpy(&addr.s_addr, san.d.iPAddress->data, sizeof(addr.s_addr)); ++ memcpy(&addr.s_addr, ASN1_STRING_get0_data(san.d.iPAddress), sizeof(addr.s_addr)); + const Ip::Address ip(addr); + return AnyP::Host::ParseIp(ip); + } + +- if (san.d.iPAddress->length == 16) { ++ if (ASN1_STRING_length(san.d.iPAddress) == 16) { + struct in6_addr addr; + static_assert(sizeof(addr.s6_addr) == 16); +- memcpy(&addr.s6_addr, san.d.iPAddress->data, sizeof(addr.s6_addr)); ++ memcpy(&addr.s6_addr, ASN1_STRING_get0_data(san.d.iPAddress), sizeof(addr.s6_addr)); + const Ip::Address ip(addr); + return AnyP::Host::ParseIp(ip); + } + +- debugs(83, 3, "unexpected length of an IP address SAN: " << san.d.iPAddress->length); ++ debugs(83, 3, "unexpected length of an IP address SAN: " << ASN1_STRING_length(san.d.iPAddress)); + return std::nullopt; + } + +@@ -856,7 +856,7 @@ Ssl::InitClientContext(Security::ContextPointer &ctx, Security::PeerOptions &pee + + /// \ingroup ServerProtocolSSLInternal + static const char * +-ssl_get_attribute(X509_NAME * name, const char *attribute_name) ++ssl_get_attribute(const X509_NAME * name, const char *attribute_name) + { + static char buffer[1024]; + buffer[0] = '\0'; +@@ -879,7 +879,7 @@ ssl_get_attribute(X509_NAME * name, const char *attribute_name) + const char * + Ssl::GetX509UserAttribute(X509 * cert, const char *attribute_name) + { +- X509_NAME *name; ++ const X509_NAME *name; + const char *ret; + + if (!cert) +@@ -933,7 +933,7 @@ const char * + Ssl::GetX509CAAttribute(X509 * cert, const char *attribute_name) + { + +- X509_NAME *name; ++ const X509_NAME *name; + const char *ret; + + if (!cert) +@@ -1484,7 +1484,7 @@ void Ssl::InRamCertificateDbKey(const Ssl::CertificateProperties &certProperties + if (certProperties.mimicCert) { + if (auto *sig = Ssl::X509_get_signature(certProperties.mimicCert)) { + origSignatureAsKey = true; +- key.append((const char *)sig->data, sig->length); ++ key.append((const char *)ASN1_STRING_get0_data(sig), ASN1_STRING_length(sig)); + } + } + +-- +2.53.0 + diff --git a/squid.service b/squid.service index 6978032..09c68cc 100644 --- a/squid.service +++ b/squid.service @@ -8,11 +8,14 @@ Type=notify LimitNOFILE=16384 PIDFile=/run/squid.pid EnvironmentFile=/etc/sysconfig/squid -ExecStartPre=/usr/libexec/squid/cache_swap.sh -ExecStart=/usr/sbin/squid --foreground $SQUID_OPTS -f ${SQUID_CONF} -ExecReload=/usr/bin/kill -HUP $MAINPID +ExecStartPre=!/usr/libexec/squid/cache_swap.sh +ExecStart=!/usr/sbin/squid --foreground $SQUID_OPTS -f ${SQUID_CONF} +ExecReload=!/usr/bin/kill -HUP $MAINPID KillMode=mixed NotifyAccess=all +User=squid +Group=squid +RuntimeDirectory=squid [Install] WantedBy=multi-user.target diff --git a/squid.spec b/squid.spec index 8a99ea2..ec202ee 100644 --- a/squid.spec +++ b/squid.spec @@ -1,16 +1,17 @@ %define __perl_requires %{SOURCE98} +%define version_underscore %(echo %{version} | tr '.' '_') Name: squid -Version: 4.12 -Release: 3%{?dist} +Version: 7.6 +Release: 1%{?dist} Summary: The Squid proxy caching server Epoch: 7 # See CREDITS for breakdown of non GPLv2+ code -License: GPLv2+ and (LGPLv2+ and MIT and BSD and Public Domain) +License: GPL-2.0-or-later AND (LGPL-2.0-or-later AND MIT AND BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND BSD-4-Clause-UC AND LicenseRef-Fedora-Public-Domain AND