New version 4.6.8

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

ci.fmf

@@ -0,0 +1 @@
+resultsdb-testcase: separate

gating.yaml

@@ -1,16 +1,25 @@
 --- !Policy
 product_versions:
   - fedora-*
-decision_contexts: [bodhi_update_push_testing]
+decision_context: bodhi_update_push_testing
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
  
-#gating rawhide
+#Rawhide
 --- !Policy
 product_versions:
   - fedora-*
-decision_contexts: [bodhi_update_push_stable]
+decision_context: bodhi_update_push_stable
 subject_type: koji_build
 rules:
-  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
+  - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
+ 
+#gating rhel
+--- !Policy
+product_versions:
+  - rhel-*
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-public.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}

plans.fmf

@@ -0,0 +1,35 @@
+/tier1-internal:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/tier1/internal
+
+/tier1-public:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/tier1/public
+
+/tier2-tier3-internal:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/tier2-tier3/internal
+
+/tier2-tier3-public:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/tier2-tier3/public
+
+/others-internal:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/others/internal
+
+/others-public:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/wireshark.git
+      name: /plans/others/public

plans/all.fmf

@@ -1,6 +0,0 @@
-summary: Test plan with all Fedora tests
-discover:
-       how: fmf
-       url: https://src.fedoraproject.org/tests/wireshark.git
-execute:
-       how: tmt

rpminspect.yaml

@@ -0,0 +1,13 @@
+---
+ownership:
+  #dumpcap is the only binary that has group wireshark
+  ignore:
+    - /usr/bin/dumpcap
+
+capabilities:
+  #dumpcap is the only binary that has group wireshark
+  ignore:
+    - /usr/bin/dumpcap
+
+inspections:
+  xml: off

sources

@@ -1,2 +1,2 @@
-SHA512 (wireshark-3.6.7.tar.xz) = caf087ee467bf934f28d096869ea3d9d7c5a3c83e51c4df447700096943a92abf5cf29f4956b9a549e0708bcb3515b55c4660a7ced2cb9dbc582b87550026fac
-SHA512 (SIGNATURES-3.6.7.txt) = f7f826d4665cbf89088dd12a1e732a9a451b2566e2b4fad0924e443c811bb158a9276cf0221c79414f9020c6e5f8f0ec25513b56cbaf82d304c2a7ac3f06ef5d
+SHA512 (wireshark-4.6.8.tar.xz) = 4692bd15bebd67475502b6afe106e3be85b90add16f932d7e58c4426fd62b5886e96daa522aafd9ee4a8300bf3e091a738b5b1fa20e3e0721d0d0f3be216f3c8
+SHA512 (SIGNATURES-4.6.8.txt) = 598caa682ac71899465fb82a37445f7141287bbabee964dfd33aedbb4c4c6e0ed9b206d458b9eb2d9a083f9c6db9f8b50d8dcaf11e26dc33bb8baee83ae3f6fa

wireshark-0002-Customize-permission-denied-error.patch

@@ -1,57 +1,28 @@
-From: Jan Safranek <jsafrane@redhat.com>
-Date: Fri, 26 Nov 2010 14:30:45 +0300
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "From: Jan Safranek" <jsafrane@redhat.com>
+Date: Wed, 9 Sep 2026 08:53:35 +0200
 Subject: [PATCH] Customize 'permission denied' error.
 
-Add Fedora-specific message to error output when dumpcap cannot be started
-because of permissions.
-
-Signed-off-by: Jan Safranek <jsafrane@redhat.com>
 
 diff --git a/capture/capture_sync.c b/capture/capture_sync.c
-index 2f9d2cc..b18e47f 100644
+index 36a8f3edbe..db8b49b816 100644
 --- a/capture/capture_sync.c
 +++ b/capture/capture_sync.c
-@@ -375,6 +375,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
-     gchar *signal_pipe_name;
- #else
-     char errmsg[1024+1];
-+    const char *securitymsg = "";
-     int sync_pipe[2];                       /* pipe used to send messages from child to parent */
-     enum PIPES { PIPE_READ, PIPE_WRITE };   /* Constants 0 and 1 for PIPE_READ and PIPE_WRITE */
- #endif
-@@ -728,8 +729,11 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
-         dup2(sync_pipe[PIPE_WRITE], 2);
-         ws_close(sync_pipe[PIPE_READ]);
-         execv(argv[0], argv);
--        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
--                   argv[0], g_strerror(errno));
-+        if (errno == EPERM || errno == EACCES)
-+          securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
-+        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
-+                argv[0], g_strerror(errno), securitymsg);
+@@ -2102,8 +2102,16 @@ sync_pipe_input_cb(GIOChannel *pipe_io, capture_session *cap_session)
+         if (!ws_strtoi32(buffer, NULL, &exec_errno)) {
+             ws_warning("Invalid errno: %s", buffer);
+         }
+-        primary_msg = ws_strdup_printf("Couldn't run dumpcap in child process: %s",
++        if (exec_errno == EPERM || exec_errno == EACCES) {
++            const char *securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
++            primary_msg = ws_strdup_printf("Couldn't run dumpcap in child process: %s%s",
++                                       g_strerror(exec_errno), securitymsg);
++        }
++        else {
++            primary_msg = ws_strdup_printf("Couldn't run dumpcap in child process: %s",
+                                        g_strerror(exec_errno));
++        }
 +
-         sync_pipe_errmsg_to_parent(2, errmsg, "");
- 
-         /* Exit with "_exit()", so that we don't close the connection
-@@ -826,6 +830,7 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
-     int i;
- #else
-     char errmsg[1024+1];
-+    const char *securitymsg = "";
-     int sync_pipe[2];                       /* pipe used to send messages from child to parent */
-     int data_pipe[2];                       /* pipe used to send data from child to parent */
- #endif
-@@ -1003,8 +1008,11 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
-         ws_close(sync_pipe[PIPE_READ]);
-         ws_close(sync_pipe[PIPE_WRITE]);
-         execv(argv[0], argv);
--        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
--                   argv[0], g_strerror(errno));
-+        execv(argv[0], (gpointer)argv);
-+	if (errno == EPERM || errno == EACCES)
-+		securitymsg = "\nAre you a member of the 'wireshark' group? Try running\n'usermod -a -G wireshark _your_username_' as root.";
-+        g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s%s",
-+                   argv[0], g_strerror(errno), securitymsg);
-         sync_pipe_errmsg_to_parent(2, errmsg, "");
- 
-         /* Exit with "_exit()", so that we don't close the connection
+         cap_session->error(cap_session, primary_msg, NULL);
+         /* the capture child will close the sync_pipe, nothing to do for now */
+         /* (an error message doesn't mean we have to stop capturing) */

