just a missing detail in the changelog

Includes fix for VSV00019

.gitignore

@@ -50,4 +50,29 @@ varnish-2.1.3.tar.gz
 /varnish-7.0.0.tgz
 /varnish-7.0.1.tgz
 /varnish-7.0.2.tgz
-/varnish-7.0.3.tgz
+/pkg-varnish-cache-3ba24a8.tar.gz
+/varnish-7.1.0.tgz
+/varnish-7.1.1.tgz
+/pkg-varnish-cache-ffc59a3.tar.gz
+/varnish-7.2.0.tgz
+/varnish-7.2.1.tgz
+/pkg-varnish-cache-7126673.tar.gz
+/varnish-7.3.0.tgz
+/pkg-varnish-cache-cfa8cb3.tar.gz
+/varnish-7.4.0.tgz
+/varnish-7.4.1.tgz
+/varnish-7.4.2.tgz
+/varnish-7.5.0.tgz
+/varnish-7.6.0.tgz
+/pkg-varnish-cache-7d90347.tar.gz
+/varnish-7.6.1.tgz
+/varnish-7.7.0.tgz
+/varnish-7.7.1.tgz
+/jemalloc-5.3.0.tar.bz2
+/varnish-7.7.3.tgz
+/varnish-8.0.0.tgz
+/pkg-varnish-cache-1f0d212.tar.gz
+/varnish-9.0.0.tar.gz
+/varnish-9.0.1.tar.gz
+/varnish-9.0.2.tar.gz
+/varnish-9.0.3.tar.gz

fix_for_VSV00010_fcf5722a.patch

@@ -1,235 +0,0 @@
-commit fcf5722af75fdbf58dd425dd68d0beaa49bab4f4
-Author: Martin Blix Grydeland <martin@varnish-software.com>
-Date:   Thu Sep 29 14:38:05 2022 +0200
-
-    Add all well-known headers to the perfect hash lookup table
-    
-    This expands the perfect hash lookup table to be able to match any entry
-    in the list of well-known headers from tbl/http_headers.h.
-    
-    Previously only the headers that had a non-zero filter flag section was
-    kept in the fast match table.
-    
-    Fixes: VSV00010
-
-diff --git a/bin/varnishd/cache/cache_http.c b/bin/varnishd/cache/cache_http.c
-index 194055c3c..827197ded 100644
---- a/bin/varnishd/cache/cache_http.c
-+++ b/bin/varnishd/cache/cache_http.c
-@@ -65,73 +65,113 @@ const char H__Reason[]	= "\010:reason:";
-  * A suitable algorithm can be found with `gperf`:
-  *
-  *	tr '" ,' '   ' < include/tbl/http_headers.h |
-- *		awk '$1 == "H(" && $4 != "0" {print$2}' |
-+ *		awk '$1 == "H(" {print $2}' |
-  *		gperf --ignore-case
-  *
-  */
- 
-+#define GPERF_MIN_WORD_LENGTH 2
-+#define GPERF_MAX_WORD_LENGTH 19
-+#define GPERF_MAX_HASH_VALUE 79
-+
- static const unsigned char http_asso_values[256] = {
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 25, 39,  0, 20,  5, 39, 39, 39, 15,  0, 39,
--	10, 39,  0, 39, 15, 10, 39, 39,  0, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 25, 39,  0, 20,  5, 39, 39, 39, 15,  0, 39,
--	10, 39,  0, 39, 15, 10, 39, 39,  0, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39,
--	39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39, 39
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80,  0, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80,  5, 80, 20,  0,  0,
-+	5, 10,  5,  5, 80,  0, 15,  0, 20, 80,
-+	40, 80,  0, 35, 10, 20, 55, 45,  0,  0,
-+	80, 80, 80, 80, 80, 80, 80,  5, 80, 20,
-+	0,  0,  5, 10,  5,  5, 80,  0, 15,  0,
-+	20, 80, 40, 80,  0, 35, 10, 20, 55, 45,
-+	0,  0, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80, 80, 80, 80, 80,
-+	80, 80, 80, 80, 80, 80
- };
- 
- static struct http_hdrflg {
- 	char		*hdr;
- 	unsigned	flag;
--} http_hdrflg[38 + 1] = {			// MAX_HASH_VALUE
--	{ NULL },
--	{ NULL },
--	{ H_TE },
--	{ H_Age },
--	{ NULL },
-+} http_hdrflg[GPERF_MAX_HASH_VALUE + 1] = {
-+	{ NULL }, { NULL }, { NULL }, { NULL },
-+	{ H_Date },
- 	{ H_Range },
- 	{ NULL },
--	{ H_Upgrade },
-+	{ H_Referer },
-+	{ H_Age },
-+	{ H_From },
-+	{ H_Keep_Alive },
-+	{ H_Retry_After },
-+	{ H_TE },
- 	{ H_If_Range },
--	{ NULL },
--	{ H_Connection },
--	{ NULL },
-+	{ H_ETag },
-+	{ H_X_Forwarded_For },
-+	{ H_Expect },
- 	{ H_Trailer },
--	{ H_If_None_Match },
--	{ NULL },
--	{ NULL },
--	{ NULL },
--	{ H_Transfer_Encoding },
--	{ H_Proxy_Authenticate },
--	{ H_Proxy_Authorization },
--	{ H_Keep_Alive },
--	{ NULL },
--	{ NULL },
- 	{ H_If_Match },
--	{ H_HTTP2_Settings },
--	{ NULL },
--	{ NULL },
--	{ NULL },
--	{ H_Content_Range },
-+	{ H_Host },
-+	{ H_Accept_Language },
-+	{ H_Accept },
-+	{ H_If_Modified_Since },
-+	{ H_If_None_Match },
- 	{ H_If_Unmodified_Since },
- 	{ NULL },
-+	{ H_Cookie },
-+	{ H_Upgrade },
-+	{ H_Last_Modified },
-+	{ H_Accept_Charset },
-+	{ H_Accept_Encoding },
-+	{ H_Content_MD5 },
-+	{ H_Content_Type },
-+	{ H_Content_Range },
-+	{ NULL }, { NULL },
-+	{ H_Content_Language },
-+	{ H_Transfer_Encoding },
-+	{ H_Authorization },
-+	{ H_Content_Length },
-+	{ H_User_Agent },
-+	{ H_Server },
-+	{ H_Expires },
-+	{ H_Location },
- 	{ NULL },
--	{ H_If_Modified_Since },
-+	{ H_Set_Cookie },
-+	{ H_Content_Encoding },
-+	{ H_Max_Forwards },
- 	{ H_Cache_Control },
- 	{ NULL },
-+	{ H_Connection },
-+	{ H_Pragma },
- 	{ NULL },
-+	{ H_Accept_Ranges },
-+	{ H_HTTP2_Settings },
-+	{ H_Allow },
-+	{ H_Content_Location },
- 	{ NULL },
-+	{ H_Proxy_Authenticate },
-+	{ H_Vary },
- 	{ NULL },
--	{ H_Accept_Ranges }
-+	{ H_WWW_Authenticate },
-+	{ H_Warning },
-+	{ H_Via },
-+	{ NULL }, { NULL }, { NULL }, { NULL },
-+	{ NULL }, { NULL }, { NULL }, { NULL },
-+	{ NULL }, { NULL }, { NULL }, { NULL },
-+	{ NULL }, { NULL }, { NULL },
-+	{ H_Proxy_Authorization }
- };
- 
- static struct http_hdrflg *
-@@ -145,12 +185,12 @@ http_hdr_flags(const char *b, const char *e)
- 	assert(b <= e);
- 	u = (unsigned)(e - b);
- 	assert(b + u == e);
--	if (u < 2 || u > 19)		// MIN_WORD_LENGTH & MAX_WORD_LENGTH
--		return(NULL);
--	if (u > 3)
--		u += http_asso_values[((const uint8_t*)b)[3]];
--	if (u > 38)			// MAX_HASH_VALUE
--		return(NULL);
-+	if (u < GPERF_MIN_WORD_LENGTH || u > GPERF_MAX_WORD_LENGTH)
-+		return (NULL);
-+	u += http_asso_values[((const uint8_t *)b)[u - 1]] +
-+	    http_asso_values[((const uint8_t *)b)[0]];
-+	if (u > GPERF_MAX_HASH_VALUE)
-+		return (NULL);
- 	retval = &http_hdrflg[u];
- 	if (retval->hdr == NULL)
- 		return(NULL);
-@@ -168,11 +208,9 @@ http_init_hdr(char *hdr, int flg)
- 
- 	hdr[0] = strlen(hdr + 1);
- 	f = http_hdr_flags(hdr + 1, hdr + hdr[0]);
--	if (flg) {
--		AN(f);
--		assert(f->hdr == hdr);
--		f->flag = flg;
--	}
-+	AN(f);
-+	assert(f->hdr == hdr);
-+	f->flag = flg;
- }
- 
- void
-diff --git a/bin/varnishtest/tests/f00010.vtc b/bin/varnishtest/tests/f00010.vtc
-new file mode 100644
-index 000000000..b381b5cf3
---- /dev/null
-+++ b/bin/varnishtest/tests/f00010.vtc
-@@ -0,0 +1,19 @@
-+varnishtest "Do not allow critical headers to be marked hop-by-hop"
-+
-+varnish v1 -vcl {
-+	backend default none;
-+} -start
-+
-+client c1 {
-+	txreq -hdr "Connection: Content-Length" -body "asdf"
-+	rxresp
-+	expect resp.status == 400
-+	expect_close
-+} -run
-+
-+client c2 {
-+	txreq -hdr "Connection: Host"
-+	rxresp
-+	expect resp.status == 400
-+	expect_close
-+} -run