Beerware) URL: http://www.squid-cache.org -Source0: http://www.squid-cache.org/Versions/v4/squid-%{version}.tar.xz -Source1: http://www.squid-cache.org/Versions/v4/squid-%{version}.tar.xz.asc +Source0: https://github.com/squid-cache/squid/releases/download/SQUID_%{version_underscore}/squid-%{version}.tar.xz +Source1: https://github.com/squid-cache/squid/releases/download/SQUID_%{version_underscore}/squid-%{version}.tar.xz.asc Source2: http://www.squid-cache.org/pgp.asc Source3: squid.logrotate Source4: squid.sysconfig @@ -18,31 +19,34 @@ Source5: squid.pam Source6: squid.nm Source7: squid.service Source8: cache_swap.sh +Source9: squid.sysusers +Source10: squid.tmpfiles Source98: perl-requires-squid.sh # Upstream patches # Backported patches +# Patch101: squid-7.1-.....patch # Local patches # Applying upstream patches first makes it less likely that local patches # will break upstream ones. -Patch201: squid-4.0.11-config.patch -Patch202: squid-3.1.0.9-location.patch -Patch203: squid-3.0.STABLE1-perlpath.patch -Patch204: squid-3.5.9-include-guards.patch -Patch205: squid-4.0.21-large-acl.patch +Patch201: squid-6.1-config.patch +Patch202: squid-6.1-location.patch +Patch203: squid-6.1-perlpath.patch +# revert this upstream patch - https://bugzilla.redhat.com/show_bug.cgi?id=1936422 +# workaround for #1934919 +Patch204: squid-6.1-symlink-lang-err.patch +Patch205: squid-7.5-openssl4.patch # cache_swap.sh Requires: bash gawk # for httpd conf file - cachemgr script alias Requires: httpd-filesystem -Requires(pre): shadow-utils -Requires(post): systemd -Requires(preun): systemd -Requires(postun): systemd + # squid_ldap_auth and other LDAP helpers require OpenLDAP +BuildRequires: make BuildRequires: openldap-devel # squid_pam_auth requires PAM development libs BuildRequires: pam-devel @@ -50,10 +54,8 @@ BuildRequires: pam-devel BuildRequires: openssl-devel # squid_kerb_aut requires Kerberos development libs BuildRequires: krb5-devel -# time_quota requires DB -BuildRequires: libdb-devel -# ESI support requires Expat & libxml2 -BuildRequires: expat-devel libxml2-devel +# time_quota requires TrivialDB +BuildRequires: libtdb-devel # TPROXY requires libcap, and also increases security somewhat BuildRequires: libcap-devel # eCAP support @@ -61,24 +63,27 @@ BuildRequires: libecap-devel #ip_user helper requires BuildRequires: gcc-c++ BuildRequires: libtool libtool-ltdl-devel +BuildRequires: libxcrypt-devel BuildRequires: perl-generators # For test suite BuildRequires: pkgconfig(cppunit) # For verifying downloded src tarball BuildRequires: gnupg2 -# for _tmpfilesdir and _unitdir macro +# for _unitdir macro # see https://docs.fedoraproject.org/en-US/packaging-guidelines/Systemd/#_packaging BuildRequires: systemd-rpm-macros # systemd notify BuildRequires: systemd-devel +%{?systemd_requires} +%{?sysusers_requires_compat} # Old NetworkManager expects the dispatcher scripts in a different place Conflicts: NetworkManager < 1.20 %description Squid is a high-performance proxy caching server for Web clients, -supporting FTP, gopher, and HTTP data objects. Unlike traditional +supporting FTP and HTTP data objects. Unlike traditional caching software, Squid handles all requests in a single, non-blocking, I/O-driven process. Squid keeps meta data and especially hot objects cached in RAM, caches DNS lookups, supports non-blocking @@ -90,18 +95,8 @@ lookup program (dnsserver), a program for retrieving FTP data %prep %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data='%{SOURCE0}' -%setup -q -# Upstream patches - -# Backported patches - -# Local patches -%patch201 -p1 -b .config -%patch202 -p1 -b .location -%patch203 -p1 -b .perlpath -%patch204 -p0 -b .include-guards -%patch205 -p1 -b .large_acl +%autosetup -p1 # https://bugzilla.redhat.com/show_bug.cgi?id=1679526 # Patch in the vendor documentation and used different location for documentation @@ -121,8 +116,8 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented --enable-eui \ --enable-follow-x-forwarded-for \ --enable-auth \ - --enable-auth-basic="DB,fake,getpwnam,LDAP,NCSA,PAM,POP3,RADIUS,SASL,SMB,SMB_LM" \ - --enable-auth-ntlm="SMB_LM,fake" \ + --enable-auth-basic="DB,fake,getpwnam,LDAP,NCSA,PAM,POP3,RADIUS,SASL,SMB" \ + --enable-auth-ntlm="fake" \ --enable-auth-digest="file,LDAP" \ --enable-auth-negotiate="kerberos" \ --enable-external-acl-helpers="LDAP_group,time_quota,session,unix_group,wbinfo_group,kerberos_ldap_group" \ @@ -144,7 +139,7 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented --enable-storeio="aufs,diskd,ufs,rock" \ --enable-diskio \ --enable-wccpv2 \ - --enable-esi \ + --disable-esi \ --enable-ecap \ --with-aio \ --with-default-user="squid" \ @@ -154,7 +149,13 @@ sed -i 's|@SYSCONFDIR@/squid.conf.documented|%{_pkgdocdir}/squid.conf.documented --disable-arch-native \ --disable-security-cert-validators \ --disable-strict-error-checking \ - --with-swapdir=%{_localstatedir}/spool/squid + --with-swapdir=%{_localstatedir}/spool/squid \ + --enable-translation + +# workaround to build squid v5 +#mkdir -p src/icmp/tests +#mkdir -p tools/squidclient/tests +#mkdir -p tools/tests %make_build @@ -195,17 +196,8 @@ install -m 644 $RPM_BUILD_ROOT/squid.httpd.tmp $RPM_BUILD_ROOT%{_sysconfdir}/htt install -m 755 %{SOURCE6} $RPM_BUILD_ROOT%{_prefix}/lib/NetworkManager/dispatcher.d/20-squid mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/log/squid mkdir -p $RPM_BUILD_ROOT%{_localstatedir}/spool/squid -mkdir -p $RPM_BUILD_ROOT/run/squid chmod 644 contrib/url-normalizer.pl contrib/user-agents.pl -# install /usr/lib/tmpfiles.d/squid.conf -mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} -cat > ${RPM_BUILD_ROOT}%{_tmpfilesdir}/squid.conf </dev/null 2>&1; then - /usr/sbin/groupadd -g 23 squid -fi - -if ! getent passwd squid >/dev/null 2>&1 ; then - /usr/sbin/useradd -g 23 -u 23 -d /var/spool/squid -r -s /sbin/nologin squid >/dev/null 2>&1 || exit 1 -fi +%sysusers_create_compat %{SOURCE9} for i in /var/log/squid /var/spool/squid ; do if [ -d $i ] ; then @@ -276,6 +264,37 @@ done exit 0 +%pretrans -p +-- temporarilly commented until https://bugzilla.redhat.com/show_bug.cgi?id=1936422 is resolved +-- +-- previously /usr/share/squid/errors/es-mx was symlink, now it is directory since squid v5 +-- see https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Replacement/ +-- Define the path to the symlink being replaced below. +-- +-- path = "/usr/share/squid/errors/es-mx" +-- st = posix.stat(path) +-- if st and st.type == "link" then +-- os.remove(path) +-- end + +-- Due to a bug #447156 +paths = {"/usr/share/squid/errors/zh-cn", "/usr/share/squid/errors/zh-tw"} +for