wireshark-0003-fix-string-overrun-in-plugins-profinet.patch

@@ -1,18 +0,0 @@
-From: Peter Hatina <phatina@redhat.com>
-Date: Wed, 4 Sep 2013 10:03:57 +0200
-Subject: [PATCH] fix string overrun in plugins/profinet
-
-
-diff --git a/plugins/epan/profinet/packet-dcom-cba.c b/plugins/epan/profinet/packet-dcom-cba.c
-index 0f1658a..f7fd322 100644
---- a/plugins/epan/profinet/packet-dcom-cba.c
-+++ b/plugins/epan/profinet/packet-dcom-cba.c
-@@ -555,7 +555,7 @@ dissect_ICBAPhysicalDevice_get_LogicalDevice_rqst(tvbuff_t *tvb, int offset,
-     packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep)
- {
-     guint32      u32Pointer;
--    gchar        szStr[1000];
-+    gchar        szStr[1000] = "";
-     guint32      u32MaxStr = sizeof(szStr);
-     gchar       *call;
- 

wireshark-0004-Restore-Fedora-specific-groups.patch

@@ -1,15 +0,0 @@
-From: Peter Lemenkov <lemenkov@gmail.com>
-Date: Fri, 13 Sep 2013 14:36:55 +0400
-Subject: [PATCH] Restore Fedora-specific groups
-
-Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
-diff --git a/org.wireshark.Wireshark.desktop b/org.wireshark.Wireshark.desktop
-index 334db48..669c6f1 100644
---- a/org.wireshark.Wireshark.desktop
-+++ b/org.wireshark.Wireshark.desktop
-@@ -108,4 +108,4 @@ Terminal=false
- MimeType=application/vnd.tcpdump.pcap;application/x-pcapng;application/x-snoop;application/x-iptrace;application/x-lanalyzer;application/x-nettl;application/x-radcom;application/x-etherpeek;application/x-visualnetworks;application/x-netinstobserver;application/x-5view;application/x-tektronix-rf5;application/x-micropross-mplog;application/x-apple-packetlogger;application/x-endace-erf;application/ipfix;application/x-ixia-vwr;
- # Category entry according to:
- # https://specifications.freedesktop.org/menu-spec/1.0/
--Categories=Network;Monitor;Qt;
-+Categories=Application;Network;Monitor;Qt;

wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch

@@ -1,20 +0,0 @@
-From: Kenneth Soerensen <knnthsrnsn@gmail.com>
-Date: Wed, 29 Jan 2014 16:04:12 +0400
-Subject: [PATCH] Fix paths in a org.wireshark.Wireshark.desktop file
-
-
-diff --git a/org.wireshark.Wireshark.desktop b/org.wireshark.Wireshark.desktop
-index 669c6f1..f7df1f3 100644
---- a/org.wireshark.Wireshark.desktop
-+++ b/org.wireshark.Wireshark.desktop
-@@ -102,8 +102,8 @@ Comment[tr]=Ağ trafiği çözümleyicisi
- Comment[vi]=Trình phân tích giao thông mạng
- Comment[uk]=Аналізатор мережевого трафіку
- Icon=org.wireshark.Wireshark
--TryExec=wireshark
--Exec=wireshark %f
-+TryExec=/usr/bin/wireshark
-+Exec=/usr/bin/wireshark %f
- Terminal=false
- MimeType=application/vnd.tcpdump.pcap;application/x-pcapng;application/x-snoop;application/x-iptrace;application/x-lanalyzer;application/x-nettl;application/x-radcom;application/x-etherpeek;application/x-visualnetworks;application/x-netinstobserver;application/x-5view;application/x-tektronix-rf5;application/x-micropross-mplog;application/x-apple-packetlogger;application/x-endace-erf;application/ipfix;application/x-ixia-vwr;
- # Category entry according to:

wireshark-0006-Move-tmp-to-var-tmp.patch

@@ -1,269 +1,77 @@
-From cb54210f7f02b07768cfbf49ae266d487f580e1b Mon Sep 17 00:00:00 2001
-From: rpm-build <rpm-build>
-Date: Thu, 29 Jun 2017 15:32:58 +0200
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Hatina <phatina@redhat.com>
+Date: Tue, 24 Sep 2013 10:55:09 +0200
 Subject: [PATCH] Move /tmp to /var/tmp
 
-Fedora is using tmpfs which is limited by the size of RAM, thus we need
-to use different directory on different filesystem.
----
- ui/qt/about_dialog.cpp         |  3 +-
- ui/qt/iax2_analysis_dialog.cpp |  5 +--
- ui/qt/rtp_analysis_dialog.cpp  |  5 +--
- ui/qt/rtp_audio_stream.cpp     |  3 +-
- wsutil/tempfile.c              |  9 +++---
- wsutil/tempfile.h              |  4 +--
- wsutil/wstmpdir.c              | 70 ++++++++++++++++++++++++++++++++++++++++++
- wsutil/wstmpdir.h              | 39 +++++++++++++++++++++++
- 8 files changed, 132 insertions(+), 11 deletions(-)
- create mode 100644 wsutil/wstmpdir.c
- create mode 100644 wsutil/wstmpdir.h
+Fedora mounts /tmp on tmpfs, which is backed by RAM, and capture files
+are routinely larger than RAM, so the default temporary directory needs
+to be somewhere on disk.
 
-diff --git a/ui/qt/about_dialog.cpp b/ui/qt/about_dialog.cpp
-index 31dc581..2f74285 100644
---- a/ui/qt/about_dialog.cpp
-+++ b/ui/qt/about_dialog.cpp
-@@ -26,6 +26,7 @@
- 
- #include "wireshark_application.h"
- #include <wsutil/filesystem.h>
-+#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
- 
- #include <QDesktopServices>
- #include <QUrl>
-@@ -206,7 +206,7 @@ FolderListModel::FolderListModel(QObject * parent):
-     appendRow(QStringList() << tr("\"File\" dialogs") << get_last_open_dir() << tr("capture files"));
- 
-     /* temp */
--    appendRow(QStringList() << tr("Temp") << g_get_tmp_dir() << tr("untitled capture files"));
-+    appendRow(QStringList() << tr("Temp") << get_tmp_dir() << tr("untitled capture files"));
- 
-     /* pers conf */
-     appendRow(QStringList() << tr("Personal configuration")
-diff --git a/ui/qt/iax2_analysis_dialog.cpp b/ui/qt/iax2_analysis_dialog.cpp
-index ee4e5fd..fe17a95 100644
---- a/ui/qt/iax2_analysis_dialog.cpp
-+++ b/ui/qt/iax2_analysis_dialog.cpp
-@@ -37,6 +37,7 @@
- #include "ui/rtp_stream.h"
- #endif
- #include <wsutil/utf8_entities.h>
-+#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
- 
- #include <wsutil/g711.h>
- #include <wsutil/pint.h>
-@@ -271,10 +272,10 @@ Iax2AnalysisDialog::Iax2AnalysisDialog(QWidget &parent, CaptureFile &cf) :
- 
-     // We keep our temp files open for the lifetime of the dialog. The GTK+
-     // UI opens and closes at various points.
--    QString tempname = QString("%1/wireshark_iax2_f").arg(QDir::tempPath());
-+    QString tempname = QString("%1/wireshark_iax2_f").arg(get_tmp_dir());
-     fwd_tempfile_ = new QTemporaryFile(tempname, this);
-     fwd_tempfile_->open();
--    tempname = QString("%1/wireshark_iax2_r").arg(QDir::tempPath());
-+    tempname = QString("%1/wireshark_iax2_r").arg(get_tmp_dir());
-     rev_tempfile_ = new QTemporaryFile(tempname, this);
-     rev_tempfile_->open();
- 
-diff --git a/ui/qt/utils/rtp_audio_file.cpp b/ui/qt/utils/rtp_audio_file.cpp
-index 591a63b..203f5c5 100644
---- a/ui/qt/utils/rtp_audio_file.cpp
-+++ b/ui/qt/utils/rtp_audio_file.cpp
-@@ -31,6 +31,7 @@
- 
- #include "rtp_audio_file.h"
- #include <ws_attributes.h>
-+#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
- 
- RtpAudioFile::RtpAudioFile(bool use_disk_for_temp, bool use_disk_for_frames):
-       real_pos_(0)
-@@ -45,7 +46,7 @@ RtpAudioFile::RtpAudioFile(bool use_disk_for_temp, bool use_disk_for_frames):
- 
-     tempname = "memory";
-     if (use_disk_for_temp) {
--        tempname = QString("%1/wireshark_rtp_stream").arg(QDir::tempPath());
-+        tempname = QString("%1/wireshark_rtp_stream").arg(get_tmp_dir());
-         sample_file_ = new QTemporaryFile(tempname, this);
-     } else {
-         sample_file_ = new QBuffer(this);
-diff --git a/wsutil/tempfile.c b/wsutil/tempfile.c
-index 5082452..f751a7c 100644
---- a/wsutil/tempfile.c
-+++ b/wsutil/tempfile.c
-@@ -12,10 +12,12 @@
+Set TMPDIR in configuration_init(), which every program calls early in
+main(). TMPDIR is the one knob that GLib (g_get_tmp_dir()), Qt
+(QDir::tempPath()) and child processes such as dumpcap all read, so one
+default covers every temporary file rather than the handful of call
+sites a per-site patch can reach. A TMPDIR already in the environment is
+left alone.
 
