Accepting request 1329868 from server:http

- Update to version 3.3.2+git0.72df9192b:

OBS-URL: https://build.opensuse.org/request/show/1329868
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/haproxy?expand=0&rev=174

_service

@@ -1,12 +1,12 @@
 <services>
   <service name="tar_scm" mode="manual">
-    <param name="url">http://git.haproxy.org/git/haproxy-3.2.git/</param>
+    <param name="url">http://git.haproxy.org/git/haproxy-3.3.git/</param>
     <param name="scm">git</param>
     <param name="filename">haproxy</param>
     <param name="versionformat">@PARENT_TAG@+git@TAG_OFFSET@.%h</param>
     <param name="versionrewrite-pattern">v(.*)</param>
     <param name="versionrewrite-replacement">\1</param>
-    <param name="revision">v3.2.9</param>
+    <param name="revision">v3.3.2</param>
     <param name="changesgenerate">enable</param>
   </service>
 

_servicedata

@@ -3,4 +3,8 @@
     <param name="url">http://git.haproxy.org/git/haproxy-3.2.git/</param>
     <param name="changesrevision">170436929ac78cfc4d1a43b3340535e1ac4d00d8</param>
   </service>
+  <service name="tar_scm">
+    <param name="url">http://git.haproxy.org/git/haproxy-3.3.git/</param>
+    <param name="changesrevision">72df9192b9ff071abce66a040d74cb6f0fe8232c</param>
+  </service>
 </servicedata>

haproxy-1.6.0-makefile_lib.patch

@@ -1,8 +1,8 @@
-Index: haproxy-3.2/Makefile
+Index: haproxy-3.3/Makefile
 ===================================================================
---- haproxy-3.2.orig/Makefile
-+++ haproxy-3.2/Makefile
-@@ -794,7 +794,7 @@ ifneq ($(USE_PCRE:0=)$(USE_STATIC_PCRE:0
+--- haproxy-3.3.orig/Makefile
++++ haproxy-3.3/Makefile
+@@ -799,7 +799,7 @@ ifneq ($(USE_PCRE:0=)$(USE_STATIC_PCRE:0
    PCREDIR     := $(shell $(PCRE_CONFIG) --prefix 2>/dev/null || echo /usr/local)
    ifneq ($(PCREDIR),)
      PCRE_INC := $(PCREDIR)/include
@@ -11,7 +11,7 @@ Index: haproxy-3.2/Makefile
    endif
  
    PCRE_CFLAGS := $(if $(PCRE_INC),-I$(PCRE_INC))
-@@ -812,7 +812,7 @@ ifneq ($(USE_PCRE2:0=)$(USE_STATIC_PCRE2
+@@ -817,7 +817,7 @@ ifneq ($(USE_PCRE2:0=)$(USE_STATIC_PCRE2
    PCRE2DIR     := $(shell $(PCRE2_CONFIG) --prefix 2>/dev/null || echo /usr/local)
    ifneq ($(PCRE2DIR),)
      PCRE2_INC := $(PCRE2DIR)/include

haproxy-1.6.0-sec-options.patch

@@ -4,21 +4,21 @@ Date:   Mon Jun 17 13:00:08 2019 +0000
 
     SUSE: Makefile sec options
 
-Index: haproxy-3.2/Makefile
+Index: haproxy-3.3/Makefile
 ===================================================================
---- haproxy-3.2.orig/Makefile
-+++ haproxy-3.2/Makefile
-@@ -346,7 +346,8 @@ use_opts = USE_EPOLL USE_KQUEUE USE_NETF
-            USE_THREAD_DUMP USE_EVPORTS USE_OT USE_QUIC USE_PROMEX             \
-            USE_MEMORY_PROFILING                                               \
+--- haproxy-3.3.orig/Makefile
++++ haproxy-3.3/Makefile
+@@ -351,7 +351,8 @@ use_opts = USE_EPOLL USE_KQUEUE USE_NETF
+            USE_MEMORY_PROFILING USE_SHM_OPEN                                  \
             USE_STATIC_PCRE USE_STATIC_PCRE2                                   \
--           USE_PCRE USE_PCRE_JIT USE_PCRE2 USE_PCRE2_JIT USE_QUIC_OPENSSL_COMPAT
-+           USE_PCRE USE_PCRE_JIT USE_PCRE2 USE_PCRE2_JIT USE_QUIC_OPENSSL_COMPAT \
+            USE_PCRE USE_PCRE_JIT USE_PCRE2 USE_PCRE2_JIT                      \
+-           USE_QUIC_OPENSSL_COMPAT USE_KTLS
++           USE_QUIC_OPENSSL_COMPAT USE_KTLS \
 +					 USE_PIE USE_STACKPROTECTOR USE_RELRO_NOW
  