fix_for_VSV00011_515a93d.patch

@@ -1,201 +0,0 @@
-commit 515a93df894430767073ccd8265497b6b25b54b5
-Author: Asad Sajjad Ahmed <asadsa@varnish-software.com>
-Date:   Fri Sep 30 14:42:53 2022 +0200
-
-    hpack: fix pseudo-headers handling
-    
-    We should apply the same restrictions on the list of allowed characters inside
-    H/2 pseudo-headers as we do for H/1. This error is translated into the
-    headers we send to a backend over H/1.
-    
-    Failure to do so could permit various exploits against a backend not handling
-    malformed H/1 requests.
-    
-    Signed-off-by: Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
-diff --git a/bin/varnishd/http2/cache_http2_hpack.c b/bin/varnishd/http2/cache_http2_hpack.c
-index 6e67b55c5..f58788b12 100644
---- a/bin/varnishd/http2/cache_http2_hpack.c
-+++ b/bin/varnishd/http2/cache_http2_hpack.c
-@@ -96,13 +96,18 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- {
- 	/* XXX: This might belong in cache/cache_http.c */
- 	const char *b0;
-+	int disallow_empty;
- 	unsigned n;
-+	char *p;
-+	int i;
- 
- 	CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC);
- 	AN(b);
- 	assert(namelen >= 2);	/* 2 chars from the ': ' that we added */
- 	assert(namelen <= len);
- 
-+	disallow_empty = 0;
-+
- 	if (len > UINT_MAX) {	/* XXX: cache_param max header size */
- 		VSLb(hp->vsl, SLT_BogoHeader, "Header too large: %.20s", b);
- 		return (H2SE_ENHANCE_YOUR_CALM);
-@@ -117,10 +122,24 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 			b += namelen;
- 			len -= namelen;
- 			n = HTTP_HDR_METHOD;
-+			disallow_empty = 1;
-+
-+			/* First field cannot contain SP or CTL */
-+			for (p = b, i = 0; i < len; p++, i++) {
-+				if (vct_issp(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
- 		} else if (!strncmp(b, ":path: ", namelen)) {
- 			b += namelen;
- 			len -= namelen;
- 			n = HTTP_HDR_URL;
-+			disallow_empty = 1;
-+
-+			/* Second field cannot contain LWS or CTL */
-+			for (p = b, i = 0; i < len; p++, i++) {
-+				if (vct_islws(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
- 		} else if (!strncmp(b, ":scheme: ", namelen)) {
- 			/* XXX: What to do about this one? (typically
- 			   "http" or "https"). For now set it as a normal
-@@ -128,6 +147,15 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 			b++;
- 			len-=1;
- 			n = hp->nhd;
-+
-+			for (p = b + namelen, i = 0; i < len-namelen;
-+			    p++, i++) {
-+				if (vct_issp(*p) || vct_isctl(*p))
-+					return (H2SE_PROTOCOL_ERROR);
-+			}
-+
-+			if (!i)
-+				return (H2SE_PROTOCOL_ERROR);
- 		} else if (!strncmp(b, ":authority: ", namelen)) {
- 			b+=6;
- 			len-=6;
-@@ -164,6 +192,13 @@ h2h_addhdr(struct http *hp, char *b, size_t namelen, size_t len)
- 	hp->hd[n].b = b;
- 	hp->hd[n].e = b + len;
- 
-+	if (disallow_empty && !Tlen(hp->hd[n])) {
-+		VSLb(hp->vsl, SLT_BogoHeader,
-+		    "Empty pseudo-header %.*s",
-+		    (int)namelen, b0);
-+		return (H2SE_PROTOCOL_ERROR);
-+	}
-+
- 	return (0);
- }
- 
-diff --git a/bin/varnishtest/tests/t02023.vtc b/bin/varnishtest/tests/t02023.vtc
-new file mode 100644
-index 000000000..cfd843da3
---- /dev/null
-+++ b/bin/varnishtest/tests/t02023.vtc
-@@ -0,0 +1,48 @@
-+varnishtest "Empty pseudo-headers"
-+
-+server s1 {
-+	rxreq
-+	txresp
-+} -start
-+
-+varnish v1 -arg "-p feature=+http2" -vcl+backend {
-+} -start
-+
-+client c1 {
-+	txreq -url ""
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	txreq -req ""
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	txreq -proto ""
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -url ""
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -scheme ""
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -req ""
-+		rxrst
-+	} -run
-+} -run
-diff --git a/bin/varnishtest/tests/t02024.vtc b/bin/varnishtest/tests/t02024.vtc
-new file mode 100644
-index 000000000..0d0a1abc5
---- /dev/null
-+++ b/bin/varnishtest/tests/t02024.vtc
-@@ -0,0 +1,48 @@
-+varnishtest "Garbage pseudo-headers"
-+
-+server s1 {
-+	rxreq
-+	txresp
-+} -start
-+
-+varnish v1 -arg "-p feature=+http2" -vcl+backend {
-+} -start
-+
-+client c1 {
-+	txreq -url " "
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	txreq -req " "
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	txreq -proto " "
-+	rxresp
-+	expect resp.status == 400
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -url " "
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -scheme " "
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -req " "
-+		rxrst
-+	} -run
-+} -run

jemalloc-5.3.0-aarch64-ts-segfault.patch

@@ -0,0 +1,140 @@
+diff --git a/test/unit/psset.c b/test/unit/psset.c
+index 6ff7201..58b4a88 100644
+--- a/test/unit/psset.c
++++ b/test/unit/psset.c
+@@ -124,7 +124,7 @@ TEST_BEGIN(test_fill) {
+ 	hpdata_t pageslab;
+ 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
+ 
+-	edata_t alloc[HUGEPAGE_PAGES];
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	psset_t psset;
+ 	psset_init(&psset);
+@@ -147,6 +147,8 @@ TEST_BEGIN(test_fill) {
+ 	edata_init_test(&extra_alloc);
+ 	err = test_psset_alloc_reuse(&psset, &extra_alloc, PAGE);
+ 	expect_true(err, "Alloc succeeded even though psset should be empty");
++	
++	free(alloc);
+ }
+ TEST_END
+ 
+@@ -157,7 +159,7 @@ TEST_BEGIN(test_reuse) {
+ 	hpdata_t pageslab;
+ 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
+ 
+-	edata_t alloc[HUGEPAGE_PAGES];
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	psset_t psset;
+ 	psset_init(&psset);
+@@ -239,6 +241,8 @@ TEST_BEGIN(test_reuse) {
+ 	err = test_psset_alloc_reuse(&psset, &alloc[index_of_4], 4 * PAGE);
+ 	expect_false(err, "Should have been able to find alloc.");
+ 	edata_expect(&alloc[index_of_4], index_of_4, 4);
++	
++	free(alloc);
+ }
+ TEST_END
+ 
+@@ -249,7 +253,7 @@ TEST_BEGIN(test_evict) {
+ 	hpdata_t pageslab;
+ 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
+ 
+-	edata_t alloc[HUGEPAGE_PAGES];
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	psset_t psset;
+ 	psset_init(&psset);
+@@ -273,6 +277,8 @@ TEST_BEGIN(test_evict) {
+ 
+ 	err = test_psset_alloc_reuse(&psset, &alloc[0], PAGE);
+ 	expect_true(err, "psset should be empty.");
++	
++	free(alloc);
+ }
+ TEST_END
+ 
+@@ -286,7 +292,9 @@ TEST_BEGIN(test_multi_pageslab) {
+ 	    (void *)((uintptr_t)PAGESLAB_ADDR + HUGEPAGE),
+ 	    PAGESLAB_AGE + 1);
+ 
+-	edata_t alloc[2][HUGEPAGE_PAGES];
++	edata_t* alloc[2];
++	alloc[0] = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
++	alloc[1] = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	psset_t psset;
+ 	psset_init(&psset);
+@@ -336,6 +344,9 @@ TEST_BEGIN(test_multi_pageslab) {
+ 	 */
+ 	err = test_psset_alloc_reuse(&psset, &alloc[1][0], 2 * PAGE);
+ 	expect_false(err, "Allocation should have succeeded");
++	
++	free(alloc[0]);
++	free(alloc[1]);
+ }
+ TEST_END
+ 
+@@ -385,7 +396,7 @@ TEST_BEGIN(test_stats) {
+ 	hpdata_t pageslab;
+ 	hpdata_init(&pageslab, PAGESLAB_ADDR, PAGESLAB_AGE);
+ 
+-	edata_t alloc[HUGEPAGE_PAGES];
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	psset_t psset;
+ 	psset_init(&psset);
+@@ -415,6 +426,8 @@ TEST_BEGIN(test_stats) {
+ 	stats_expect(&psset, 0);
+ 	psset_update_end(&psset, &pageslab);
+ 	stats_expect(&psset, 1);
++	
++	free(alloc);
+ }
+ TEST_END
+ 
+@@ -475,8 +488,8 @@ init_test_pageslabs(psset_t *psset, hpdata_t *pageslab,
+ 
+ TEST_BEGIN(test_oldest_fit) {
+ 	bool err;
+-	edata_t alloc[HUGEPAGE_PAGES];
+-	edata_t worse_alloc[HUGEPAGE_PAGES];
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
++	edata_t *worse_alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
+ 
+ 	hpdata_t pageslab;
+ 	hpdata_t worse_pageslab;
+@@ -493,14 +506,19 @@ TEST_BEGIN(test_oldest_fit) {
+ 	expect_false(err, "Nonempty psset failed page allocation");
+ 	expect_ptr_eq(&pageslab, edata_ps_get(&test_edata),
+ 	    "Allocated from the wrong pageslab");
++
++	free(alloc);
++	free(worse_alloc);
+ }
+ TEST_END
+ 
+ TEST_BEGIN(test_insert_remove) {
+ 	bool err;
+ 	hpdata_t *ps;
+-	edata_t alloc[HUGEPAGE_PAGES];
+-	edata_t worse_alloc[HUGEPAGE_PAGES];
++
++	edata_t *alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
++	edata_t *worse_alloc = (edata_t *)malloc(sizeof(edata_t) * HUGEPAGE_PAGES);
++
+ 
+ 	hpdata_t pageslab;
+ 	hpdata_t worse_pageslab;
+@@ -539,6 +557,9 @@ TEST_BEGIN(test_insert_remove) {
+ 	psset_update_begin(&psset, &worse_pageslab);
+ 	err = test_psset_alloc_reuse(&psset, &alloc[HUGEPAGE_PAGES - 1], PAGE);
+ 	expect_true(err, "psset should be empty, but an alloc succeeded");
++
++	free(alloc);
++	free(worse_alloc);
+ }
+ TEST_END
+ 

jemalloc-5.3.0_fno-builtin.patch

@@ -0,0 +1,29 @@
+commit 3de0c24859f4413bf03448249078169bb50bda0f
+Author: divanorama <divanorama@gmail.com>
+Date:   Thu Sep 29 23:35:59 2022 +0200
+
+    Disable builtin malloc in tests
+    
+    With `--with-jemalloc-prefix=` and without `-fno-builtin` or `-O1` both clang and gcc may optimize out `malloc` calls
+    whose result is unused. Comparing result to NULL also doesn't necessarily count as being used.
+    
+    This won't be a problem in most client programs as this only concerns really unused pointers, but in
+    tests it's important to actually execute allocations.
+    `-fno-builtin` should disable this optimization for both gcc and clang, and applying it only to tests code shouldn't hopefully be an issue.
+    Another alternative is to force "use" of result but that'd require more changes and may miss some other optimization-related issues.
+    
+    This should resolve https://github.com/jemalloc/jemalloc/issues/2091
+
+diff --git a/Makefile.in b/Makefile.in
+index 6809fb29..a964f07e 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -458,6 +458,8 @@ $(TESTS_OBJS): $(objroot)test/%.$(O): $(srcroot)test/%.c
+ $(TESTS_CPP_OBJS): $(objroot)test/%.$(O): $(srcroot)test/%.cpp
+ $(TESTS_OBJS): CPPFLAGS += -I$(srcroot)test/include -I$(objroot)test/include
+ $(TESTS_CPP_OBJS): CPPFLAGS += -I$(srcroot)test/include -I$(objroot)test/include
++$(TESTS_OBJS): CFLAGS += -fno-builtin
++$(TESTS_CPP_OBJS): CPPFLAGS += -fno-builtin
+ ifneq ($(IMPORTLIB),$(SO))
+ $(CPP_OBJS) $(C_SYM_OBJS) $(C_OBJS) $(C_JET_SYM_OBJS) $(C_JET_OBJS): CPPFLAGS += -DDLLEXPORT
+ endif

sources

@@ -1,2 +1,3 @@
-SHA512 (pkg-varnish-cache-d3e6a3f.tar.gz) = 01a133e10bc88e115255839de9ce394fa232b21341c1712773cf6e4633112301890cdc5155fce51afc6456324b84a7dd82a8544b7e9e598841ea1c5dccd3b4e3
-SHA512 (varnish-7.0.3.tgz) = 515d5a60120228de381af5f78cd0b712ee77430c59c8760a1a027c5f5759c8f20f3ab79f4d3785f9f4ca3b1b62b0abb59d9e0b29010a879b6f93fa65e6b6f84d
+SHA512 (varnish-9.0.3.tar.gz) = 2789cff88632c2279062a109513cc00cab7690785f8f77e90b9968098c71ddcdc6403d6a9edc755b8f4055f0d32d9e330b0bc20fbab92ba80232955942dc912a
+SHA512 (jemalloc-5.3.0.tar.bz2) = 22907bb052096e2caffb6e4e23548aecc5cc9283dce476896a2b1127eee64170e3562fa2e7db9571298814a7a2c7df6e8d1fbe152bd3f3b0c1abec22a2de34b1
+SHA512 (pkg-varnish-cache-1f0d212.tar.gz) = 9f05978c99f292e64e71ba24ef2de791a33640e40fbad66d47889837fb0d4ced203873f5a17716edf757b5ad48098289882c2df196ce1fb457f279bf7f35bec3

test_for_VSV00011_31a157cc.patch

@@ -1,68 +0,0 @@
-commit 31a157cc8470cdc44db0ca299c4c246bd54e2d1c
-Author: Asad Sajjad Ahmed <asadsa@varnish-software.com>
-Date:   Mon Oct 3 16:08:30 2022 +0200
-
-    h2: add vtc for VSV00011
-    
-    Check for correct handling of missing pseudo-headers, and invalid
-    characters.
-    
-    Signed-off-by: Asad Sajjad Ahmed <asadsa@varnish-software.com>
-
-diff --git a/bin/varnishtest/tests/f00011.vtc b/bin/varnishtest/tests/f00011.vtc
-new file mode 100644
-index 000000000..810918028
---- /dev/null
-+++ b/bin/varnishtest/tests/f00011.vtc
-@@ -0,0 +1,51 @@
-+varnishtest "H2: Malformed pseudo-headers"
-+
-+server s1 {
-+	rxreq
-+	txresp
-+} -start
-+
-+varnish v1 -arg "-p feature=+http2" -vcl+backend {
-+} -start
-+
-+client c1 {
-+	stream 1 {
-+		txreq -url ""
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -url " \t"
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -scheme ""
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -scheme " \t"
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -req ""
-+		rxrst
-+	} -run
-+} -run
-+
-+client c1 {
-+	stream 1 {
-+		txreq -req " \t"
-+		rxrst
-+	} -run
-+} -run