- #include <glib.h>
- #include "tempfile.h"
-+#include <wsutil/file_util.h>
-+#include <wsutil/wstmpdir.h> /* for get_tmp_dir() */
+Only TMPDIR is consulted, and an empty one counts as unset - that is
+exactly how GLib and Qt behave on Unix, where TMP and TEMP are ignored
+entirely.
 
-  /**
-  * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-- * is created using g_file_open_tmp.
-+ * is created using get_tmp_dir.
-  *
-  * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must be freed.
-@@ -30,6 +31,9 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
- {
-   int fd;
-   gchar *safe_pfx = NULL;
-+  gchar *tmp_file;
-+  const char *tmp_dir;
-+  int old_mask;
+The change is Peter Hatina's, from 2013; the implementation above was
+rewritten in 2026 and the original is worth recording. It added
+wsutil/wstmpdir.{c,h} - a copy of g_get_tmp_dir() with a /var/tmp
+fallback, exported from libwsutil as get_tmp_dir() - and rewrote
+create_tempfile() around it.
 
-   if (pfx) {
-     /* The characters in "delimiters" come from:
-@@ -49,7 +53,15 @@ create_tempfile(gchar **namebuf, const char *pfx, const char *sfx, GError **err)
-   gchar* filetmpl = g_strdup_printf("%sXXXXXX%s", safe_pfx ? safe_pfx : "", sfx ? sfx : "");
-   g_free(safe_pfx);
+That reached three of the roughly seventeen places that ask for a
+temporary directory, missing the second temporary file in
+rtp_audio_file.cpp, the export-object and traffic-tab dialogs, tshark's
+own default, wsutil/socket.c and create_tempdir(). It also worked only
+by accident: P_tmpdir is "/tmp" on glibc and was tested ahead of the
+/var/tmp default, so the fallback was reached purely because
+wstmpdir.c never included <stdio.h>. Adding that one header would have
+silently restored /tmp.
 
--  fd = g_file_open_tmp(filetmpl, namebuf, err);
-+  tmp_dir = get_tmp_dir();
-+  tmp_file = g_strconcat(tmp_dir, "/", filetmpl, NULL);
-+
-+  if (namebuf)
-+    *namebuf = tmp_file;
-+
-+  old_mask = ws_umask(0077);
-+  fd = mkstemps(tmp_file, sfx ? (int) strlen(sfx) : 0);
-+  ws_umask(old_mask);
+Setting TMPDIR keeps Peter's intent and drops all of that.
 