key,path in ipairs(paths) +do + st = posix.stat(path) + if st and st.type == "directory" then + status = os.rename(path, path .. ".rpmmoved") + if not status then + suffix = 0 + while not status do + suffix = suffix + 1 + status = os.rename(path .. ".rpmmoved", path .. ".rpmmoved." .. suffix) + end + os.rename(path, path .. ".rpmmoved") + end + end +end + %post %systemd_post squid.service @@ -294,6 +313,205 @@ fi %changelog +* Tue Jul 21 2026 Luboš Uhliarik - 7:7.6-1 +- new version 7.6 + +* Fri Jul 17 2026 Fedora Release Engineering - 7:7.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Fri Jun 12 2026 Yaakov Selkowitz - 7:7.5-3 +- Rebuilt for openssl 4.0 + +* Wed May 06 2026 Pavol Žáčik - 7:7.5-2 +- Add patch to fix OpenSSL 4.0 compatibility + +* Mon Apr 27 2026 Luboš Uhliarik - 7:7.5-1 +- new version 7.5 +- Add tmpfiles.d rules for /var directories (bootc compatibility) + +* Thu Jan 22 2026 Luboš Uhliarik - 7:7.4-1 +- new version 7.4 + +* Sat Jan 17 2026 Fedora Release Engineering - 7:7.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Wed Oct 29 2025 Luboš Uhliarik - 7:7.3-1 +- new version 7.3 + +* Fri Oct 17 2025 Luboš Uhliarik - 7:7.2-1 +- new version 7.2 + +* Thu Sep 11 2025 Luboš Uhliarik - 7:7.1-3 +- Support provider keys that require NULL digest + +* Thu Aug 14 2025 Luboš Uhliarik - 7:7.1-1 +- new version 7.1 +- removed squidclient +- removed purge +- removed cachemgr.cgi +- removed basic_smb_lm_auth and ntlm_smb_lm_auth helpers + +* Fri Jul 25 2025 Fedora Release Engineering - 7:6.14-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Mon Jul 21 2025 Luboš Uhliarik - 7:6.14-1 +- new version 6.14 + +* Wed Mar 12 2025 Luboš Uhliarik - 7:6.13-2 +- Do not blame cache_peer for 4xx CONNECT responses + +* Tue Feb 04 2025 Luboš Uhliarik - 7:6.13-1 +- new version 6.13 + +* Sat Feb 01 2025 Björn Esser - 7:6.12-5 +- Add explicit BR: libxcrypt-devel + +* Sun Jan 19 2025 Fedora Release Engineering - 7:6.12-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Fri Nov 01 2024 Luboš Uhliarik - 7:6.12-3 +- better error handling in cache_swap.sh +- added RuntimeDirectory to systemd service file + +* Fri Nov 01 2024 Luboš Uhliarik - 7:6.12-2 +- Disable ESI support since ESI support has been also removed from squid 7 +- Resolves: CVE-2024-45802 squid: Denial of Service processing ESI + response content + +* Wed Oct 23 2024 Luboš Uhliarik - 7:6.12-1 +- new version 6.12 +- Fix TCP_MISS_ABORTED/100 erros when uploading + +* Fri Oct 11 2024 Luboš Uhliarik - 7:6.11-2 +- ignore SP and HTAB chars after chunk-size + +* Wed Sep 25 2024 Luboš Uhliarik - 7:6.11-1 +- new version 6.11 + +* Sat Jul 20 2024 Fedora Release Engineering - 7:6.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Mon Jul 01 2024 Luboš Uhliarik - 7:6.10-1 +- new version 6.10 +- Resolves: #2294354 - CVE-2024-37894 squid: Out-of-bounds write error may + lead to Denial of Service + +* Tue Apr 16 2024 Luboš Uhliarik - 7:6.9-1 +- Resolves: #2262715 - squid-6.9 is available + +* Sat Mar 09 2024 Luboš Uhliarik - 7:6.8-1 +- new version 6.8 + +* Mon Feb 12 2024 Luboš Uhliarik - 7:6.7-1 +- new version 6.7 +- switch to autosetup +- fix FTBFS when using gcc14 + +* Sat Jan 27 2024 Fedora Release Engineering - 7:6.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Dec 13 2023 Yaakov Selkowitz - 7:6.6-1 +- new version 6.6 + +* Tue Nov 07 2023 Luboš Uhliarik - 7:6.5-1 +- new version 6.5 + +* Tue Oct 24 2023 Luboš Uhliarik - 7:6.4-1 +- new version 6.4 + +* Thu Sep 14 2023 Luboš Uhliarik - 7:6.3-2 +- SPDX migration + +* Tue Sep 05 2023 Luboš Uhliarik - 7:6.3-1 +- new version 6.3 + +* Wed Aug 16 2023 Luboš Uhliarik - 7:6.2-1 +- new version 6.2 + +* Fri Aug 04 2023 Luboš Uhliarik - 7:6.1-3 +- Fix "!commHasHalfClosedMonitor(fd)" assertion + +* Sat Jul 22 2023 Fedora Release Engineering - 7:6.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Tue Jul 11 2023 Luboš Uhliarik - 7:6.1-1 +- new version 6.1 + +* Tue May 09 2023 Luboš Uhliarik - 7:5.9-1 +- new version 5.9 + +* Tue Feb 28 2023 Luboš Uhliarik - 7:5.8-1 +- new version 5.8 + +* Sat Jan 21 2023 Fedora Release Engineering - 7:5.7-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Dec 05 2022 Tomas Korbar - 7:5.7-3 +- Backport adding IP_BIND_ADDRESS_NO_PORT flag to outgoing connections + +* Wed Oct 12 2022 Luboš Uhliarik - 7:5.7-2 +- Provide a sysusers.d file to get user() and group() provides (#2134071) + +* Tue Sep 06 2022 Luboš Uhliarik - 7:5.7-1 +- new version 5.7 + +* Sat Jul 23 2022 Fedora Release Engineering - 7:5.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 27 2022 Luboš Uhliarik - 7:5.6-1 +- new version 5.6 + +* Wed Apr 20 2022 Luboš Uhliarik - 7:5.5-1 +- new version 5.5 +- Resolves: #2053799 - squid-5.5 is available + +* Wed Feb 09 2022 Luboš Uhliarik - 7:5.4-1 +- new version 5.4 + +* Sat Jan 22 2022 Fedora Release Engineering - 7:5.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Tue Oct 05 2021 Luboš Uhliarik - 7:5.2-1 +- new version 5.2 (#2010109) +- Resolves: #1934559 - squid: out-of-bounds read in WCCP protocol + +* Tue Sep 14 2021 Sahana Prasad - 7:5.1-2 +- Rebuilt with OpenSSL 3.0.0 + +* Thu Aug 05 2021 Luboš Uhliarik - 7:5.1-1 +- new version 5.1 + +* Fri Jul 23 2021 Fedora Release Engineering - 7:5.0.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Mon May 17 2021 Lubos Uhliarik - 7:5.0.6-1 +- new version 5.0.6 + +* Fri Apr 23 2021 Lubos Uhliarik - 7:5.0.5-4 +- Related: #1934919 - squid update attempts fail with file conflicts + +* Fri Mar 05 2021 Lubos Uhliarik - 7:5.0.5-3 +- Resolves: #1934919 - squid update attempts fail with file conflicts + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 7:5.0.5-2 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Wed Feb 10 2021 Lubos Uhliarik - 7:5.0.5-1 +- new version 5.0.5 + +* Wed Jan 27 2021 Fedora Release Engineering - 7:4.13-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Sat Oct 17 2020 Jeff Law - 7:4.13-2 +- Fix missing #includes for gcc-11 + +* Tue Aug 25 2020 Lubos Uhliarik - 7:4.13-1 +- new version 4.13 + +* Fri Aug 07 2020 Jeff law - 7:4.12-4 +- Disable LTO + * Sat Aug 01 2020 Fedora Release Engineering - 7:4.12-3 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/squid.sysusers b/squid.sysusers new file mode 100644 index 0000000..f9cc56b --- /dev/null +++ b/squid.sysusers @@ -0,0 +1,2 @@ +g squid 23 - +u squid 23 "Squid proxy user" /var/spool/squid /sbin/nologin diff --git a/squid.tmpfiles b/squid.tmpfiles new file mode 100644 index 0000000..18ce3c4 --- /dev/null +++ b/squid.tmpfiles @@ -0,0 +1,2 @@ +d /var/log/squid 0770 squid root - - +d /var/spool/squid 0750 squid squid - -