varnish-7.7.0_fix_4298.patch

@@ -0,0 +1,178 @@
+commit 95e41dfa584d108e444949534c7ce5801cffeacc
+Author: Poul-Henning Kamp <phk@FreeBSD.org>
+Date:   Wed Mar 26 09:25:43 2025 +0000
+
+    If the client sends NO_RFC7540_PRIORITIES, "rxprio" verbs become no-ops.
+    
+    Fixes: #4298
+    Tested by: @ingvarha
+
+
+
+commit 3a1eb57d8bd57205db7d2c766aed39cf73c4f578
+Author: Poul-Henning Kamp <phk@FreeBSD.org>
+Date:   Wed Mar 26 09:24:17 2025 +0000
+
+    Add more HTTP2 Settings to the table
+
+
+diff --git a/bin/varnishtest/vtc.h b/bin/varnishtest/vtc.h
+index 2e5d4161a..b765fe60a 100644
+--- a/bin/varnishtest/vtc.h
++++ b/bin/varnishtest/vtc.h
+@@ -148,7 +148,7 @@ struct http;
+ void cmd_stream(CMD_ARGS);
+ void start_h2(struct http *hp);
+ void stop_h2(struct http *hp);
+-void b64_settings(const struct http *hp, const char *s);
++void b64_settings(struct http *hp, const char *s);
+ 
+ /* vtc_gzip.c */
+ void vtc_gunzip(struct http *, char *, long *);
+diff --git a/bin/varnishtest/vtc_http.h b/bin/varnishtest/vtc_http.h
+index 7a86de8da..62c598a55 100644
+--- a/bin/varnishtest/vtc_http.h
++++ b/bin/varnishtest/vtc_http.h
+@@ -83,6 +83,7 @@ struct http {
+ 	/* H/2 */
+ 	unsigned		h2;
+ 	int			wf;
++	int			no_rfc7540_priorities;
+ 
+ 	pthread_t		tp;
+ 	VTAILQ_HEAD(, stream)   streams;
+diff --git a/bin/varnishtest/vtc_http2.c b/bin/varnishtest/vtc_http2.c
+index 822abbae1..7feeb42b0 100644
+--- a/bin/varnishtest/vtc_http2.c
++++ b/bin/varnishtest/vtc_http2.c
+@@ -629,7 +629,7 @@ parse_settings(const struct stream *s, struct frame *f)
+ 			buf = "unknown";
+ 		u += 4;
+ 
+-		if (t == 1) {
++		if (t == SETTINGS_HEADER_TABLE_SIZE) {
+ 			r = HPK_ResizeTbl(s->hp->encctx, v);
+ 			assert(r == hpk_done);
+ 		}
+@@ -2460,28 +2460,47 @@ cmd_rxsettings(CMD_ARGS)
+ 		hp->h2_win_peer->init = val;
+ 	}
+ }
++/* SECTION: stream.spec.prio_rxprio rxprio
++ *
++ * Receive a PRIORITY frame.
++ */
++static void
++cmd_rxprio (CMD_ARGS)
++{
++	struct stream *s;
++	(void)av;
++	CAST_OBJ_NOTNULL(s, priv, STREAM_MAGIC);
++        if (s->hp->no_rfc7540_priorities) {
++		vtc_log(vl, 4, "skipping rxprio: no_rfc7540_priorities is set");
++		return;
++	}
++	s->frame = rxstuff(s);
++	if (s->frame != NULL && s->frame->type != TYPE_PRIORITY) {
++		vtc_fatal(vl,
++		    "Wrong frame type %s (%d) wanted %s",
++		    s->frame->type < TYPE_MAX ?
++		    h2_types[s->frame->type] : "?",
++		    s->frame->type, "PRIORITY");
++	}
++}
+ 
+ #define RXFUNC(lctype, upctype) \
+ 	static void \
+-	cmd_rx ## lctype(CMD_ARGS) { \
++	cmd_rx ## lctype(CMD_ARGS) \
++	{ \
+ 		struct stream *s; \
+ 		(void)av; \
+ 		CAST_OBJ_NOTNULL(s, priv, STREAM_MAGIC); \
+ 		s->frame = rxstuff(s); \
+-		if (s->frame != NULL && s->frame->type != TYPE_ ## upctype) \
++		if (s->frame != NULL && s->frame->type != TYPE_ ## upctype) { \
+ 			vtc_fatal(vl, \
+ 			    "Wrong frame type %s (%d) wanted %s", \
+ 			    s->frame->type < TYPE_MAX ? \
+ 			    h2_types[s->frame->type] : "?", \
+ 			    s->frame->type, #upctype); \
++		} \
+ 	}
+ 
+-/* SECTION: stream.spec.prio_rxprio rxprio
+- *
+- * Receive a PRIORITY frame.
+- */
+-RXFUNC(prio,	PRIORITY)
+-
+ /* SECTION: stream.spec.reset_rxrst rxrst
+  *
+  * Receive a RST_STREAM frame.
+@@ -2857,7 +2876,7 @@ cmd_stream(CMD_ARGS)
+ }
+ 
+ void
+-b64_settings(const struct http *hp, const char *s)
++b64_settings(struct http *hp, const char *s)
+ {
+ 	uint16_t i;
+ 	uint64_t v, vv;
+@@ -2891,7 +2910,10 @@ b64_settings(const struct http *hp, const char *s)
+ 		else
+ 			buf = "unknown";
+ 
+-		if (v == 1) {
++		if (i == SETTINGS_NO_RFC7540_PRIORITIES) {
++			hp->no_rfc7540_priorities = v;
++		}
++		if (i == SETTINGS_HEADER_TABLE_SIZE) {
+ 			enum hpk_result hrs;
+ 			if (hp->sfd) {
+ 				AN(hp->encctx);
+diff --git a/include/tbl/h2_settings.h b/include/tbl/h2_settings.h
+index 2dbac671f..273f157fe 100644
+--- a/include/tbl/h2_settings.h
++++ b/include/tbl/h2_settings.h
+@@ -102,7 +102,39 @@ H2_SETTING(					// rfc7540,l,2159,2167
+ 	0xffffffff,
+ 	0
+ )
+-#endif
++
++H2_SETTING(					// rfc8441
++	ENABLE_CONNECT_PROTOCOL,
++	enable_connect_protocol,
++	0x8,
++	0,
++	0,
++	1,
++	H2CE_PROTOCOL_ERROR
++)
++
++H2_SETTING(					// rfc9218
++	NO_RFC7540_PRIORITIES,
++	no_rfc7540_priorities,
++	0x9,
++	0,
++	0,
++	1,
++	H2CE_PROTOCOL_ERROR
++)
++
++H2_SETTING(					// [MS-HTTP2E]
++						// [Gabriel_Montenegro]
++	TLS_RENEG_PERMITTED,
++	tls_reneg_permitted,
++	0x10,
++	0,
++	0,
++	3,
++	H2CE_PROTOCOL_ERROR
++)
++#endif /* !H2_SETTINGS_PARAM_ONLY */
++
+ #undef H2_SETTING
+ 
+ /*lint -restore */

varnish-9.0.1_openssl_4.0_asn1.patch

@@ -0,0 +1,38 @@
+Author: Ingvar Hagelund <ingvar@redpill-linpro.com>
+Date:   Wed Apr 15 00:17:59 2026 +0200
+
+    Use ASN1_STRING functions for openssl-4.0.0
+
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-15 00:34:44.788211992 +0200
+@@ -142,10 +142,10 @@
+ 	char *a;
+ 	int n, i, l, o;
+ 
+-	if (d->type != V_ASN1_GENERALIZEDTIME)
++	if (ASN1_STRING_type(d) != V_ASN1_GENERALIZEDTIME)
+ 		return (0);
+-	l = d->length;
+-	a = (char *)d->data;
++	l = ASN1_STRING_length(d);
++	a = (char *)ASN1_STRING_get0_data(d);
+ 	o = 0;
+ 	/*
+ 	 * GENERALIZEDTIME is similar to UTCTIME except the year is represented
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-15 00:35:53.447792774 +0200
+@@ -1060,10 +1060,10 @@
+ 
+ 			break;
+ 		case GEN_IPADD:
+-			p = n->d.ip->data;
++			p = ASN1_STRING_get0_data(n->d.ip);
+ 			AN(p);
+ 
+-			if (inet_ntop(n->d.ip->length == 16 ? AF_INET6 : AF_INET,
++			if (inet_ntop(ASN1_STRING_length(n->d.ip) == 16 ? AF_INET6 : AF_INET,
+ 			    p, b, INET6_ADDRSTRLEN) == 0)
+ 				continue;
+ 

varnish.spec

@@ -2,94 +2,125 @@
 # https://github.com/varnishcache/varnish-cache/issues/2269
 %global debug_package %{nil}
 
-%if 0%{?rhel} == 7
-%global _use_internal_dependency_generator 0
-%global __find_provides %{_builddir}/%{name}-%{version}/find-provides %__find_provides
-%global __python /usr/bin/python3.4
-%else
-%global __python %{__python3}
-%endif
-
 %global __provides_exclude_from ^%{_libdir}/varnish/vmods
 