  # preset all variables for all supported build options among use_opts
  $(reset_opts_vars)
-@@ -897,6 +898,35 @@ ifneq ($(TRACE),)
+@@ -902,6 +903,35 @@ ifneq ($(TRACE),)
    COPTS += -finstrument-functions
  endif
  

haproxy-3.2.9+git0.170436929.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:3d4a3d4b4c2ee192fc40dac87a43f5df07ee6f0bb3776bd276211cebffebd63a
-size 5277163

haproxy-3.3.2+git0.72df9192b.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:af7a52338068471490ca59d48dab3b55fb8ba351176d8f6c2afb251d17bbf851
+size 5405624

haproxy.changes

@@ -1,3 +1,129 @@
+-------------------------------------------------------------------
+Thu Jan 29 18:46:02 UTC 2026 - Marcus Rueckert <mrueckert@suse.de>
+
+- Update to version 3.3.2+git0.72df9192b:
+  * [RELEASE] Released version 3.3.2
+  * BUG/MEDIUM: debug: only dump Lua state when panicking
+  * BUG/MEDIUM: ssl: fix msg callbacks on QUIC connections
+  * BUG/MINOR: config/ssl: fix spelling of "expose-experimental-directives"
+  * BUG/MINOR: config: check capture pool creations for failures
+  * BUG/MINOR: stick-tables: abort startup on stk_ctr pool creation failure
+  * DOC: config: mention some possible TLS versions restrictions for kTLS
+  * BUG/MAJOR: applet: Don't call I/O handler if the applet was shut
+  * BUG/MINOR: ssl: Encrypted keys could not be loaded when given alongside certificate
+  * BUG/MINOR: ssl: Properly manage alloc failures in SSL passphrase callback
+  * DOC: reg-tests: update VTest upstream link in the starting guide
+  * MINOR: hlua: Add support for lua 5.5
+  * BUG/MINOR: ssl: fix error message of tune.ssl.certificate-compression
+  * MINOR: ssl: allow to disable certificate compression
+  * BUG/MINOR: proto_tcp: Properly report support for HAVE_TCP_MD5SIG feature
+  * BUG/MEDIUM: mux-h1: Skip UNUSED htx block when formating the start line
+  * BUG/MINOR: promex: Detach promex from the server on error dump its metrics dump
+  * BUG/MINOR: hlua: consume error object if ignored after a failing lua_pcall()
+  * BUG/MEDIUM: hlua: fix invalid lua_pcall() usage in hlua_traceback()
+  * BUG/MINOR: proxy: fix deinit crash on defaults with duplicate name
+  * REGTESTS: ssl: fix generate-certificates w/ LibreSSL
+  * BUG/MEDIUM: mux-quic: prevent BUG_ON() on aborted uni stream close
+  * BUG/MEDIUM: ssl: fix generate-certificates option when SNI greater than 64bytes
+  * BUG/MEDIUM: ssl: fix error path on generate-certificates
+  * BUG/MEDIUM: log: parsing log-forward options may result in segfault
+  * BUG/MEDIUM: promex: server iteration may rely on stale server
+  * BUG/MINOR: server: ensure server is detached from proxy list before being freed
+  * MINOR: cli: use srv_drop() when server was created using new_server()
+  * BUG/MINOR: cfgparse: fix "default" prefix parsing
+  * BUG/MINOR: proxy: free persist_rules
+  * BUG/MINOR: http_act: fix deinit performed on uninitialized lf_expr in release_http_map()
+  * BUG/MEDIUM: quic: fix ACK ECN frame parsing
+  * BUG/MINOR: hlua_fcn: ensure Patref:add_bulk() is given a table object before using it
+  * BUG/MINOR: hlua_fcn: fix broken yield for Patref:add_bulk()
+  * MINOR: cfgparse: remove duplicate "force-persist" in common kw list
+  * BUG/MINOR: ech/quic: enable ech configuration also for quic listeners
+  * REGTESTS: ssl: Fix reg-tests curve check
+  * BUG/MINOR: cli/stick-tables: argument to "show table" is optional
+  * BUILD: sockpair: fix build issue on macOS related to variable-length arrays
+  * BUG/MINOR: cfgparse: wrong section name upon error
+  * BUILD: tools: memchr definition changed in C23
+  * BUILD: ssl: strchr definition changed in C23
+  * BUG/MINOR: quic: fix deprecated warning for window size keyword
+  * BUG/MEDIUM: stconn: Move data from <kip> to <kop> during zero-copy forwarding
+  * BUG/MEDIUM: mworker: can't use signals after a failed reload
+  * BUG/MEDIUM: mux-h1: Take care to update <kop> value during zero-copy forwarding
+  * BUG/MEDIUM: peers: Properly handle shutdown when trying to get a line
+  * BUG/MINOR: mworker/cli: fix show proc pagination using reload counter
+  * DOC: config: fix the length attribute name for stick tables of type binary / string
