Update to 7.4.2 for fix CVE-2023-44487

(cherry picked from commit d6faded3afc00a794de31de3362dfdb4870f6412)

fix-varnish-devel-installation-failure.patch

@@ -0,0 +1,78 @@
+From a022cd62660fdd6405563fe568e786ec759fc2b5 Mon Sep 17 00:00:00 2001
+From: wu-leilei <wu18740459704@163.com>
+Date: Fri, 21 Jan 2022 15:52:05 +0800
+Subject: [PATCH] fix varnish-devel installation failure
+
+---
+ bin/varnishtest/huffman_gen.py | 2 +-
+ doc/sphinx/vtc-syntax.py       | 2 +-
+ lib/libvarnishapi/generate.py  | 2 +-
+ lib/libvcc/generate.py         | 2 +-
+ lib/libvcc/vmodtool.py         | 2 +-
+ lib/libvcc/vsctool.py          | 2 +-
+ wflags.py                      | 2 +-
+ 7 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/bin/varnishtest/huffman_gen.py b/bin/varnishtest/huffman_gen.py
+index 1320424..a9666fb 100755
+--- a/bin/varnishtest/huffman_gen.py
++++ b/bin/varnishtest/huffman_gen.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ 
+ import re
+ import sys
+diff --git a/doc/sphinx/vtc-syntax.py b/doc/sphinx/vtc-syntax.py
+index f5533e8..7009142 100644
+--- a/doc/sphinx/vtc-syntax.py
++++ b/doc/sphinx/vtc-syntax.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ #
+ # Copyright (c) 2006-2016 Varnish Software AS
+ # All rights reserved.
+diff --git a/lib/libvarnishapi/generate.py b/lib/libvarnishapi/generate.py
+index 10bef42..3619779 100755
+--- a/lib/libvarnishapi/generate.py
++++ b/lib/libvarnishapi/generate.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ #-
+ # Copyright (c) 2006 Verdens Gang AS
+ # Copyright (c) 2006-2015 Varnish Software AS
+diff --git a/lib/libvcc/generate.py b/lib/libvcc/generate.py
+index a2b318b..ecf2c50 100755
+--- a/lib/libvcc/generate.py
++++ b/lib/libvcc/generate.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ #
+ # Copyright (c) 2006 Verdens Gang AS
+ # Copyright (c) 2006-2015 Varnish Software AS
+diff --git a/lib/libvcc/vmodtool.py b/lib/libvcc/vmodtool.py
+index 0eb77c5..6b3af4d 100755
+--- a/lib/libvcc/vmodtool.py
++++ b/lib/libvcc/vmodtool.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ #
+ # Copyright (c) 2010-2016 Varnish Software
+ # All rights reserved.
+diff --git a/wflags.py b/wflags.py
+index 9e9e4e9..90605a2 100644
+--- a/wflags.py
++++ b/wflags.py
+@@ -1,4 +1,4 @@
+-#!/usr/bin/env python3
++#!/usr/bin/python3
+ #
+ # Copyright (c) 2021 Varnish Software AS
+ # All rights reserved.
+-- 
+2.23.0
+

fix-varnish.service-reload-failed.patch

@@ -0,0 +1,25 @@
+From eac670ac734d814b466cbbf5e9b68625735438e5 Mon Sep 17 00:00:00 2001
+From: caodongxia <315816521@qq.com>
+Date: Fri, 18 Feb 2022 16:21:18 +0800
+Subject: [PATCH] fix varnish.service reload failed
+
+---
+ .../systemd/varnish.service                                     | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/systemd/varnish.service b/pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/systemd/varnish.service
+index c06c36b..6c65124 100644
+--- a/pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/systemd/varnish.service
++++ b/pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/systemd/varnish.service
+@@ -22,7 +22,7 @@ TasksMax=infinity
+ LimitCORE=infinity
+ 
+ ExecStart=/usr/sbin/varnishd -a :6081 -f /etc/varnish/default.vcl -s malloc,256m
+-ExecReload=/usr/sbin/varnishreload
++ExecReload=/usr/sbin/varnishreload /etc/varnish/default.vcl
+ 
+ [Install]
+ WantedBy=multi-user.target
+-- 
+2.27.0
+

modify-invalid-option-for-varnished-command.patch

@@ -1,25 +0,0 @@
-From 727e97677a45ab13d0adf43ba627f6b972e02a9e Mon Sep 17 00:00:00 2001
-From: caodongxia <315816521@qq.com>
-Date: Fri, 25 Nov 2022 19:16:48 +0800
-Subject: [PATCH] modify invalid option ? for the varnished command
-
----
- bin/varnishd/mgt/mgt_main.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/bin/varnishd/mgt/mgt_main.c b/bin/varnishd/mgt/mgt_main.c
-index 9f4c236..9ad6d8a 100644
---- a/bin/varnishd/mgt/mgt_main.c
-+++ b/bin/varnishd/mgt/mgt_main.c
-@@ -79,7 +79,7 @@ static struct vpf_fh *pfh2 = NULL;
- static struct vfil_path *vcl_path = NULL;
- static VTAILQ_HEAD(,f_arg) f_args = VTAILQ_HEAD_INITIALIZER(f_args);
- 
--static const char opt_spec[] = "a:b:Cdf:Fh:i:I:j:l:M:n:P:p:r:S:s:T:t:VW:x:";
-+static const char opt_spec[] = "?a:b:Cdf:Fh:i:I:j:l:M:n:P:p:r:S:s:T:t:VW:x:";
- 
- int optreset;	// Some has it, some doesn't.  Cheaper than auto*
- 
--- 
-2.23.0
-

varnish.spec

@@ -1,21 +1,22 @@
 %global __python %{__python3}
+%global vendor %{?_vendor:%{_vendor}}%{!?_vendor:openEuler}
 