-   g_free(filetmpl);
-   return fd;
-diff --git a/wsutil/tempfile.h b/wsutil/tempfile.h
-index 1dca2df..bb3160c 100644
---- a/wsutil/tempfile.h
-+++ b/wsutil/tempfile.h
-@@ -45,7 +45,7 @@ WS_DLL_PUBLIC char *get_tempfile_path(const char *filename);
- 
- /**
-  * Create a tempfile with the given prefix (e.g. "wireshark"). The path
-- * is created using g_file_open_tmp.
-+ * is created using get_tmp_dir and mkstemp.
-  *
-  * @param namebuf [in,out] If not NULL, receives the full path of the temp file.
-  *                Must be freed.
-diff --git a/wsutil/wstmpdir.c b/wsutil/wstmpdir.c
-new file mode 100644
-index 0000000..d8b733b
---- /dev/null
-+++ b/wsutil/wstmpdir.c
-@@ -0,0 +1,71 @@
-+/* wstmpdir.c
-+ *
-+ * Copyright (C) 2013 Red Hat, Inc. All right reserved.
-+ *
-+ * Temporary directory routine
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License
-+ * as published by the Free Software Foundation; either version 2
-+ * of the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Author: Peter Hatina <phatina@redhat.com>
-+ */
+Rewritten-by: Peter Lemenkov <lemenkov@gmail.com>
+Assisted-by: Claude
+
+diff --git a/wsutil/filesystem.c b/wsutil/filesystem.c
+index f1c7358a97..6ee028cb71 100644
+--- a/wsutil/filesystem.c
++++ b/wsutil/filesystem.c
+@@ -932,6 +932,32 @@ configuration_init(const char* arg0)
+ #ifdef _WIN32
+     return configuration_init_w32(arg0);
+ #else
++    /*
++     * Fedora mounts /tmp on tmpfs, which is backed by RAM, and capture
++     * files are routinely larger than RAM. Default the temporary
++     * directory to /var/tmp unless the user has asked for something else.
++     *
++     * TMPDIR is the one knob that GLib (g_get_tmp_dir()), Qt
++     * (QDir::tempPath()) and child processes such as dumpcap all read on
++     * this platform, so setting it here covers every temporary file the
++     * programs create without having to touch each call site. It has to
++     * happen before any of them run, and configuration_init() is among
++     * the first things every program calls.
++     *
++     * Only TMPDIR is consulted. TMP and TEMP are Windows spellings that
++     * neither GLib nor Qt looks at on Unix, so honouring them here would
++     * promise something the rest of the code cannot keep.
++     *
++     * An empty TMPDIR counts as unset, which is how both GLib and Qt
++     * treat it - otherwise it would suppress this default and leave them
++     * falling back to /tmp, the one outcome nobody asked for.
++     */
++    const char *tmpdir = g_getenv("TMPDIR");
 +
-+#include "config.h"
-+
-+#include <glib.h>
-+#include "wstmpdir.h"
-+
-+/**
-+ * Gets the directory to use for temporary files.
-+ *
-+ * Inspired by glib-2.0. If no TMP, TEMP or TMPDIR is set,
-+ * /var/tmp is returned (Fedora specific).
-+ *
-+ * Returns: the directory to use for temporary files.
-+ */
-+const char *get_tmp_dir(void)
-+{
-+    static gchar *tmp_dir;
-+
-+    if (g_once_init_enter(&tmp_dir)) {
-+        gchar *tmp;
-+
-+        tmp = g_strdup(g_getenv("TEMP"));
-+        if (tmp == NULL || *tmp == '\0') {
-+            g_free(tmp);
-+            tmp = g_strdup(g_getenv("TMPDIR"));
-+        }
-+
-+#ifdef P_tmpdir
-+        if (tmp == NULL || *tmp == '\0') {
-+            gsize k;
-+            g_free(tmp);
-+            tmp = g_strdup(P_tmpdir);
-+            k = strlen(tmp);
-+            if (k > 1 && G_IS_DIR_SEPARATOR(tmp[k - 1]))
-+                tmp[k - 1] = '\0';
-+            fprintf(stderr, "Using P_tmpdir: %s\n", P_tmpdir);
-+        }
-+#endif /* P_tmpdir */
-+
-+        if (tmp == NULL || *tmp == '\0') {
-+            g_free(tmp);
-+            tmp = g_strdup("/var/tmp");
-+        }
-+
-+        g_once_init_leave(&tmp_dir, tmp);
++    if (tmpdir == NULL || tmpdir[0] == '\0') {
++        g_setenv("TMPDIR", "/var/tmp", true);
 +    }
 +
-+    return tmp_dir;
-+}
-diff --git a/wsutil/wstmpdir.h b/wsutil/wstmpdir.h
-new file mode 100644
-index 0000000..07ac583
---- /dev/null
-+++ b/wsutil/wstmpdir.h
-@@ -0,0 +1,39 @@
-+/* wstmpdir.c
-+ *
-+ * Copyright (C) 2013 Red Hat, Inc. All right reserved.
-+ *
-+ * Temporary directory routine
-+ *
-+ * This program is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU General Public License
-+ * as published by the Free Software Foundation; either version 2
-+ * of the License, or (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License
-+ * along with this program; if not, write to the Free Software
-+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Author: Peter Hatina <phatina@redhat.com>
-+ */
-+
-+#ifndef __WS_TMP_DIR_H__
-+#define __WS_TMP_DIR_H__
-+
-+#include "ws_symbol_export.h"
-+
-+#ifdef __cplusplus
-+extern "C" {
-+#endif // __cplusplus
-+
-+WS_DLL_PUBLIC const char *get_tmp_dir(void);
-+
-+#ifdef __cplusplus
-+}
-+#endif // __cplusplus
-+
-+#endif
--- 
-2.13.0
+     return configuration_init_posix(arg0);
+ #endif
+ }

wireshark-0007-cmakelists.patch

@@ -1,20 +0,0 @@
-diff --git a/wsutil/CMakeLists.txt b/wsutil/CMakeLists.txt
-index 0367cd1..6382a2c 100644
---- a/wsutil/CMakeLists.txt
-+++ b/wsutil/CMakeLists.txt
-@@ -69,6 +69,7 @@ set(WSUTIL_PUBLIC_HEADERS
- 	ws_mempbrk_int.h
- 	ws_pipe.h
- 	ws_roundup.h
-+	wstmpdir.h
- 	wsjson.h
- 	wslog.h
- 	xtea.h
-@@ -118,6 +118,7 @@ set(WSUTIL_COMMON_FILES
- 	ws_getopt.c
- 	ws_mempbrk.c
- 	ws_pipe.c
-+	wstmpdir.c
- 	wsgcrypt.c
- 	wsjson.c
- 	wslog.c

wireshark-0009-remove-strato-manpages.patch

@@ -0,0 +1,257 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Peter Lemenkov <lemenkov@gmail.com>
+Date: Tue, 8 Sep 2026 19:49:08 +0200
+Subject: [PATCH] Docs: Build a manual page only when its program is built
+
+The manual pages are added to the build unconditionally, so a build
+configured without a program still generates, installs and packages
+that program's page.
+
+The default configuration shows it. BUILD_stratoshark is OFF by
+default, yet stratoshark(1), strato(1), falcodump(1), sshdig(1) and
+dumpcalls(1) are built and installed anyway, along with the Stratoshark
+release notes, documenting programs that were never compiled. The same
+goes for anything else switched off: randpktdump(1) survives
+-DBUILD_randpktdump=OFF, and etwdump(1) is installed on every platform,
+though the program it describes is built only on Windows.
+
+Guard each page on the condition its program is built under, which is
+what dpauxmon, sdjournal and mmdbresolve already do a few lines further
+down. That means the dependency as well as the option, so sshdump,
+ciscodump, wifidump and sshdig follow LIBSSH_FOUND and falcodump and
+dumpcalls follow SINSP_FOUND, exactly as extcap/CMakeLists.txt builds
+them. Extend the same to the HTML pages in DOC_FILES, where falcodump
+and dumpcalls were already guarded and the rest were not, and to the
+Stratoshark release notes.
+
+sshdig moves to the stratoshark package in the Debian packaging. It is
+a Stratoshark extcap, installed into STRATOSHARK_EXTCAP_INSTALL_LIBDIR
+and shipped with stratoshark, but its manual page was listed in
+wireshark-common. That was already wrong - a default build has no
+sshdig binary in that package - and it becomes a build failure once the
+page is only generated when the program is:
+
+    dh_installman: error: Cannot find (any matches for)
+    "obj-*/doc/man_pages/sshdig.1" (tried in ., debian/tmp)
+
+Pages for things that are always built - wireshark, tshark, capinfos,
+captype, dumpcap, editcap, mergecap, randpkt, rawshark, reordercap,
+sharkd, text2pcap and the section 4 pages - stay unconditional.
+
+Assisted-by: Claude
+Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2129bd0b22..e467cfdb1f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -2281,33 +2281,60 @@ endif()
+ 
+ if (ASCIIDOCTOR_FOUND)
+ 	list(APPEND DOC_FILES
+-		${CMAKE_BINARY_DIR}/doc/man_pages/androiddump.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/udpdump.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/capinfos.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/captype.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/ciscodump.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/dumpcap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/editcap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/extcap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/mergecap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/randpkt.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/randpktdump.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/etwdump.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/rawshark.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/reordercap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/sharkd.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/sshdig.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/sshdump.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/strato.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/stratoshark.html
+-		${CMAKE_BINARY_DIR}/doc/man_pages/wifidump.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/text2pcap.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/tshark.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/wireshark.html
+ 		${CMAKE_BINARY_DIR}/doc/man_pages/wireshark-filter.html
+ 		"${CMAKE_BINARY_DIR}/doc/Wireshark Release Notes.html"
+-		"${CMAKE_BINARY_DIR}/doc/Stratoshark Release Notes.html"
+ 	)
++
++	#
++	# As with the manual pages themselves, only install the HTML for a
++	# program that is actually built.
++	#
++	if(BUILD_stratoshark)
++		list(APPEND DOC_FILES
++			${CMAKE_BINARY_DIR}/doc/man_pages/stratoshark.html
++			"${CMAKE_BINARY_DIR}/doc/Stratoshark Release Notes.html"
++		)
++	endif()
++	if(BUILD_strato)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/strato.html)
++	endif()
++	if(BUILD_androiddump)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/androiddump.html)
++	endif()
++	if(BUILD_ciscodump AND LIBSSH_FOUND)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/ciscodump.html)
++	endif()
++	if(BUILD_etwdump AND WIN32)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/etwdump.html)
++	endif()
++	if(BUILD_randpktdump)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/randpktdump.html)
++	endif()
++	if(BUILD_sshdig AND LIBSSH_FOUND)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/sshdig.html)
++	endif()
++	if(BUILD_sshdump AND LIBSSH_FOUND)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/sshdump.html)
++	endif()
++	if(BUILD_udpdump)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/udpdump.html)
++	endif()
++	if(BUILD_wifidump AND LIBSSH_FOUND)
++		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/wifidump.html)
++	endif()
+ 	if(MAXMINDDB_FOUND)
+ 		list(APPEND DOC_FILES ${CMAKE_BINARY_DIR}/doc/man_pages/mmdbresolve.html)
+ 	endif()
+diff --git a/doc/CMakeLists.txt b/doc/CMakeLists.txt
+index a92ed452fe..7a05821b4c 100644
+--- a/doc/CMakeLists.txt
++++ b/doc/CMakeLists.txt
+@@ -40,28 +40,70 @@ endmacro()
+ 
+ ADD_MAN_PAGE(wireshark   1)
+ ADD_MAN_PAGE(tshark      1)
+-ADD_MAN_PAGE(stratoshark 1)
+-ADD_MAN_PAGE(strato      1)
+ 
+-ADD_MAN_PAGE(androiddump 1)
+ ADD_MAN_PAGE(capinfos    1)
+ ADD_MAN_PAGE(captype     1)
+-ADD_MAN_PAGE(ciscodump   1)
+ ADD_MAN_PAGE(dumpcap     1)
+ ADD_MAN_PAGE(editcap     1)
+-ADD_MAN_PAGE(etwdump     1)
+-ADD_MAN_PAGE(falcodump   1)
+ ADD_MAN_PAGE(mergecap    1)
+ ADD_MAN_PAGE(randpkt     1)
+-ADD_MAN_PAGE(randpktdump 1)
+ ADD_MAN_PAGE(rawshark    1)
+ ADD_MAN_PAGE(reordercap  1)
+ ADD_MAN_PAGE(sharkd      1)
+-ADD_MAN_PAGE(sshdig      1)
+-ADD_MAN_PAGE(sshdump     1)
+ ADD_MAN_PAGE(text2pcap   1)
+-ADD_MAN_PAGE(udpdump     1)
+-ADD_MAN_PAGE(wifidump    1)
++
++#
++# A program that is not built should not leave a manual page behind for
++# it. Each of these follows the option that decides whether the program
++# is built, the same way dpauxmon, sdjournal and mmdbresolve do below.
++#
++if(BUILD_stratoshark)
++	ADD_MAN_PAGE(stratoshark 1)
++endif()
++
++if(BUILD_strato)
++	ADD_MAN_PAGE(strato      1)
++endif()
++
++if(BUILD_androiddump)
++	ADD_MAN_PAGE(androiddump 1)
++endif()
++
++if(BUILD_ciscodump AND LIBSSH_FOUND)
++	ADD_MAN_PAGE(ciscodump   1)
++endif()
++
++if(BUILD_dumpcalls AND SINSP_FOUND)
++	ADD_MAN_PAGE(dumpcalls   1)
++endif()
++
++if(BUILD_etwdump AND WIN32)
++	ADD_MAN_PAGE(etwdump     1)
++endif()
++
++if(BUILD_falcodump AND SINSP_FOUND)
++	ADD_MAN_PAGE(falcodump   1)
++endif()
++
++if(BUILD_randpktdump)
++	ADD_MAN_PAGE(randpktdump 1)
++endif()
++
++if(BUILD_sshdig AND LIBSSH_FOUND)
++	ADD_MAN_PAGE(sshdig      1)
++endif()
++
++if(BUILD_sshdump AND LIBSSH_FOUND)
++	ADD_MAN_PAGE(sshdump     1)
++endif()
++
++if(BUILD_udpdump)
++	ADD_MAN_PAGE(udpdump     1)
++endif()
++
++if(BUILD_wifidump AND LIBSSH_FOUND)
++	ADD_MAN_PAGE(wifidump    1)
++endif()
+ 
+ ADD_MAN_PAGE(extcap           4)
+ ADD_MAN_PAGE(wireshark-filter 4)
+@@ -112,13 +154,17 @@ endif()
+ if(ASCIIDOCTOR_FOUND)
+ 	ASCIIDOCTOR2HTML("Wireshark_Release_Notes.adoc" CONVERT_UNDERSCORES)
+ 	ASCIIDOCTOR2TXT("Wireshark_Release_Notes.adoc" CONVERT_UNDERSCORES)
+-	ASCIIDOCTOR2HTML("Stratoshark_Release_Notes.adoc" CONVERT_UNDERSCORES)
+-	ASCIIDOCTOR2TXT("Stratoshark_Release_Notes.adoc" CONVERT_UNDERSCORES)
++	set(RELEASE_NOTES_HTML "${CMAKE_CURRENT_BINARY_DIR}/Wireshark Release Notes.html")
++
++	# Only the release notes for something that was built.
++	if(BUILD_stratoshark)
++		ASCIIDOCTOR2HTML("Stratoshark_Release_Notes.adoc" CONVERT_UNDERSCORES)
++		list(APPEND RELEASE_NOTES_HTML "${CMAKE_CURRENT_BINARY_DIR}/Stratoshark Release Notes.html")
++	endif()
+ 
+ 	add_custom_target(release_notes_html
+ 		DEPENDS
+-			"${CMAKE_CURRENT_BINARY_DIR}/Wireshark Release Notes.html"
+-			"${CMAKE_CURRENT_BINARY_DIR}/Stratoshark Release Notes.html"
++			${RELEASE_NOTES_HTML}
+ 	)
+ 	set_target_properties(release_notes_html PROPERTIES FOLDER "Documentation")
+ 
+@@ -166,8 +212,7 @@ if(ASCIIDOCTOR_FOUND)
+ 	install(
+ 		FILES
+ 			${HTML_INSTALL_FILES}
+-			"${CMAKE_CURRENT_BINARY_DIR}/Wireshark Release Notes.html"
+-			"${CMAKE_CURRENT_BINARY_DIR}/Stratoshark Release Notes.html"
++			${RELEASE_NOTES_HTML}
+ 		DESTINATION
+ 			${CMAKE_INSTALL_DOCDIR}
+ 		COMPONENT "ReleaseNotes"
+diff --git a/packaging/debian/stratoshark.manpages b/packaging/debian/stratoshark.manpages
+index 4f27313b47..f13fa2d55d 100644
+--- a/packaging/debian/stratoshark.manpages
++++ b/packaging/debian/stratoshark.manpages
+@@ -1,2 +1,3 @@
+ usr/share/man/man1/strato.1
+ usr/share/man/man1/stratoshark.1
++usr/share/man/man1/sshdig.1
+diff --git a/packaging/debian/wireshark-common.manpages b/packaging/debian/wireshark-common.manpages
+index 9c7ce5956c..974e970e28 100644
+--- a/packaging/debian/wireshark-common.manpages
++++ b/packaging/debian/wireshark-common.manpages
+@@ -13,7 +13,6 @@ obj-*/doc/man_pages/androiddump.1
+ obj-*/doc/man_pages/ciscodump.1
+ obj-*/doc/man_pages/randpktdump.1
+ obj-*/doc/man_pages/udpdump.1
+-obj-*/doc/man_pages/sshdig.1
+ obj-*/doc/man_pages/sshdump.1
+ obj-*/doc/man_pages/wifidump.1
+ obj-*/doc/man_pages/extcap.4

wireshark.spec

@@ -1,16 +1,17 @@
 %undefine __cmake_in_source_build
 %global with_lua 1
 %global with_maxminddb 1
-%global plugins_version 3.6
-# added temporarily due to errors in libqt5core
-%define _lto_cflags %{nil}
+%global with_pytools 1
+%global plugins_version 4.6
+
+%bcond http3 %[0%{?fedora} >= 43]
 
 Summary:	Network traffic analyzer
 Name:		wireshark
-Version:	3.6.7
-Release:	2%{?dist}
+Version:	4.6.8
+Release:	1%{?dist}
 Epoch:		1
-License:	GPL+
+License:	BSD-1-Clause AND BSD-2-Clause AND BSD-3-Clause AND MIT AND GPL-2.0-or-later AND LGPL-2.0-or-later AND Zlib AND ISC AND (BSD-3-Clause OR GPL-2.0-only) AND (GPL-2.0-or-later AND Zlib)
 Url:		http://www.wireshark.org/
 
 Source0:	https://wireshark.org/download/src/%{name}-%{version}.tar.xz
@@ -19,16 +20,11 @@ Source2:	90-wireshark-usbmon.rules
 Source3:	wireshark.sysusers
 
 # Fedora-specific
-Patch2:		wireshark-0002-Customize-permission-denied-error.patch
-# Will be proposed upstream
-Patch3:		wireshark-0003-fix-string-overrun-in-plugins-profinet.patch
+Patch2:   wireshark-0002-Customize-permission-denied-error.patch
 # Fedora-specific
-Patch4:		wireshark-0004-Restore-Fedora-specific-groups.patch
-# Fedora-specific
-Patch5:		wireshark-0005-Fix-paths-in-a-wireshark.desktop-file.patch
-# Fedora-specific
-Patch6:		wireshark-0006-Move-tmp-to-var-tmp.patch
-Patch7:		wireshark-0007-cmakelists.patch
+Patch6:   wireshark-0006-Move-tmp-to-var-tmp.patch
+# Proposed upstream - https://gitlab.com/wireshark/wireshark/-/merge_requests/26425
+Patch9:   wireshark-0009-remove-strato-manpages.patch
 
 #install tshark together with wireshark GUI
 Requires:	%{name}-cli = %{epoch}:%{version}-%{release}
@@ -58,32 +54,52 @@ BuildRequires:	desktop-file-utils
 BuildRequires:	xdg-utils
 BuildRequires:	bison
 BuildRequires:	flex
-BuildRequires:	pcre-devel
 BuildRequires:	perl(Pod::Html)
 BuildRequires:	perl(Pod::Man)
 BuildRequires:	perl(open)
+BuildRequires:	pcre2-devel
 Buildrequires:	libssh-devel
-BuildRequires:	qt5-linguist
-BuildRequires:	qt5-qtbase-devel
-BuildRequires:	qt5-qtmultimedia-devel
-BuildRequires:	qt5-qtsvg-devel
+BuildRequires:	qt6-qttools-devel
+BuildRequires:	qt6-linguist
+BuildRequires:	qt6-qtbase-devel
+BuildRequires:	qt6-qt5compat-devel
+BuildRequires:	qt6-qtmultimedia-devel
+BuildRequires:	qt6-qtsvg-devel
+BuildRequires:  qt6-qtimageformats
 BuildRequires:	zlib-devel
 BuildRequires:	asciidoctor
 %if %{with_maxminddb} && 0%{?fedora}
 BuildRequires:	libmaxminddb-devel
 %endif
 %if %{with_lua} && 0%{?fedora}
-BuildRequires:	compat-lua-devel
+BuildRequires:	lua-devel
 %endif
-Buildrequires: git-core
-Buildrequires: python3-devel
-Buildrequires: cmake
+Buildrequires:	git-core
+Buildrequires:	python3-devel
+Buildrequires:	cmake
+Buildrequires:	speexdsp-devel
 #needed for sdjournal external capture interface
-BuildRequires: systemd-devel
-BuildRequires: libnghttp2-devel
-BuildRequires: systemd-rpm-macros
+BuildRequires:	systemd-devel
+BuildRequires:	libnghttp2-devel
+%if %{with http3}
+BuildRequires:	libnghttp3-devel
+%endif
+BuildRequires:	systemd-rpm-macros
+BuildRequires:	lz4-devel
+BuildRequires:	snappy-devel
+BuildRequires:	brotli-devel
+BuildRequires:	opus-devel
+BuildRequires:	sbc-devel
+%if 0%{?fedora}
+BuildRequires:	ilbc-devel
+BuildRequires:	opencore-amr-devel
+# bcg729 for G.729
+BuildRequires:	bcg729-devel
+# spandsp for G.722 and G.726
+BuildRequires:	spandsp-devel
+# wireshark needs the -compat package
+%endif
 
-Obsoletes: wireshark-qt, wireshark-gtk
 
 %description
 Wireshark allows you to examine protocol data stored in files or as it is
@@ -98,8 +114,6 @@ transferred over HTTP or CIFS, or play back an RTP audio stream.
 
 %package	cli
 Summary:	Network traffic analyzer
-Requires(pre):	shadow-utils
-Requires(post): systemd-udev
 
 %description cli
 This package contains command-line utilities, plugins, and documentation for
@@ -107,7 +121,14 @@ Wireshark.
 
 %package devel
 Summary:	Development headers and libraries for wireshark
-Requires:	%{name} = %{epoch}:%{version}-%{release} glibc-devel glib2-devel
+Requires:	%{name} = %{epoch}:%{version}-%{release}
+Requires:	%{name}-cli = %{epoch}:%{version}-%{release}
+Requires:	glibc-devel
+Requires:	glib2-devel
+%if %{with_pytools} && 0%{?fedora}
+Requires:	python3-ply
+Requires:	omniORB-devel
+%endif
 
 %description devel
 The wireshark-devel package contains the header files, developer
@@ -135,59 +156,53 @@ and plugins.
   -DBUILD_randpktdump=OFF \
   -DBUILD_androiddump=ON \
   -DENABLE_SMI=ON \
+  -DUSE_qt6=ON \
   -DENABLE_PLUGINS=ON \
   -DENABLE_NETLINK=ON \
   -DBUILD_dcerpcidl2wrs=OFF \
   -DBUILD_sdjournal=ON \
-  %{nil}
+  -DBUILD_stratoshark=OFF
 
 %cmake_build
 
 %install
 %cmake_install
+%cmake_install --component Development
 
 desktop-file-validate %{buildroot}%{_datadir}/applications/org.wireshark.Wireshark.desktop
 
 #install devel files (inspired by debian/wireshark-dev.header-files)
 install -d -m 0755  %{buildroot}%{_includedir}/wireshark
+install -m 0644 %{__cmake_builddir}/config.h %{buildroot}%{_includedir}/wireshark/config.h
 IDIR="%{buildroot}%{_includedir}/wireshark"
-mkdir -p "${IDIR}/epan"
-mkdir -p "${IDIR}/epan/crypt"
-mkdir -p "${IDIR}/epan/ftypes"
-mkdir -p "${IDIR}/epan/dfilter"
-mkdir -p "${IDIR}/epan/dissectors"
-mkdir -p "${IDIR}/epan/wmem"
-mkdir -p "${IDIR}/wiretap"
-mkdir -p "${IDIR}/wsutil"
 mkdir -p %{buildroot}%{_udevrulesdir}
-install -m 644 %{_vpath_builddir}/config.h epan/register.h	"${IDIR}/"
-install -m 644 cfile.h file.h		"${IDIR}/"
-install -m 644 ws_symbol_export.h	"${IDIR}/"
-install -m 644 epan/*.h			"${IDIR}/epan/"
-install -m 644 epan/crypt/*.h		"${IDIR}/epan/crypt"
-install -m 644 epan/ftypes/*.h		"${IDIR}/epan/ftypes"
-install -m 644 epan/dfilter/*.h		"${IDIR}/epan/dfilter"
-install -m 644 epan/dissectors/*.h	"${IDIR}/epan/dissectors"
-install -m 644 wiretap/*.h		"${IDIR}/wiretap"
-install -m 644 wsutil/*.h		"${IDIR}/wsutil"
-install -m 644 ws_diag_control.h	"${IDIR}/"
-install -m 644 %{SOURCE2}		%{buildroot}%{_udevrulesdir}
-install -Dpm 644 %{SOURCE3}		%{buildroot}%{_sysusersdir}/%{name}.conf
+install -m 0644 %{SOURCE2}		%{buildroot}%{_udevrulesdir}
+install -Dpm 0644 %{SOURCE3}		%{buildroot}%{_sysusersdir}/%{name}.conf
+
+%if %{with_pytools} && 0%{?fedora}
+#install asn2wrs.py, idl2wrs and make-plugin-reg.py tools
+mkdir -p %{buildroot}%{_libexecdir}/wireshark/pytools
+install -m 0755 tools/asn2wrs.py %{buildroot}%{_libexecdir}/wireshark/pytools/
+install -m 0755 tools/make-plugin-reg.py %{buildroot}%{_libexecdir}/wireshark/pytools/
+install -m 0755 tools/idl2wrs %{buildroot}%{_libexecdir}/wireshark/pytools/
+
+#install idl2wrs dependent scripts
+install -m 0644 tools/wireshark_be.py %{buildroot}%{_libexecdir}/wireshark/pytools/
+install -m 0644 tools/wireshark_gen.py %{buildroot}%{_libexecdir}/wireshark/pytools/
+%endif
 
 touch %{buildroot}%{_bindir}/%{name}
 
 # Remove libtool archives and static libs
 find %{buildroot} -type f -name "*.la" -delete
 
-%pre cli
-%sysusers_create_compat %{SOURCE3}
 
 %post cli
 %{?ldconfig}
 # skip triggering if udevd isn't even accessible, e.g. containers or
 # rpm-ostree-based systems
 if [ -S /run/udev/control ]; then
-    /usr/bin/udevadm trigger --subsystem-match=usbmon
+    /usr/bin/udevadm trigger --subsystem-match=usbmon || :
 fi
 
 %ldconfig_postun cli
@@ -200,14 +215,14 @@ fi
 %{_datadir}/icons/hicolor/*/mimetypes/*
 %{_bindir}/wireshark
 %{_mandir}/man1/wireshark.*
-%{_sysusersdir}/%{name}.conf
 
 %files cli
 %license COPYING
-%doc AUTHORS INSTALL NEWS README*
+%doc AUTHORS INSTALL README*
 %{_bindir}/capinfos
 %{_bindir}/captype
 %{_bindir}/editcap
+%{_bindir}/dftest
 %{_bindir}/mergecap
 %{_bindir}/randpkt
 %{_bindir}/reordercap
@@ -221,17 +236,17 @@ fi
 %{_bindir}/rawshark
 %{_udevrulesdir}/90-wireshark-usbmon.rules
 %{_libdir}/lib*.so.*
-%dir %{_libdir}/wireshark
-%dir %{_libdir}/wireshark/extcap
+%dir %{_libexecdir}/wireshark
+%dir %{_libexecdir}/wireshark/extcap
 %dir %{_libdir}/wireshark/plugins
-%{_libdir}/wireshark/extcap/ciscodump
-%{_libdir}/wireshark/extcap/udpdump
-%{_libdir}/wireshark/extcap/sshdump
-%{_libdir}/wireshark/extcap/sdjournal
-%{_libdir}/wireshark/extcap/dpauxmon
-%{_libdir}/wireshark/extcap/androiddump
-%dir %{_libdir}/wireshark/cmake
-%{_libdir}/wireshark/cmake/*.cmake
+%dir %{_libdir}/wireshark
+%{_libexecdir}/wireshark/extcap/ciscodump
+%{_libexecdir}/wireshark/extcap/udpdump
+%{_libexecdir}/wireshark/extcap/wifidump
+%{_libexecdir}/wireshark/extcap/sshdump
+%{_libexecdir}/wireshark/extcap/sdjournal
+%{_libexecdir}/wireshark/extcap/dpauxmon
+%{_libexecdir}/wireshark/extcap/androiddump
 #the version wireshark uses to store plugins is only x.y, not .z
 %dir %{_libdir}/wireshark/plugins/%{plugins_version}
 %dir %{_libdir}/wireshark/plugins/%{plugins_version}/epan
@@ -248,32 +263,227 @@ fi
 %{_mandir}/man1/dumpcap.*
 %{_mandir}/man4/wireshark-filter.*
 %{_mandir}/man1/rawshark.*
-%{_mandir}/man1/dftest.*
 %{_mandir}/man1/randpkt.*
 %{_mandir}/man1/reordercap.*
 %{_mandir}/man1/sshdump.*
 %{_mandir}/man1/udpdump.*
+%{_mandir}/man1/wifidump.*
 %{_mandir}/man1/androiddump.*
 %{_mandir}/man1/captype.*
 %{_mandir}/man1/ciscodump.*
-%{_mandir}/man1/randpktdump.*
 %{_mandir}/man1/dpauxmon.*
 %{_mandir}/man1/sdjournal.*
-%{_mandir}/man1/etwdump.1.gz
+%{_mandir}/man1/sharkd.*
 %{_mandir}/man4/extcap.*
+%{_datadir}/doc/wireshark/*
+
 %if %{with_maxminddb} && 0%{?fedora}
 %{_mandir}/man1/mmdbresolve.*
 %endif
 %dir %{_datadir}/wireshark
 %{_datadir}/wireshark/*
+%{_sysusersdir}/%{name}.conf
 
 %files devel
 %doc doc/README.* ChangeLog
-%{_includedir}/wireshark
+%dir %{_includedir}/wireshark
+%{_includedir}/wireshark/*
 %{_libdir}/lib*.so
 %{_libdir}/pkgconfig/%{name}.pc
+%{_libdir}/cmake/%{name}/*.cmake
+%if %{with_pytools} && 0%{?fedora}
+%dir %{_libexecdir}/wireshark/pytools
+%{_libexecdir}/wireshark/pytools/*.py
+%{_libexecdir}/wireshark/pytools/idl2wrs
+%endif
 
 %changelog
+* Wed Sep  9 2026 Peter Lemenkov <lemenkov@gmail.com> - 1:4.6.8-1
+- New version 4.6.8
+
+* Tue Sep 08 2026 Peter Lemenkov <lemenkov@gmail.com> - 1:4.6.7-3
+- Rewrite the /var/tmp patch to set TMPDIR in configuration_init() rather
+  than add wsutil/wstmpdir.{c,h} and rewrite create_tempfile(). TMPDIR is
+  read by GLib, by Qt and by child processes such as dumpcap, so one
+  default now covers every temporary file instead of three of the roughly
+  seventeen places that ask for a temporary directory
+- Drop wireshark-0007-cmakelists.patch, which existed only to build the
+  files the rewrite removes
+- Drop the stray wireshark-0003 patch, applied upstream in 0bc06ec1086 and
+  unreferenced by the spec since 4.6.0
+
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.6.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Tue Jul 14 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.6.7-1
+- New version 4.6.7
+
+* Sat Jun 13 2026 Yaakov Selkowitz <yselkowi@redhat.com> - 1:4.6.6-2
+- Rebuilt for openssl 4.0
+
+* Mon Jun 01 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.6.6-1
+- New version 4.6.6
+
+* Wed Mar 11 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.6.4-2
+- Python tools should only be shipped in Fedora
+
+* Wed Mar 04 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.6.4-1
+- New version 4.6.4
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.6.3-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Thu Jan 15 2026 Michal Ruprich <mruprich@redhat.com> - 1:4.6.3-1
+- New version 4.6.3
+
+* Thu Dec 11 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 1:4.6.1-3
+- Enable HTTP/3 support on F43+ only
+
+* Tue Dec 09 2025 Alexey Kurov <nucleo@fedoraproject.org> - 1:4.6.1-2
+- BuildRequires: libnghttp3-devel - needed for HTTP3 support
+
+* Thu Nov 27 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.6.1-1
+- New version 4.6.1
+
+* Thu Oct 09 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.6.0-1
+- New version 4.6.0
+
+* Mon Sep 01 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.9-1
+- New version 4.4.9
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.4.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Fri Jul 18 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.8-1
+- New version 4.4.8
+
+* Thu Jun 05 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.7-1
+- New version 4.4.7
+
+* Tue Jun 03 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.6-2
+- udevadm should be ignored if an error occures
+
+* Mon May 26 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.6-1
+- New version 4.4.6
+
+* Tue Mar 18 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.5-1
+- New version 4.4.5
+
+* Thu Feb 20 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.4-1
+- New version 4.4.4
+
+* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:4.4.3-2
+- Drop call to %sysusers_create_compat
+
+* Wed Jan 22 2025 Michal Ruprich <mruprich@redhat.com> - 1:4.4.3-1
+- New version 4.4.3
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.4.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Thu Nov 21 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-1
+- New version 4.4.2
+
+* Thu Oct 10 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.4.1-1
+- New version 4.4.1
+
+* Fri Sep 20 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.4.0-2
+- Using cmake install for development headers and .cmake files
+
+* Thu Aug 29 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.4.0-1
+- New version 4.4.0
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.2.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Thu Jul 11 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.6-1
+- New version 4.2.6
+
+* Fri May 24 2024 Neal Gompa <ngompa@fedoraproject.org> - 1:4.2.5-2
+- Rebuild (Qt6)
+
+* Wed May 22 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.5-1
+- New version 4.2.5
+
+* Tue May 21 2024 Jan Grulich <jgrulich@redhat.com> - 1:4.2.4-3
+- Rebuild (qt6)
+
+* Sat May 04 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.4-2
+- Enabling additional features (rhbz#2278136)
+
+* Mon Apr 08 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.4-1
+- New version 4.2.4
+
+* Thu Apr 04 2024 Jan Grulich <jgrulich@redhat.com> - 1:4.2.3-2
+- Rebuild (qt6)
+
+* Tue Mar 12 2024 Marie Loise Nolden <loise@kde.org> - 1:4.2.3-1
+- New version 4.2.3-1
+
+* Sun Feb 18 2024 Yaakov Selkowitz <yselkowi@redhat.com> - 1:4.2.2-3
+- Install more devel headers
+
+* Sun Feb 11 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.2-2
+- Making sure that wireshark.pc is created and installed
+
+* Thu Feb 01 2024 Michal Ruprich <mruprich@redhat.com> - 1:4.2.2-1
+- New version 4.2.2
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.0.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Thu Aug 31 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.8-2
+- Resolves: #2236246 - wireshark crash in managed interfaces
+
+* Tue Aug 29 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.8-1
+- New version 4.0.8
+- Resolves: #2235577 - possible Denial of Service via crafted package
+
+* Fri Jul 28 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.7-3
+- Resolves: #2227004 - capinfos aborts in FIPS
+
+* Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.0.7-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Fri Jul 14 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.7-1
+- New version 4.0.7
+
+* Thu May 25 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.6-1
+- New version 4.0.6
+
+* Thu Apr 13 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.5-1
+- New version 4.0.5
+- Fix for bug #2159392
+
+* Wed Mar 22 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.4-2
+- SPDX migration
+
+* Tue Mar 07 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.4-1
+- New version 4.0.4
+
+* Thu Feb 02 2023 Michal Ruprich <mruprich@redhat.com> - 1:4.0.3-1
+- New version 4.0.3
+
+* Sat Jan 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:4.0.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Dec 08 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.2-1
+- New version 4.0.2
+
+* Thu Oct 27 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.1-1
+- New version 4.0.1
+- Only compat-lua is supported, on Fedora only
+
+* Fri Oct 14 2022 Michal Ruprich <mruprich@redhat.com> - 1:4.0.0-2
+- Adding a couple of tweaks for the latest rebased version
+
+* Thu Oct 06 2022 Kenneth Topp <toppk@bllue.org> - 1:4.0.0-1
+- New version 4.0.0
+
+* Thu Sep 29 2022 Michal Ruprich <mruprich@redhat.com> - 1:3.6.8-2
+- New version 3.6.8
+- Fix for CVE-2022-3190
+
 * Mon Aug 01 2022 Davide Cavalca <dcavalca@fedoraproject.org> - 1:3.6.7-2
 - Drop gating for python3-devel dependency