+  * BUG/MINOR: backend: inspect request not response buffer to check for TFO
+  * BUG/MINOR: backend: fix the conn_retries check for TFO
+  * MINOR: mux-h2: perform a graceful close at 75% glitches threshold
+  * MINOR: mux-h2: add missing glitch count for non-decodable H2 headers
+
+-------------------------------------------------------------------
+Wed Jan 28 15:08:53 UTC 2026 - Peter Varkoly <varkoly@suse.com>
+
+- Fix packages for Immutable Mode
+
+-------------------------------------------------------------------
+Fri Dec 19 16:04:39 UTC 2025 - Marcus Rueckert <mrueckert@suse.de>
+
+- Update to version 3.3.1+git0.9c24c11a6:
+  * [RELEASE] Released version 3.3.1
+  * BUG/MEDIUM: mux-h2: synchronize all conditions to create a new backend stream
+  * BUG/MEDIUM: backend: Do not remove CO_FL_SESS_IDLE in assign_server()
+  * BUG/MEDIUM: quic: Don't try to use hystart if not implemented
+  * BUG/MINOR: quic-be: Missing keywords array NULL termination
+  * MINOR: quic: implement cc-algo server keyword
+  * MINOR: quic: extract cc-algo parsing in a dedicated function
+  * MINOR: quic: define quic_cc_algo as const
+  * Revert "MINOR: quic: use dynamic cc_algo on bind_conf"
+  * BUG/MEDIUM: stconn: Don't report abort from SC if read0 was already received
+  * BUG/MEDIUM: http-ana: Properly detect client abort when forwarding response (v2)
+  * MINOR: h2/trace: emit a trace of the received RST_STREAM type
+  * BUG/MEDIUM: h3: fix access to QCS <sd> definitely
+  * BUG/MEDIUM: ssl: Don't resume session for check connections
+  * BUG/MEDIUM: ssl: Don't store the ALPN for check connections
+  * MINOR: connections: Add a new CO_FL_SSL_NO_CACHED_INFO flag
+  * BUG/MEDIUM: ssl: Always check the ALPN after handshake
+  * MEDIUM: ssl/server: No longer store the SNI of cached TLS sessions
+  * BUG/MEDIUM: ssl: Don't reuse TLS session if the connection's SNI differs
+  * MEDIUM: tcpcheck/backend: Get the connection SNI before initializing SSL ctx
+  * MINOR: connection/ssl: Store the SNI hash value in the connection itself
+  * MINOR: ssl: Compare hashes instead of SNIs when a session is cached
+  * MINOR: ssl: Store hash of the SNI for cached TLS sessions
+  * MINOR: ssl: Add a function to hash SNIs
+  * MEDIUM: quic: Add connection as argument when qc_new_conn() is called
+  * BUG/MINOR: mworker/cli: 'show proc' is limited by buffer size
+  * CLEANUP: mworker/cli: remove useless variable
+  * BUG/MEDIUM: h3: do not access QCS <sd> if not allocated
+  * DOC: config: Improve spop mode documentation
+  * DOC: config: Fix description of the spop mode
+  * BUG/MEDIUM: http-ana: Don't close server connection on read0 in TUNNEL mode
+  * BUG/MINOR: log: Dump good %B and %U values in logs
+  * BUG/MINOR: ssl: Don't allow to set NULL sni
+  * BUG/MINOR: quic: do not set first the default QUIC curves
+  * BUG/MINOR: quic-be: missing connection stream closure upon TLS alert to send
+  * MINOR: quic: avoid code duplication in TLS alert callback
+  * MINOR: quic: Add useful debugging traces in qc_idle_timer_do_rearm()
+  * BUG/MINOR: quic-be: handshake errors without connection stream closure
+  * BUG/MINOR: quic/ssl: crash in ClientHello callback ssl traces
+  * DOC: config: reorder the cache section's keywords
+  * DOC: config: mention clearer that the cache's total-max-size is mandatory
+  * BUG/MEDIUM: config: ignore empty args in skipped blocks
+  * BUG/MEDIUM: connection: fix "bc_settings_streams_limit" typo
+  * DOC: configuration: ECH support details
+  * BUG/MINOR: jwt: Missing "case" in switch statement
+  * BUG/MEDIUM: mworker/listener: ambiguous use of RX_F_INHERITED with shards
+
+-------------------------------------------------------------------
+Wed Nov 26 15:48:38 UTC 2025 - Marcus Rueckert <mrueckert@suse.de>
+
+- Update to version 3.3.0+git0.7832fb21f:
+  https://www.haproxy.com/blog/announcing-haproxy-3-3
+  https://www.mail-archive.com/haproxy@formilux.org/msg46300.html
+- refresh patches:
+  haproxy-1.6.0-makefile_lib.patch
+  haproxy-1.6.0-sec-options.patch
+- enable USE_KTLS
+- prepare ech/quic support
+
 -------------------------------------------------------------------
 Fri Nov 21 10:27:18 UTC 2025 - Marcus Rueckert <mrueckert@suse.de>
 

haproxy.spec

@@ -46,8 +46,10 @@
 %bcond_with tmpfiles
 %endif
 
+%bcond_with ech
+
 Name:           haproxy
-Version:        3.2.9+git0.170436929
+Version:        3.3.2+git0.72df9192b
 Release:        0
 #
 Summary:        The Reliable, High Performance TCP/HTTP Load Balancer
@@ -121,6 +123,7 @@ cp %{SOURCE7} .
     USE_RELRO_NOW=1 \
     USE_STACKPROTECTOR=1 \
     USE_PIE=1 \
+    USE_KTLS=1 \
     USE_PCRE2=1 \
     %if %{with pcre2_jit}
     USE_PCRE2_JIT=1 \
@@ -133,6 +136,10 @@ cp %{SOURCE7} .
     USE_OPENSSL_AWSLC=1 \
 %else
     USE_OPENSSL=1 \
+%if %{with ech}
+    USE_QUIC_OPENSSL_COMPAT=1 \
+    USE_ECH=1 \
+%endif
 %endif
     USE_LUA=1 \
     USE_ZLIB=1 \
@@ -215,7 +222,7 @@ rm examples/*init*
 %if %{with rc_symlink}
 %{_sbindir}/rchaproxy
 %endif
-%dir %attr(-,root,haproxy) %{pkg_home}
+%dir %ghost %{pkg_home}
 %{_mandir}/man1/%{pkg_name}.1%{?ext_man}
 %dir %{_datadir}/vim
 %dir %{vim_data_dir}