just a missing detail in the changelog

Includes fix for VSV00019

.gitignore

@@ -69,3 +69,10 @@ varnish-2.1.3.tar.gz
 /varnish-7.7.0.tgz
 /varnish-7.7.1.tgz
 /jemalloc-5.3.0.tar.bz2
+/varnish-7.7.3.tgz
+/varnish-8.0.0.tgz
+/pkg-varnish-cache-1f0d212.tar.gz
+/varnish-9.0.0.tar.gz
+/varnish-9.0.1.tar.gz
+/varnish-9.0.2.tar.gz
+/varnish-9.0.3.tar.gz

sources

@@ -1,3 +1,3 @@
-SHA512 (varnish-7.7.1.tgz) = 4a15ff23dc07cb19959031be5070e7da46a2be2d1a1d2e3950966ca593849d3f8be4f41bd35dae75876bbc121bf268345b47aa35764645362aa42b822b634ad9
-SHA512 (pkg-varnish-cache-7d90347.tar.gz) = c5bf026bb50b416001d0e22e56c2774c143dab1f4658f03f1a4e6578369b71cfda5854b7d6b580c43c2ab8e68bfb9033b56734adfd29ac0fddc61fd6b1b4b0c0
+SHA512 (varnish-9.0.3.tar.gz) = 2789cff88632c2279062a109513cc00cab7690785f8f77e90b9968098c71ddcdc6403d6a9edc755b8f4055f0d32d9e330b0bc20fbab92ba80232955942dc912a
 SHA512 (jemalloc-5.3.0.tar.bz2) = 22907bb052096e2caffb6e4e23548aecc5cc9283dce476896a2b1127eee64170e3562fa2e7db9571298814a7a2c7df6e8d1fbe152bd3f3b0c1abec22a2de34b1
+SHA512 (pkg-varnish-cache-1f0d212.tar.gz) = 9f05978c99f292e64e71ba24ef2de791a33640e40fbad66d47889837fb0d4ced203873f5a17716edf757b5ad48098289882c2df196ce1fb457f279bf7f35bec3

varnish-9.0.1_openssl_4.0_asn1.patch

@@ -0,0 +1,38 @@
+Author: Ingvar Hagelund <ingvar@redpill-linpro.com>
+Date:   Wed Apr 15 00:17:59 2026 +0200
+
+    Use ASN1_STRING functions for openssl-4.0.0
+
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-15 00:34:44.788211992 +0200
+@@ -142,10 +142,10 @@
+ 	char *a;
+ 	int n, i, l, o;
+ 
+-	if (d->type != V_ASN1_GENERALIZEDTIME)
++	if (ASN1_STRING_type(d) != V_ASN1_GENERALIZEDTIME)
+ 		return (0);
+-	l = d->length;
+-	a = (char *)d->data;
++	l = ASN1_STRING_length(d);
++	a = (char *)ASN1_STRING_get0_data(d);
+ 	o = 0;
+ 	/*
+ 	 * GENERALIZEDTIME is similar to UTCTIME except the year is represented
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-15 00:35:53.447792774 +0200
+@@ -1060,10 +1060,10 @@
+ 
+ 			break;
+ 		case GEN_IPADD:
+-			p = n->d.ip->data;
++			p = ASN1_STRING_get0_data(n->d.ip);
+ 			AN(p);
+ 
+-			if (inet_ntop(n->d.ip->length == 16 ? AF_INET6 : AF_INET,
++			if (inet_ntop(ASN1_STRING_length(n->d.ip) == 16 ? AF_INET6 : AF_INET,
+ 			    p, b, INET6_ADDRSTRLEN) == 0)
+ 				continue;
+ 

varnish.spec

@@ -4,12 +4,12 @@
 
 %global __provides_exclude_from ^%{_libdir}/varnish/vmods
 
-%global abi 2e8180f788715e5bc44df08479d60c9435d79bdd
-%global vrt 21.0
+%global abi 0a625649cd40af4b6c10be5e58a2e89a5e275baa
+%global vrt 23.1
 
 # Package scripts are now external
 # https://github.com/varnishcache/pkg-varnish-cache
-%global commit1 7d90347be31891b338dededb318594cebb668ba7
+%global commit1 1f0d212dc45065f38bd80ac57fe22773a20a0595
 %global shortcommit1 %(c=%{commit1}; echo ${c:0:7})
 
 # Default: Use jemalloc, as adviced by upstream project
@@ -31,18 +31,19 @@
 
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 7.7.1
-Release: 4%{?dist}
+Version: 9.0.3
+Release: 3%{?dist}
 License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
-Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
+Source0: https://github.com/varnish/varnish/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
 Source2: varnish.sysusers
 Source3: https://github.com/jemalloc/jemalloc/releases/download/%{jemalloc_version}/jemalloc-%{jemalloc_version}.tar.bz2
+Source4: varnish.tmpfiles
 
-# Fix for h2 switch in varnishtest
-# https://github.com/varnishcache/varnish-cache/issues/4298
-Patch0:   varnish-7.7.0_fix_4298.patch
+# Compatibility with openssl-4.0.0
+# https://github.com/varnish/varnish/issues/32
+Patch1:   varnish-9.0.1_openssl_4.0_asn1.patch
 
 %if %{with bundled_jemalloc}
 # bundled jemalloc patch
@@ -90,6 +91,7 @@ BuildRequires: make
 BuildRequires: ncurses-devel
 BuildRequires: pcre2-devel
 BuildRequires: pkgconfig
+BuildRequires: openssl-devel
 
 %if %{with bundled_jemalloc}
 BuildRequires:  /usr/bin/xsltproc
@@ -98,7 +100,7 @@ BuildRequires:  perl-generators
 
 # Extra requirements for the build suite
 #   needs haproxy2
-%if 0%{?fedora} > 30 || 0%{?rhel} > 8
+%if 0%{?fedora} > 30
 BuildRequires: haproxy
 %endif
 BuildRequires: nghttp2
@@ -152,7 +154,9 @@ Documentation files for %name
 
 %prep
 %setup -q
-%patch 0 -p1
+%if 0%{?fedora} > 44 || 0%{?rhel} > 10
+%patch 1 -p1
+%endif
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
@@ -226,6 +230,10 @@ export CFLAGS="$CFLAGS -ffloat-store -fexcess-precision=standard"
 export CFLAGS="$CFLAGS -std=gnu17"
 %endif
 
+%if 0%{?fedora} > 42 || 0%{?rhel} > 10
+export CFLAGS="$CFLAGS -Wno-error=discarded-qualifiers"
+%endif
+
 %ifarch s390x
 export CFLAGS="$CFLAGS -Wno-error=free-nonheap-object"
 %endif
@@ -287,8 +295,11 @@ popd
 %endif
 
 # Up the stack size in tests, necessary on secondary arches
-sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/varnishtest/tests/*.vtc
-sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
+sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/vinyltest/tests/*.vtc
+sed -i 's/file,2M/file,8M/' bin/vinyltest/tests/r04036.vtc
+%ifarch %ix86
+sed -i 's/param.set workspace_thread 0.55k/param.set workspace_thread 0.5k/' bin/vinyltest/tests/b00081.vtc
+%endif
 
 # This is a bug in varnishtest making it incompatible with nghttp2 >= 1.65
 #if 0#{?fedora} > 41 || 0#{?rhel} > 10
@@ -299,11 +310,15 @@ sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
 export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
 %endif
 
+# This runs fine in the emulator, but not on Red Hat's builders
+# Upstream is looking at it, upstream issue #36
+%ifarch s390x
+rm bin/vinyltest/tests/t02033.vtc
+%endif
+
 # Just a hack to avoid too high load on secondary arch builders
-%ifarch s390x ppc64le
-# This works when ran alone, but not in the whole suite. Load and/or timing issues
-rm bin/varnishtest/tests/t02014.vtc
-make -j2 check
+%ifarch s390x ppc64le %ix86
+make check
 %else
 %make_build check
 %endif
@@ -343,6 +358,10 @@ install -D -m 0644 redhat/varnishncsa.service %{buildroot}%{_unitdir}/varnishncs
 install -D -m 0755 redhat/varnishreload %{buildroot}%{_sbindir}/varnishreload
 install -p -D -m 0644 %{SOURCE2} %{buildroot}%{_sysusersdir}/varnish.conf
 
+# tmpfiles.d configuration
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 644 -p %{SOURCE4} %{buildroot}%{_tmpfilesdir}/varnish.conf
+
 echo %{_libdir}/varnish > %{buildroot}%{_sysconfdir}/ld.so.conf.d/%{name}-%{_arch}.conf
 
 # No idea why these ends up with mode 600 in the debug package
@@ -367,7 +386,7 @@ chmod 644 lib/libvmod_*/*.h
 %{_mandir}/man3/*.3*
 %{_mandir}/man7/*.7*
 %license LICENSE
-%doc README.rst ChangeLog
+%doc README.md ChangeLog
 %doc etc/builtin.vcl etc/example.vcl
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
@@ -377,10 +396,11 @@ chmod 644 lib/libvmod_*/*.h
 %{_unitdir}/varnish.service
 %{_unitdir}/varnishncsa.service
 %{_sysusersdir}/varnish.conf
+%{_tmpfilesdir}/varnish.conf
 
 %files devel
 %license LICENSE
-%doc README.rst
+%doc README.md
 %{_libdir}/lib*.so
 %{_includedir}/%{name}
 %{_libdir}/pkgconfig/varnishapi.pc
@@ -407,7 +427,44 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
-* Fri Jun 31 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-4
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 9.0.3-2
+- Rebuilt for openssl 4.0
+
+* Thu May 21 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.3-1
+- New upstream release: A security relase
+- Includes fix for VSV00019 aka CVE-2026-50052
+
+* Fri May 15 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.2-1
+- New upstream release: A bugfix release
+
+* Fri Apr 10 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.1-1
+- New upstream release
+- Add patch for openssl-4.0.0 in rawhide
+- Includes fix for VEV00002
+
+* Fri Mar 27 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.0-1
+- New upstream release
+- Includes fix for VSV00018
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 8.0.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Thu Dec 11 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 8.0.0-1
+- New upstream release
+- New pkg-varnish-cache checkout
+- Added cflag -Wno-error=discarded-qualifiers to build on fedora while waiting for upstream
+
+* Wed Oct 29 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.3-2
+- Add tmpfiles.d rules for /var directories (bootc compatibility)
+
+* Mon Sep 15 2025 Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.7.3-1
+- New upstream release: A security release
+- Includes fix for VSV00017 aka CVE-2025-8671, rhbz#2388222
+
+* Thu Jul 31 2025 Luboš Uhliarik <luhliari@redhat.com> - 7.7.1-4
 - bundle jemalloc in RHEL
 
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 7.7.1-3

varnish.tmpfiles

@@ -0,0 +1,2 @@
+d /var/lib/varnish  755 root root -
+d /var/log/varnish  700 varnish varnish -