 Name:             varnish
 Summary:          A web application accelerator
-Version:          6.6.2
+Version:          7.4.2
-Release:          3
+Release:          1
-License:          BSD
+License:          BSD-2-Clause
 URL:              https://www.varnish-cache.org/
 Source0:          http://varnish-cache.org/_downloads/varnish-%{version}.tgz
 
 # https://github.com/varnishcache/pkg-varnish-cache
-Source1:          https://github.com/varnishcache/pkg-varnish-cache/archive/ec7ad9e6c6dd7c9b4f4ba60c5b223376908c3ca6/pkg-varnish-cache-ec7ad9e.tar.gz
+Source1:          https://github.com/varnishcache/pkg-varnish-cache/archive/0ad2f22629c4a368959c423a19e352c9c6c79682/pkg-varnish-cache-0ad2f22.tar.gz
-Patch0000:        modify-invalid-option-for-varnished-command.patch
+Patch0001:        fix-varnish-devel-installation-failure.patch
+Patch0002:        fix-varnish.service-reload-failed.patch
 
 BuildRequires:    python3-sphinx python3-docutils pkgconfig make graphviz nghttp2 systemd-units
-BuildRequires:    ncurses-devel pcre-devel libedit-devel python3
+BuildRequires:    ncurses-devel pcre2-devel libedit-devel gcc
-Requires:         logrotate ncurses pcre jemalloc openEuler-rpm-config gcc
+Requires:         logrotate ncurses pcre2 jemalloc %{vendor}-rpm-config gcc
-Requires:	  %{name}-help = %{version}-%{release}
 Requires(pre):    shadow-utils
 Requires(post):   /usr/bin/uuidgen systemd-units systemd-sysv
 Requires(preun):  systemd-units
@@ -51,16 +52,17 @@ Help documentation files for varnish.
 
 %prep
 %autosetup -p1 -a 0 -a 1
-ln -s pkg-varnish-cache-ec7ad9e6c6dd7c9b4f4ba60c5b223376908c3ca6/redhat redhat
+ln -s pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/redhat redhat
-ln -s pkg-varnish-cache-ec7ad9e6c6dd7c9b4f4ba60c5b223376908c3ca6/debian debian
+ln -s pkg-varnish-cache-0ad2f22629c4a368959c423a19e352c9c6c79682/debian debian
 cp redhat/find-provides .
-sed -i 's,rst2man-3.6,rst2man-3.4,g; s,rst2html-3.6,rst2html-3.4,g; s,phinx-build-3.6,phinx-build-3.4,g' configure
 
 %build
 export RST2MAN=/bin/true
 
-%configure LT_SYS_LIBRARY_PATH=%_libdir \
+%configure --disable-static \
-  --disable-static \
+%ifarch aarch64
+  --with-jemalloc=no \
+%endif
   --localstatedir=/var/lib  \
   --docdir="%{_docdir}/varnish"
 
@@ -72,6 +74,7 @@ popd
 %make_build
 
 sed -i 's,User=varnishlog,User=varnish,g;' redhat/varnishncsa.service
+sed -i 's/env python/python3/g;' lib/libvcc/vmodtool.py
 
 rm -rf doc/html/_sources
 
@@ -103,11 +106,10 @@ chmod 644 lib/libvmod_*/*.h
 %endif
 
 %check
-%ifarch s390 s390x aarch64
+%ifarch aarch64
-rm bin/varnishtest/tests/o00005.vtc
+sed -i 's/48/128/g;' bin/varnishtest/tests/c00057.vtc
 %endif
-
+make %{?_smp_mflags} check LD_LIBRARY_PATH="%{buildroot}%{_libdir}:%{buildroot}%{_libdir}/%{name}" VERBOSE=1
-%make_build check
 
 %pre
 getent group varnish >/dev/null || groupadd -r varnish
@@ -139,7 +141,8 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 %config(noreplace) %{_sysconfdir}/varnish/default.vcl
 %config(noreplace) %{_sysconfdir}/logrotate.d/varnish
 %config %{_sysconfdir}/ld.so.conf.d/varnish-%{_arch}.conf
-
+%exclude /usr/lib/debug/*
+%exclude /usr/src/debug/*
 %{_unitdir}/varnish.service
 %{_unitdir}/varnishncsa.service
 
@@ -158,6 +161,9 @@ test -f /etc/varnish/secret || (uuidgen > /etc/varnish/secret && chmod 0600 /etc
 %{_mandir}/man7/*.7*
 
 %changelog
+* Sat Feb 17 2024 wangkai <13474090681@163.com> - 7.4.2-1
+- Update to 7.4.2 for fix CVE-2023-44487
+
 * Tue Dec 26 2023 weiyaping <weiyaping@xfusion.com> - 6.6.2-3
 - fix python syntax error in rpmbuild build report
 

varnish.yaml

@@ -0,0 +1,4 @@
+version_control: github
+src_repo: varnishcache/varnish-cache
+tag_prefix: ^varnish-
+seperator: .