-%global abi 6a4c6a5c7e66a664b140278c209f0b18c544cab8
-%global vrt 14.0
+%global abi 0a625649cd40af4b6c10be5e58a2e89a5e275baa
+%global vrt 23.1
 
 # Package scripts are now external
 # https://github.com/varnishcache/pkg-varnish-cache
-%global commit1 d3e6a3fad7d4c2ac781ada92dcc246e7eef9d129
+%global commit1 1f0d212dc45065f38bd80ac57fe22773a20a0595
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
+# Default: Use jemalloc, as adviced by upstream project
+# Change to 1 to use system allocator (ie. glibc)
+#
+# for rhel >= 10, use bundled jemalloc
+# for rhel < 10, use system allocator
+%bcond system_allocator %[0%{?rhel} && 0%{?rhel} < 10]
+%bcond bundled_jemalloc %[0%{?rhel} >= 10]
+
+%define jemalloc_version 5.3.0
+%define jemalloc_prefix varnish_
+
+%if %{with system_allocator}
+# use _lto_cflags if present
+%else
+%global _lto_cflags %{nil}
+%endif
+
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 7.0.3
-Release: 2%{?dist}
-License: BSD
+Version: 9.0.3
+Release: 3%{?dist}
+License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
-Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
+Source0: https://github.com/varnish/varnish/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
+Source2: varnish.sysusers
+Source3: https://github.com/jemalloc/jemalloc/releases/download/%{jemalloc_version}/jemalloc-%{jemalloc_version}.tar.bz2
+Source4: varnish.tmpfiles
 
-# Patches:
+# Compatibility with openssl-4.0.0
+# https://github.com/varnish/varnish/issues/32
+Patch1:   varnish-9.0.1_openssl_4.0_asn1.patch
 
-# Upstream fix for VSV00010 aka CVE-2022-45059
-Patch19: fix_for_VSV00010_fcf5722a.patch
+%if %{with bundled_jemalloc}
+# bundled jemalloc patch
+Patch100: jemalloc-5.3.0_fno-builtin.patch
+Patch101: jemalloc-5.3.0-aarch64-ts-segfault.patch
+%endif
 
-# Upstream fixes for VSV00011 aka CVE-2022-45060
-Patch20: fix_for_VSV00011_515a93d.patch
-Patch21: test_for_VSV00011_31a157cc.patch
-
-%if 0%{?fedora} > 29
 Provides: varnish%{_isa} = %{version}-%{release}
 Provides: varnishd(abi)%{_isa} = %{abi}
 Provides: varnishd(vrt)%{_isa} = %{vrt}
 
 Provides: vmod(blob)%{_isa} = %{version}-%{release}
+Provides: vmod(cookie)%{_isa} = %{version}-%{release}
+Provides: vmod(debug)%{_isa} = %{version}-%{release}
 Provides: vmod(directors)%{_isa} = %{version}-%{release}
+Provides: vmod(h2)%{_isa} = %{version}-%{release}
 Provides: vmod(proxy)%{_isa} = %{version}-%{release}
 Provides: vmod(purge)%{_isa} = %{version}-%{release}
 Provides: vmod(std)%{_isa} = %{version}-%{release}
 Provides: vmod(unix)%{_isa} = %{version}-%{release}
 Provides: vmod(vtc)%{_isa} = %{version}-%{release}
-Provides: vmod(purge)%{_isa} = %{version}-%{release}
+
+%if %{with bundled_jemalloc}
+Provides: bundled(jemalloc)
 %endif
 
+BuildRequires: systemd-rpm-macros
+%{?systemd_requires}
+%{?sysusers_requires_compat}
 
-%if 0%{?rhel} == 7
-BuildRequires: python34 python34-sphinx python34-docutils
-%else
 BuildRequires: python3, python3-sphinx, python3-docutils
-%endif
+BuildRequires: gcc
+%if %{without bundled_jemalloc}
+%if %{with system_allocator}
+# use glibc
+%else
+%ifnarch aarch64
 BuildRequires: jemalloc-devel
+%endif
+%endif
+%endif
+
 BuildRequires: libedit-devel
+BuildRequires: make
 BuildRequires: ncurses-devel
 BuildRequires: pcre2-devel
 BuildRequires: pkgconfig
-BuildRequires: gcc
-BuildRequires: make
+BuildRequires: openssl-devel
 
-# Extra requirements for the build suite
-BuildRequires: nghttp2
-
-# haproxy is broken in rawhide now
-%if 0%{?rhel} >= 8
-BuildRequires: haproxy
+%if %{with bundled_jemalloc}
+BuildRequires:  /usr/bin/xsltproc
+BuildRequires:  perl-generators
 %endif
 
+# Extra requirements for the build suite
+#   needs haproxy2
+%if 0%{?fedora} > 30
+BuildRequires: haproxy
+%endif
+BuildRequires: nghttp2
+
+# Varnish actually needs gcc installed to work. It uses the C compiler
+# at runtime to compile the VCL configuration files. This is by design.
+Requires: gcc
 Requires: logrotate
 Requires: ncurses
 Requires: pcre2
-Requires: jemalloc
 Requires: redhat-rpm-config
-Requires(pre): shadow-utils
 Requires(post): /usr/bin/uuidgen
-# Varnish actually needs gcc installed to work. It uses the C compiler 
-# at runtime to compile the VCL configuration files. This is by design.
-Requires: gcc
-Requires(post): systemd-units
-Requires(post): systemd-sysv
-Requires(preun): systemd-units
-Requires(postun): systemd-units
-BuildRequires: systemd-units
+
+%if %{with system_allocator}
+# use glibc
+%else
+%if %{without bundled_jemalloc}
+Requires: jemalloc
+%endif
+%endif
 
 %description
 This is Varnish Cache, a high-performance HTTP accelerator.
@@ -108,13 +139,12 @@ Summary: Development files for %{name}
 Provides: varnish-libs-devel%{?isa} = %{version}-%{release}
 Provides: varnish-libs-devel = %{version}-%{release}
 Obsoletes: varnish-libs-devel < %{version}-%{release}
+Requires: %{name} = %{version}-%{release}
+Requires: python3
 
 %description devel
 Development files for %{name}
 Varnish Cache is a high-performance HTTP accelerator
-Requires: %{name} = %{version}-%{release}
-
-Requires: python3
 
 %package docs
 Summary: Documentation files for %name
@@ -124,27 +154,93 @@ Documentation files for %name
 
