just a missing detail in the changelog

Includes fix for VSV00019

.gitignore

@@ -72,3 +72,7 @@ varnish-2.1.3.tar.gz
 /varnish-7.7.3.tgz
 /varnish-8.0.0.tgz
 /pkg-varnish-cache-1f0d212.tar.gz
+/varnish-9.0.0.tar.gz
+/varnish-9.0.1.tar.gz
+/varnish-9.0.2.tar.gz
+/varnish-9.0.3.tar.gz

sources

@@ -1,3 +1,3 @@
-SHA512 (varnish-8.0.0.tgz) = c381928e23deaacb863dcf389a494f30a56d22a4e88fe0c5dc7d4a93828f3dc0595c7ae41837f3549795828aca1a30e08f4456d4a752a6d12c19b61943dd99e9
-SHA512 (pkg-varnish-cache-1f0d212.tar.gz) = 9f05978c99f292e64e71ba24ef2de791a33640e40fbad66d47889837fb0d4ced203873f5a17716edf757b5ad48098289882c2df196ce1fb457f279bf7f35bec3
+SHA512 (varnish-9.0.3.tar.gz) = 2789cff88632c2279062a109513cc00cab7690785f8f77e90b9968098c71ddcdc6403d6a9edc755b8f4055f0d32d9e330b0bc20fbab92ba80232955942dc912a
 SHA512 (jemalloc-5.3.0.tar.bz2) = 22907bb052096e2caffb6e4e23548aecc5cc9283dce476896a2b1127eee64170e3562fa2e7db9571298814a7a2c7df6e8d1fbe152bd3f3b0c1abec22a2de34b1
+SHA512 (pkg-varnish-cache-1f0d212.tar.gz) = 9f05978c99f292e64e71ba24ef2de791a33640e40fbad66d47889837fb0d4ced203873f5a17716edf757b5ad48098289882c2df196ce1fb457f279bf7f35bec3

varnish-9.0.1_openssl_4.0_asn1.patch

@@ -0,0 +1,38 @@
+Author: Ingvar Hagelund <ingvar@redpill-linpro.com>
+Date:   Wed Apr 15 00:17:59 2026 +0200
+
+    Use ASN1_STRING functions for openssl-4.0.0
+
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_asn_gentm.c	2026-04-15 00:34:44.788211992 +0200
+@@ -142,10 +142,10 @@
+ 	char *a;
+ 	int n, i, l, o;
+ 
+-	if (d->type != V_ASN1_GENERALIZEDTIME)
++	if (ASN1_STRING_type(d) != V_ASN1_GENERALIZEDTIME)
+ 		return (0);
+-	l = d->length;
+-	a = (char *)d->data;
++	l = ASN1_STRING_length(d);
++	a = (char *)ASN1_STRING_get0_data(d);
+ 	o = 0;
+ 	/*
+ 	 * GENERALIZEDTIME is similar to UTCTIME except the year is represented
+diff -Naur varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c
+--- varnish-9.0.1.orig/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-08 18:57:33.000000000 +0200
++++ varnish-9.0.1/bin/vinyltest/vtest2/src/vtc_tls.c	2026-04-15 00:35:53.447792774 +0200
+@@ -1060,10 +1060,10 @@
+ 
+ 			break;
+ 		case GEN_IPADD:
+-			p = n->d.ip->data;
++			p = ASN1_STRING_get0_data(n->d.ip);
+ 			AN(p);
+ 
+-			if (inet_ntop(n->d.ip->length == 16 ? AF_INET6 : AF_INET,
++			if (inet_ntop(ASN1_STRING_length(n->d.ip) == 16 ? AF_INET6 : AF_INET,
+ 			    p, b, INET6_ADDRSTRLEN) == 0)
+ 				continue;
+ 

varnish.spec

@@ -4,8 +4,8 @@
 
 %global __provides_exclude_from ^%{_libdir}/varnish/vmods
 
-%global abi 71d4d75665f4d1949f7eeca28092a12df7037f3a
-%global vrt 22.0
+%global abi 0a625649cd40af4b6c10be5e58a2e89a5e275baa
+%global vrt 23.1
 
 # Package scripts are now external
 # https://github.com/varnishcache/pkg-varnish-cache
@@ -31,19 +31,19 @@
 
 Summary: High-performance HTTP accelerator
 Name: varnish
-Version: 8.0.0
-Release: 2%{?dist}
+Version: 9.0.3
+Release: 3%{?dist}
 License: BSD-2-Clause AND (BSD-2-Clause-FreeBSD AND BSD-3-Clause AND LicenseRef-Fedora-Public-Domain AND Zlib)
 URL: https://www.varnish-cache.org/
-Source0: http://varnish-cache.org/_downloads/%{name}-%{version}.tgz
+Source0: https://github.com/varnish/varnish/releases/download/%{name}-%{version}/%{name}-%{version}.tar.gz
 Source1: https://github.com/varnishcache/pkg-varnish-cache/archive/%{commit1}.tar.gz#/pkg-varnish-cache-%{shortcommit1}.tar.gz
 Source2: varnish.sysusers
 Source3: https://github.com/jemalloc/jemalloc/releases/download/%{jemalloc_version}/jemalloc-%{jemalloc_version}.tar.bz2
 Source4: varnish.tmpfiles
 