 %prep
 %setup -q
+%if 0%{?fedora} > 44 || 0%{?rhel} > 10
+%patch 1 -p1
+%endif
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
 cp redhat/find-provides .
 sed -i 's,rst2man-3.6,rst2man-3.4,g; s,rst2html-3.6,rst2html-3.4,g; s,phinx-build-3.6,phinx-build-3.4,g' configure
-%patch19 -p1
-%patch20 -p1
-%patch21 -p1
+
+# jemalloc
+%if %{with bundled_jemalloc}
+tar xjf %SOURCE3
+sed -i '/^LIBPREFIX/s/@libprefix@/@libprefix@%{jemalloc_prefix}/' jemalloc*/Makefile.in
+pushd jemalloc*
+%patch 100 -p1 -b .jemalloc
+%patch 101 -p1 -b .ts-segfault
+popd
+
+# Override PAGESIZE, bz #1545539
+%ifarch %ix86 %arm x86_64 s390x riscv64
+%define lg_page --with-lg-page=12
+%endif
+
+%ifarch ppc64 ppc64le aarch64
+%define lg_page --with-lg-page=16
+%endif
+
+# Disable thp on systems not supporting this for now
+%ifarch %ix86 %arm aarch64 s390x
+%define disable_thp --disable-thp
+%endif
+%endif
 
 %build
+%if %{with bundled_jemalloc}
+# build bundled jemalloc first
+pushd jemalloc*
+
+echo "For debugging package builders"
+echo "What is the pagesize?"
+getconf PAGESIZE
+
+echo "What mm features are available?"
+ls /sys/kernel/mm
+ls /sys/kernel/mm/transparent_hugepage || true
+cat /sys/kernel/mm/transparent_hugepage/enabled || true
+
+echo "What kernel version and config is this?"
+uname -a
+
+%configure %{?disable_thp} %{?lg_page} --enable-prof
+make %{?_smp_mflags}
+popd
+%endif
+
+
+# varnish
+%if %{with system_allocator}
+export CFLAGS="%{optflags}"
+%else
+# nilled _lto_cflags above because they remove the deps on jemalloc.
+# On the fedoras, _lto_cflags is -flto=auto and -ffat-lto-objects. The latter is OK.
+export CFLAGS="%{optflags} -ffat-lto-objects"
+%endif
+
 # https://gcc.gnu.org/wiki/FAQ#PR323
 %ifarch %ix86
 %if 0%{?fedora} > 21
-export CFLAGS="%{optflags} -ffloat-store -fexcess-precision=standard"
+export CFLAGS="$CFLAGS -ffloat-store -fexcess-precision=standard"
 %endif
 %endif
 
-%ifarch s390x
-export CFLAGS="%{optflags} -Wno-error=free-nonheap-object"
+%if 0%{?fedora} > 41 || 0%{?rhel} > 10
+export CFLAGS="$CFLAGS -std=gnu17"
 %endif
 
+%if 0%{?fedora} > 42 || 0%{?rhel} > 10
+export CFLAGS="$CFLAGS -Wno-error=discarded-qualifiers"
+%endif
+
+%ifarch s390x
+export CFLAGS="$CFLAGS -Wno-error=free-nonheap-object"
+%endif
+
+# What platform is this
+uname -a
+
 # What gcc version is this?
 gcc --version
 
@@ -154,13 +250,33 @@ getconf PAGESIZE
 # Man pages are prebuilt. No need to regenerate them.
 export RST2MAN=/bin/true
 # Explicit python, please
-export PYTHON=%{__python}
+export PYTHON=python3
+
+for f in configure configure.ac; do
+  sed -i 's|ljemalloc|l%{jemalloc_prefix}jemalloc|g' $f
+done
+
+%if %{with bundled_jemalloc}
+export LDFLAGS="$LDFLAGS -L%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib"
+%endif
 
 %configure LT_SYS_LIBRARY_PATH=%_libdir \
  --disable-static \
   --localstatedir=/var/lib  \
+  --with-contrib \
   --docdir=%{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}} \
-#  --disable-pcre-jit \
+%ifarch %ix86
+%if 0%{?fedora} <= 37
+  --enable-pcre2-jit=no \
+%endif
+%endif
+%if %{with system_allocator} || %{without bundled_jemalloc}
+  --with-jemalloc=no \
+%endif
+
+%if %{with bundled_jemalloc}
+export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
+%endif
 
 %make_build
 
@@ -171,23 +287,55 @@ sed -i 's,User=varnishlog,User=varnish,g;' redhat/varnishncsa.service
 rm -rf doc/html/_sources
 
 %check
-
-# Remove these for now. Hard to get the size and timing right
-%ifarch s390 s390x aarch64
-rm bin/varnishtest/tests/o00005.vtc
-%endif
-%ifarch armv7hl
-rm bin/varnishtest/tests/b00046.vtc
+# check jemalloc first
+%if %{with bundled_jemalloc}
+pushd jemalloc*
+make %{?_smp_mflags} check
+popd
 %endif
 
+# Up the stack size in tests, necessary on secondary arches
+sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/vinyltest/tests/*.vtc
+sed -i 's/file,2M/file,8M/' bin/vinyltest/tests/r04036.vtc
+%ifarch %ix86
+sed -i 's/param.set workspace_thread 0.55k/param.set workspace_thread 0.5k/' bin/vinyltest/tests/b00081.vtc
+%endif
+
+# This is a bug in varnishtest making it incompatible with nghttp2 >= 1.65
+#if 0#{?fedora} > 41 || 0#{?rhel} > 10
+#rm bin/varnishtest/tests/a02022.vtc
+#endif
+
+%if %{with bundled_jemalloc}
+export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
+%endif
+
+# This runs fine in the emulator, but not on Red Hat's builders
+# Upstream is looking at it, upstream issue #36
+%ifarch s390x
+rm bin/vinyltest/tests/t02033.vtc
+%endif
+
+# Just a hack to avoid too high load on secondary arch builders
+%ifarch s390x ppc64le %ix86
+make check
+%else
 %make_build check
+%endif
 
 %install
 rm -rf %{buildroot}
 
-# mock el7 defaults to LANG=C, which makes python3 fail when parsing utf8 text
-%if 0%{?rhel} == 7
-export LANG=en_US.UTF-8
+# jemalloc
+%if %{with bundled_jemalloc}
+pushd jemalloc*
+make DESTDIR=%{buildroot} install_lib %{?_smp_mflags}
+
+find %{buildroot}%{_libdir}/ -name '*.a' -exec rm -vf {} ';'
+
+# we don't need .pc file
+rm  %{buildroot}%{_libdir}/pkgconfig/jemalloc.pc
+popd
 %endif
 
 %{make_install}
@@ -208,8 +356,13 @@ mkdir -p %{buildroot}%{_unitdir}
 install -D -m 0644 redhat/varnish.service %{buildroot}%{_unitdir}/varnish.service
 install -D -m 0644 redhat/varnishncsa.service %{buildroot}%{_unitdir}/varnishncsa.service
 install -D -m 0755 redhat/varnishreload %{buildroot}%{_sbindir}/varnishreload
+install -p -D -m 0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/varnish.conf
 
-echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf
+# tmpfiles.d configuration
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 -p %{SOURCE4} %{buildroot}%{_tmpfilesdir}/varnish.conf
+
+echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 # No idea why these ends up with mode 600 in the debug package
 %if 0%{debug_package}
@@ -217,31 +370,37 @@ chmod 644 lib/libvmod_*/*.c
 chmod 644 lib/libvmod_*/*.h
 %endif
 
+%pre
+%sysusers_create_compat %{SOURCE2}
+
 %files
+%if "%{_sbindir}" != "%{_bindir}"
 %{_sbindir}/*
+%endif
 %{_bindir}/*
 %{_libdir}/*.so.*
-%{_libdir}/varnish
+%{_libdir}/%{name}
 %{_var}/lib/varnish
 %attr(0700,varnish,varnish) %dir %{_var}/log/varnish
 %{_mandir}/man1/*.1*
 %{_mandir}/man3/*.3*
 %{_mandir}/man7/*.7*
 %license LICENSE
-%doc README.rst ChangeLog
+%doc README.md ChangeLog
 %doc etc/builtin.vcl etc/example.vcl
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
 %config(noreplace) %{_sysconfdir}/logrotate.d/varnish
-%config %{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf
-
+%config %{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 %{_unitdir}/varnish.service
 %{_unitdir}/varnishncsa.service
+%{_sysusersdir}/varnish.conf
+%{_tmpfilesdir}/varnish.conf
 
 %files devel
 %license LICENSE
-%doc README.rst
+%doc README.md
 %{_libdir}/lib*.so
 %{_includedir}/%{name}
 %{_libdir}/pkgconfig/varnishapi.pc
@@ -253,15 +412,6 @@ chmod 644 lib/libvmod_*/*.h
 %doc doc/html
 %doc doc/changes*.html
 
-
-%pre
-getent group varnish >/dev/null || groupadd -r varnish
-getent passwd varnish >/dev/null || \
-       useradd -r -g varnish -d /var/lib/varnish -s /sbin/nologin \
-               -c "Varnish Cache" varnish
-exit 0
-
-
 %post
 %systemd_post varnish varnishncsa
 /sbin/ldconfig
@@ -277,15 +427,144 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
-* Mon Nov 14 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.3-2
-- Picked upstream patches from 7.1 branch
-- Fixes CVE-2022-45059 aka VSV00010, rhbz#2141842
-- Fixes CVE-2022-45060 aka VSV00011, rhbz#2141847
-- Removed references to patches no longer needed
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 
-* Fri Aug 12 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.3-1
+* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 9.0.3-2
+- Rebuilt for openssl 4.0
+
+* Thu May 21 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.3-1
+- New upstream release: A security relase
+- Includes fix for VSV00019 aka CVE-2026-50052
+
+* Fri May 15 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.2-1
+- New upstream release: A bugfix release
+
+* Fri Apr 10 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.1-1
+- New upstream release
+- Add patch for openssl-4.0.0 in rawhide
+- Includes fix for VEV00002
+
+* Fri Mar 27 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.0-1
+- New upstream release
+- Includes fix for VSV00018
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 8.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Thu Dec 11 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 8.0.0-1
+- New upstream release
+- New pkg-varnish-cache checkout
+- Added cflag -Wno-error=discarded-qualifiers to build on fedora while waiting for upstream
+
+* Wed Oct 29 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.3-2
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
+
+* Mon Sep 15 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.3-1
+- New upstream release: A security release
+- Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
+
+* Thu Jul 31 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-4
+- bundle jemalloc in RHEL
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.7.1-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Thu May 22 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.1-2
+- Correct ABI and VRT versions
+- Pulled el7 support
+- Use systemd setup for users
+
+* Tue May 20 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-1
+- new version 7.7.1
+
+* Thu Mar 27 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-2
+- Fix for eln build (merged from yselkowitz)
+- Fix for failing h2 switch check. Enabling full test suite again
+
+* Mon Mar 24 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.0-1
+- New upstream release
+- fedora now has completed the bin/sbin merge
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.6.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Dec 02 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.1-1
+- New upstream release
+
+* Mon Sep 16 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.6.0-1
+- New upstream release
+- Updated checkout of pkg-varnish
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.5.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Tue Mar 19 2024 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.5.0-1
+- New upstream release
+- Moved somethings around to make the diff from the upstream spec less
+- Upped some memory requirements in some of the tests. Necessary on aarch64 and ppc64le (and ppc32)
+- Reduced number of parallel jobs on s390x builders as builds tend to fail when stressed
+- Retired armv7hl
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 7.4.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Nov 08 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
 - New upstream release. A security release
-- Includes fix for CVE-2022-38150 aka VSV00009, rhbz#2117692
+- Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack
+
+* Thu Oct 12 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.1-1
+- New upstream release. A bugfix release
+
+* Wed Oct 11 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.0-0
+- New upstream release
+
+* Thu Sep 14 2023 Luboš Uhliarik <luhliari@redhat.com> - 7.3.0-5
+- SPDX migration
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.3.0-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Fri Jun 23 2023 Yaakov Selkowitz <yselkowi@redhat.com> - 7.3.0-3
+- Enable system_allocator in RHEL/ELN builds
+
+* Mon Mar 20 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.3.0-2
+- Switched from bcond to bcond_with for compatibility with el8 and el9
+- haproxy builddep on systems with haproxy2
+- Disable pcre2-jit only for fedora <= 37 on 32bit x86
+
+* Thu Mar 16 2023 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.3.0-1
+- New upstream release
+- Added a bcond system_allocator for skipping jemalloc, bz#1917697
+- nil _lto_cflags macro to link to jemalloc again
+- disable pcre2-jit on 32bit x86 for now
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 7.2.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Wed Nov 09 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.2.1-1
+- New upstream release: A security release
+- Includes fix for VSV00011
+
+* Fri Sep 16 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.2.0-1
+- New upstream release. The regular bi-annual "fresh" release
+- Removed list of patches from comments
+- Cosmetical changes to specfile from upstream
+- Now build with --with-contrib
+
+* Fri Aug 12 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.1.1-1
+- New upstream release. A security release
+- Includes fix for VSV00009 aka CVE-2022-38150
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 7.1.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Tue Mar 29 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.1.0-1
+- New upstream release
+- Includes updated snapshot of pkg-varnish
+
+* Mon Feb 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 7.0.2-2
+- Fix Provides directive for varnish-devel package
 
 * Wed Jan 26 2022 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.0.2-1
 - New upstream release. A security release

varnish.sysusers

@@ -0,0 +1,3 @@
+#Type Name     ID             GECOS                 Home directory Shell
+g varnish -
+u varnish - "Varnish Cache" /var/lib/varnish /sbin/nologin

varnish.tmpfiles

@@ -0,0 +1,2 @@
+d /var/lib/varnish  755 root root -
+d /var/log/varnish  700 varnish varnish -