-# Fix for h2 switch in varnishtest
-# https://github.com/varnishcache/varnish-cache/issues/4298
-Patch0:   varnish-7.7.0_fix_4298.patch
+# Compatibility with openssl-4.0.0
+# https://github.com/varnish/varnish/issues/32
+Patch1:   varnish-9.0.1_openssl_4.0_asn1.patch
 
 %if %{with bundled_jemalloc}
 # bundled jemalloc patch
@@ -91,6 +91,7 @@ BuildRequires: make
 BuildRequires: ncurses-devel
 BuildRequires: pcre2-devel
 BuildRequires: pkgconfig
+BuildRequires: openssl-devel
 
 %if %{with bundled_jemalloc}
 BuildRequires:  /usr/bin/xsltproc
@@ -99,7 +100,7 @@ BuildRequires:  perl-generators
 
 # Extra requirements for the build suite
 #   needs haproxy2
-%if 0%{?fedora} > 30 || 0%{?rhel} > 8
+%if 0%{?fedora} > 30
 BuildRequires: haproxy
 %endif
 BuildRequires: nghttp2
@@ -153,7 +154,9 @@ Documentation files for %name
 
 %prep
 %setup -q
-#patch 0 -p1
+%if 0%{?fedora} > 44 || 0%{?rhel} > 10
+%patch 1 -p1
+%endif
 tar xzf %SOURCE1
 ln -s pkg-varnish-cache-%{commit1}/redhat redhat
 ln -s pkg-varnish-cache-%{commit1}/debian debian
@@ -292,8 +295,11 @@ popd
 %endif
 
 # Up the stack size in tests, necessary on secondary arches
-sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/varnishtest/tests/*.vtc
-sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
+sed -i 's/thread_pool_stack 80k/thread_pool_stack 128k/g;' bin/vinyltest/tests/*.vtc
+sed -i 's/file,2M/file,8M/' bin/vinyltest/tests/r04036.vtc
+%ifarch %ix86
+sed -i 's/param.set workspace_thread 0.55k/param.set workspace_thread 0.5k/' bin/vinyltest/tests/b00081.vtc
+%endif
 
 # This is a bug in varnishtest making it incompatible with nghttp2 >= 1.65
 #if 0#{?fedora} > 41 || 0#{?rhel} > 10
@@ -304,11 +310,15 @@ sed -i 's/file,2M/file,8M/' bin/varnishtest/tests/r04036.vtc
 export LD_LIBRARY_PATH=%{_builddir}/%{name}-%{version}/jemalloc-%{jemalloc_version}/lib
 %endif
 
+# This runs fine in the emulator, but not on Red Hat's builders
+# Upstream is looking at it, upstream issue #36
+%ifarch s390x
+rm bin/vinyltest/tests/t02033.vtc
+%endif
+
 # Just a hack to avoid too high load on secondary arch builders
-%ifarch s390x ppc64le
-# This works when ran alone, but not in the whole suite. Load and/or timing issues
-rm bin/varnishtest/tests/t02014.vtc
-make -j2 check
+%ifarch s390x ppc64le %ix86
+make check
 %else
 %make_build check
 %endif
@@ -376,7 +386,7 @@ chmod 644 lib/libvmod_*/*.h
 %{_mandir}/man3/*.3*
 %{_mandir}/man7/*.7*
 %license LICENSE
-%doc README.rst ChangeLog
+%doc README.md ChangeLog
 %doc etc/builtin.vcl etc/example.vcl
 %dir %{_sysconfdir}/varnish/
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
@@ -390,7 +400,7 @@ chmod 644 lib/libvmod_*/*.h
 
 %files devel
 %license LICENSE
-%doc README.rst
+%doc README.md
 %{_libdir}/lib*.so
 %{_includedir}/%{name}
 %{_libdir}/pkgconfig/varnishapi.pc
@@ -417,6 +427,28 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 9.0.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 9.0.3-2
+- Rebuilt for openssl 4.0
+
+* Thu May 21 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.3-1
+- New upstream release: A security relase
+- Includes fix for VSV00019 aka CVE-2026-50052
+
+* Fri May 15 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.2-1
+- New upstream release: A bugfix release
+
+* Fri Apr 10 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.1-1
+- New upstream release
+- Add patch for openssl-4.0.0 in rawhide
+- Includes fix for VEV00002
+
+* Fri Mar 27 2026 Ingvar Hagelund <ingvar@redpill-linpro.com> - 9.0.0-1
+- New upstream release
+- Includes fix for VSV00018
+
 * Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 8.0.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild