Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ngtcp2 for openSUSE:Factory checked in at 2026-08-27 18:49:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ngtcp2 (Old) and /work/SRC/openSUSE:Factory/.ngtcp2.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ngtcp2" Thu Aug 27 18:49:47 2026 rev:20 rq:1373797 version:1.25.0 Changes: -------- --- /work/SRC/openSUSE:Factory/ngtcp2/ngtcp2.changes 2026-08-03 17:14:44.949406145 +0200 +++ /work/SRC/openSUSE:Factory/.ngtcp2.new.1265/ngtcp2.changes 2026-08-27 18:49:53.518477764 +0200 @@ -1,0 +2,21 @@ +Wed Aug 26 11:25:59 UTC 2026 - Martin Pluskal <[email protected]> + +- Require boringssl-devel >= 0.20260813 at build time: the previous + 0.20210430 snapshot lacks SSL_set_quic_early_data_context, so + configure rejected it with a misleading "boringssl was requested + but not found" failure instead of an unresolvable dependency + +------------------------------------------------------------------- +Wed Aug 26 07:18:25 UTC 2026 - Fridrich Strba <[email protected]> + +- Add ngtcp2-boringssl-shared.patch bulding the boringssl bridge + as shared library +- Enable building the boringssl bridge in Factory + +------------------------------------------------------------------- +Mon Aug 24 18:07:11 UTC 2026 - Fridrich Strba <[email protected]> + +- Add curl-impersonate.patch backporting backward compatible changes + used by curl-impersonate project + +------------------------------------------------------------------- New: ---- curl-impersonate.patch ngtcp2-boringssl-shared.patch ----------(New B)---------- New: - Add curl-impersonate.patch backporting backward compatible changes used by curl-impersonate project New: - Add ngtcp2-boringssl-shared.patch bulding the boringssl bridge as shared library ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ngtcp2.spec ++++++ --- /var/tmp/diff_new_pack.dkyFSP/_old 2026-08-27 18:49:54.565514212 +0200 +++ /var/tmp/diff_new_pack.dkyFSP/_new 2026-08-27 18:49:54.567514281 +0200 @@ -22,11 +22,16 @@ %global gnutls_sover 8 %global openssl_soname %{soname}_crypto_ossl %global openssl_sover 0 +%global boringssl_soname %{soname}_crypto_boringssl +%global boringssl_sover 0 %if 0%{?suse_version} >= 1699 %bcond_without openssl +%bcond_without boringssl %else # requires OpenSSL 3.x with QUIC support %bcond_with openssl +# build boringssl suport only in Factory +%bcond_with boringssl %endif %if 0%{?suse_version} && 0%{?suse_version} < 1600 %global force_gcc_version 14 @@ -41,10 +46,19 @@ Source1: https://github.com/ngtcp2/ngtcp2/releases/download/v%{version}/ngtcp2-%{version}.tar.xz.asc Source2: ngtcp2.keyring Source3: baselibs.conf +# https://github.com/lexiforest/curl-impersonate/raw/refs/tags/v2.1.1/patches/ngtcp2.patch +Patch0: curl-impersonate.patch +Patch1: ngtcp2-boringssl-shared.patch +BuildRequires: autoconf +BuildRequires: automake BuildRequires: gcc%{?force_gcc_version}-c++ +BuildRequires: libtool BuildRequires: pkgconfig BuildRequires: python-rpm-macros BuildRequires: pkgconfig(gnutls) >= 3.7.3 +%if %{with boringssl} +BuildRequires: boringssl-devel >= 0.20260813 +%endif %if %{with openssl} BuildRequires: pkgconfig(openssl) >= 1.1.1 %endif @@ -76,6 +90,14 @@ This package contains the crypto API of ngtcp2, which was built using OpenSSL as the cryptographic provider. +%package -n %{boringssl_soname}%{boringssl_sover} +Summary: The ngtcp2 crypto API with BoringSSL as a backend + +%description -n %{boringssl_soname}%{boringssl_sover} +ngtcp2 is an implementation of the QUIC protocol (RFC 9000). +This package contains the crypto API of ngtcp2, which was built using +BoringSSL as the cryptographic provider. + %package -n python3-ngtcp2 Summary: Python3 bindings for ngtcp2 @@ -109,6 +131,15 @@ OpenSSL as TLS backend development files for use with libngtcp2. QUIC protocol. +%package -n libngtcp2_crypto_boringssl-devel +Summary: BoringSSL Development files for ngtcp2 +Requires: %{boringssl_soname}%{boringssl_sover} = %{version} +Requires: boringssl-devel +Requires: libngtcp2-devel = %{version}-%{release} + +%description -n libngtcp2_crypto_boringssl-devel +BoringSSL as TLS backend development files for use with libngtcp2. + %prep %autosetup -n ngtcp2-%{version} -p1 @@ -119,6 +150,7 @@ %endif # --enable-lib-only skips the examples, so the example-only dependencies # (libnghttp3, libev) are never probed and must not be requested here. +autoreconf -fi %configure \ --disable-static \ --disable-silent-rules \ @@ -129,6 +161,14 @@ %else --without-openssl \ %endif +%if %{with boringssl} + --with-boringssl \ + BORINGSSL_CFLAGS="-I%{_includedir}/boringssl" \ + BORINGSSL_LIBS="-L%{_libdir} -lboringssl_ssl -lboringssl_crypto" \ + BORINGSSL_STDCXXLIB="-lstdc++" \ +%else + --without-boringssl \ +%endif --without-libev \ %{nil} %make_build all @@ -150,6 +190,7 @@ %ldconfig_scriptlets -n %{soname}-%{sover} %ldconfig_scriptlets -n %{gnutls_soname}%{gnutls_sover} %ldconfig_scriptlets -n %{openssl_soname}%{openssl_sover} +%ldconfig_scriptlets -n %{boringssl_soname}%{boringssl_sover} %files -n %{soname}-%{sover} %license COPYING @@ -165,6 +206,12 @@ %{_libdir}/%{openssl_soname}.so.%{openssl_sover}* %endif +%if %{with boringssl} +%files -n %{boringssl_soname}%{boringssl_sover} +%license COPYING +%{_libdir}/%{boringssl_soname}.so.%{boringssl_sover}* +%endif + %files devel %dir %{_includedir}/%{name}/ %{_includedir}/%{name}/ngtcp2.h @@ -185,3 +232,10 @@ %{_libdir}/pkgconfig/libngtcp2_crypto_ossl.pc %endif +%if %{with boringssl} +%files -n libngtcp2_crypto_boringssl-devel +%{_includedir}/%{name}/ngtcp2_crypto_boringssl.h +%{_libdir}/%{boringssl_soname}.so +%{_libdir}/pkgconfig/libngtcp2_crypto_boringssl.pc +%endif + ++++++ curl-impersonate.patch ++++++ --- a/export.sh 1970-01-01 01:00:00.000000000 +0100 +++ b/export.sh 2026-08-24 14:52:55.078427300 +0200 @@ -0,0 +1,10 @@ +#!/bin/bash + +# TODO: use cmake to generate mingw makefile, see: +# +# 1. https://github.com/curl/curl/pull/13244/files +# 2. https://everything.curl.dev/build/windows.html + +git df v1.20.0 > ngtcp2.patch +mv ngtcp2.patch ../curl-impersonate/patches/ngtcp2.patch + --- a/lib/includes/ngtcp2/ngtcp2.h 2026-08-24 14:52:28.535774953 +0200 +++ b/lib/includes/ngtcp2/ngtcp2.h 2026-08-24 14:52:55.079196506 +0200 @@ -1474,6 +1474,25 @@ /** * @struct * + * :type:`ngtcp2_transport_params_raw` represents the raw serialized + * QUIC transport parameters. + */ +typedef struct ngtcp2_transport_params_raw { + /** + * :member:`base` points to the beginning of serialized transport + * parameters. + */ + const uint8_t *base; + /** + * :member:`len` is the number of bytes pointed by + * :member:`base`. + */ + size_t len; +} ngtcp2_transport_params_raw; + +/** + * @struct + * * :type:`ngtcp2_transport_params` represents QUIC transport * parameters. */ @@ -4940,6 +4959,36 @@ /** * @function + * + * `ngtcp2_conn_set_local_transport_params_raw` sets pre-serialized + * local transport parameters. If this function succeeds, + * `ngtcp2_conn_encode_local_transport_params` returns exactly the + * serialized bytes specified by |params|. + * + * This function does not update local transport parameters returned + * by `ngtcp2_conn_get_local_transport_params`. + * + * This function must be called before + * `ngtcp2_conn_install_tx_handshake_key`. + * + * This function returns 0 if it succeeds, or one of the following + * negative error codes: + * + * :macro:`NGTCP2_ERR_INVALID_ARGUMENT` + * |params| is NULL, or |params->base| is NULL when + * |params->len| is not 0. + * :macro:`NGTCP2_ERR_INVALID_STATE` + * `ngtcp2_conn_install_tx_handshake_key` has been called. + * :macro:`NGTCP2_ERR_NOMEM` + * Out of memory. + * :macro:`NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM` + * The input is malformed. + */ +NGTCP2_EXTERN int ngtcp2_conn_set_local_transport_params_raw( + ngtcp2_conn *conn, const ngtcp2_transport_params_raw *params); + +/** + * @function * * .. warning:: * --- a/lib/ngtcp2_conn.c 2026-08-24 14:52:28.534729392 +0200 +++ b/lib/ngtcp2_conn.c 2026-08-24 14:52:55.081864399 +0200 @@ -1144,6 +1144,11 @@ p->version_info_present = 1; } +static void conn_clear_local_transport_params_raw(ngtcp2_conn *conn) { + ngtcp2_mem_free(conn->mem, (uint8_t *)conn->local.transport_params_raw.base); + conn->local.transport_params_raw = (ngtcp2_transport_params_raw){0}; +} + static void conn_update_skip_pkt(ngtcp2_conn *conn, ngtcp2_pktns *pktns) { const int64_t min_gap = 3; uint8_t r; @@ -1811,6 +1816,7 @@ ngtcp2_mem_free(conn->mem, conn->crypto.decrypt_buf.base); ngtcp2_mem_free(conn->mem, conn->crypto.decrypt_hp_buf.base); ngtcp2_mem_free(conn->mem, (uint8_t *)conn->local.settings.token); + ngtcp2_mem_free(conn->mem, (uint8_t *)conn->local.transport_params_raw.base); ngtcp2_crypto_km_del(conn->crypto.key_update.old_rx_ckm, conn->mem); ngtcp2_crypto_km_del(conn->crypto.key_update.new_rx_ckm, conn->mem); @@ -11942,11 +11948,51 @@ return NGTCP2_ERR_INVALID_STATE; } + conn_clear_local_transport_params_raw(conn); conn_set_local_transport_params(conn, params); return 0; } +int ngtcp2_conn_set_local_transport_params_raw( + ngtcp2_conn *conn, const ngtcp2_transport_params_raw *params) { + uint8_t *buf; + ngtcp2_transport_params paramsbuf; + int rv; + + if (params == NULL || (params->len && params->base == NULL)) { + return NGTCP2_ERR_INVALID_ARGUMENT; + } + + if (conn->hs_pktns == NULL || conn->hs_pktns->crypto.tx.ckm) { + return NGTCP2_ERR_INVALID_STATE; + } + + if (params->len == 0) { + conn_clear_local_transport_params_raw(conn); + return 0; + } + + rv = ngtcp2_transport_params_decode(¶msbuf, params->base, params->len); + if (rv != 0) { + return rv; + } + + buf = ngtcp2_mem_malloc(conn->mem, params->len); + if (buf == NULL) { + return NGTCP2_ERR_NOMEM; + } + + memcpy(buf, params->base, params->len); + + conn_clear_local_transport_params_raw(conn); + + conn->local.transport_params_raw.base = buf; + conn->local.transport_params_raw.len = params->len; + + return 0; +} + int ngtcp2_conn_commit_local_transport_params(ngtcp2_conn *conn) { const ngtcp2_mem *mem = conn->mem; ngtcp2_transport_params *params = &conn->local.transport_params; @@ -12013,6 +12059,16 @@ ngtcp2_ssize ngtcp2_conn_encode_local_transport_params2(const ngtcp2_conn *conn, uint8_t *dest, size_t destlen) { + if (conn->local.transport_params_raw.len) { + if (destlen < conn->local.transport_params_raw.len) { + return NGTCP2_ERR_NOBUF; + } + + memcpy(dest, conn->local.transport_params_raw.base, + conn->local.transport_params_raw.len); + return (ngtcp2_ssize)conn->local.transport_params_raw.len; + } + return ngtcp2_transport_params_encode(dest, destlen, &conn->local.transport_params); } --- a/lib/ngtcp2_conn.h 2026-08-24 14:52:28.533935115 +0200 +++ b/lib/ngtcp2_conn.h 2026-08-24 14:52:55.082724453 +0200 @@ -467,6 +467,9 @@ /* transport_params is the local transport parameters. It is used for Short packet only. */ ngtcp2_transport_params transport_params; + /* transport_params_raw contains serialized local transport + parameters, if they are specified. */ + ngtcp2_transport_params_raw transport_params_raw; struct { /* max_streams is the maximum number of bidirectional streams which the local endpoint can open. */ --- a/tests/ngtcp2_conn_test.c 2026-08-24 14:52:28.527989902 +0200 +++ b/tests/ngtcp2_conn_test.c 2026-08-24 14:52:55.084864420 +0200 @@ -97,6 +97,7 @@ munit_void_test(test_ngtcp2_conn_recv_version_negotiation), munit_void_test(test_ngtcp2_conn_send_initial_token), munit_void_test(test_ngtcp2_conn_set_remote_transport_params), + munit_void_test(test_ngtcp2_conn_set_local_transport_params_raw), munit_void_test(test_ngtcp2_conn_write_connection_close), munit_void_test(test_ngtcp2_conn_write_application_close), munit_void_test(test_ngtcp2_conn_rtb_reclaim_on_pto), @@ -13267,6 +13268,90 @@ ngtcp2_conn_del(conn); } + +void test_ngtcp2_conn_set_local_transport_params_raw(void) { + ngtcp2_conn *conn; + ngtcp2_transport_params params, decoded_params; + ngtcp2_transport_params_raw raw_params; + ngtcp2_crypto_aead_ctx aead_ctx = {0}; + ngtcp2_crypto_cipher_ctx hp_ctx = {0}; + uint8_t encoded[1024]; + uint8_t rawbuf[1024]; + uint8_t out[1024]; + uint8_t malformed[] = {0x01}; + uint8_t *p; + ngtcp2_ssize nwrite; + size_t rawlen; + int rv; + conn_options opts = {0}; + + conn_server_new(&conn, opts); + conn->local.transport_params.version_info.chosen_version = NGTCP2_PROTO_VER_V1; + + server_default_transport_params(¶ms); + params.original_dcid = conn->rcid; + + nwrite = ngtcp2_transport_params_encode(encoded, sizeof(encoded), ¶ms); + assert_ptrdiff(0, <, nwrite); + + p = rawbuf; + p = ngtcp2_put_uvarint(p, 0x173e); + p = ngtcp2_put_uvarint(p, 0); + + memcpy(p, encoded, (size_t)nwrite); + p += (size_t)nwrite; + rawlen = (size_t)(p - rawbuf); + + raw_params = (ngtcp2_transport_params_raw){ + .base = rawbuf, + .len = rawlen, + }; + + rv = ngtcp2_conn_set_local_transport_params_raw(conn, &raw_params); + assert_int(0, ==, rv); + + nwrite = ngtcp2_conn_encode_local_transport_params(conn, out, sizeof(out)); + assert_ptrdiff((ngtcp2_ssize)rawlen, ==, nwrite); + assert_memory_equal(rawlen, rawbuf, out); + + params.initial_max_data += 1000; + rv = ngtcp2_conn_set_local_transport_params(conn, ¶ms); + assert_int(0, ==, rv); + + nwrite = ngtcp2_conn_encode_local_transport_params(conn, out, sizeof(out)); + assert_ptrdiff(0, <, nwrite); + + rv = ngtcp2_transport_params_decode(&decoded_params, out, (size_t)nwrite); + assert_int(0, ==, rv); + assert_uint64(params.initial_max_data, ==, decoded_params.initial_max_data); + + raw_params = (ngtcp2_transport_params_raw){ + .base = NULL, + .len = sizeof(malformed), + }; + rv = ngtcp2_conn_set_local_transport_params_raw(conn, &raw_params); + assert_int(NGTCP2_ERR_INVALID_ARGUMENT, ==, rv); + + raw_params = (ngtcp2_transport_params_raw){ + .base = malformed, + .len = sizeof(malformed), + }; + rv = ngtcp2_conn_set_local_transport_params_raw(conn, &raw_params); + assert_int(NGTCP2_ERR_MALFORMED_TRANSPORT_PARAM, ==, rv); + + rv = ngtcp2_conn_install_tx_handshake_key(conn, &aead_ctx, null_iv, + sizeof(null_iv), &hp_ctx); + assert_int(0, ==, rv); + + raw_params = (ngtcp2_transport_params_raw){ + .base = rawbuf, + .len = rawlen, + }; + rv = ngtcp2_conn_set_local_transport_params_raw(conn, &raw_params); + assert_int(NGTCP2_ERR_INVALID_STATE, ==, rv); + + ngtcp2_conn_del(conn); +} void test_ngtcp2_conn_write_connection_close(void) { ngtcp2_conn *conn; --- a/tests/ngtcp2_conn_test.h 2026-08-24 14:52:28.529036841 +0200 +++ b/tests/ngtcp2_conn_test.h 2026-08-24 14:52:55.086088732 +0200 @@ -91,6 +91,7 @@ munit_void_test_decl(test_ngtcp2_conn_recv_version_negotiation) munit_void_test_decl(test_ngtcp2_conn_send_initial_token) munit_void_test_decl(test_ngtcp2_conn_set_remote_transport_params) +munit_void_test_decl(test_ngtcp2_conn_set_local_transport_params_raw) munit_void_test_decl(test_ngtcp2_conn_write_connection_close) munit_void_test_decl(test_ngtcp2_conn_write_application_close) munit_void_test_decl(test_ngtcp2_conn_rtb_reclaim_on_pto) ++++++ ngtcp2-boringssl-shared.patch ++++++ --- a/configure.ac 2026-08-26 09:25:34.712811719 +0200 +++ b/configure.ac 2026-08-26 09:27:18.429345003 +0200 @@ -65,6 +65,10 @@ AC_SUBST(CRYPTO_OSSL_LT_REVISION, 1) AC_SUBST(CRYPTO_OSSL_LT_AGE, 3) +AC_SUBST(CRYPTO_BORINGSSL_LT_CURRENT, 0) +AC_SUBST(CRYPTO_BORINGSSL_LT_REVISION, 0) +AC_SUBST(CRYPTO_BORINGSSL_LT_AGE, 0) + # from nghttp2 major=`echo $PACKAGE_VERSION |cut -d. -f1 | sed -e "s/[^0-9]//g"` minor=`echo $PACKAGE_VERSION |cut -d. -f2 | sed -e "s/[^0-9]//g"` --- a/crypto/boringssl/Makefile.am 2026-08-26 09:25:34.707471566 +0200 +++ b/crypto/boringssl/Makefile.am 2026-08-26 09:28:38.517920390 +0200 @@ -34,9 +34,14 @@ pkgconfig_DATA = libngtcp2_crypto_boringssl.pc DISTCLEANFILES = $(pkgconfig_DATA) -lib_LIBRARIES = libngtcp2_crypto_boringssl.a +lib_LTLIBRARIES = libngtcp2_crypto_boringssl.la -libngtcp2_crypto_boringssl_a_SOURCES = boringssl.c ../shared.c ../shared.h +libngtcp2_crypto_boringssl_la_SOURCES = boringssl.c ../shared.c ../shared.h +libngtcp2_crypto_boringssl_la_LDFLAGS = -no-undefined \ + -version-info $(CRYPTO_BORINGSSL_LT_CURRENT):$(CRYPTO_BORINGSSL_LT_REVISION):$(CRYPTO_BORINGSSL_LT_AGE) +libngtcp2_crypto_boringssl_la_LIBADD = \ + $(top_builddir)/lib/libngtcp2.la \ + @BORINGSSL_LIBS@ if HAVE_CRYPTOTEST if HAVE_BORINGSSL_STDCXXLIB @@ -48,7 +53,7 @@ $(top_srcdir)/tests/munit/munit.c $(top_srcdir)/tests/munit/munit.h cryptotest_CPPFLAGS = ${AM_CPPFLAGS} -I$(top_srcdir)/tests/munit cryptotest_LDADD = \ - libngtcp2_crypto_boringssl.a \ + libngtcp2_crypto_boringssl.la \ $(top_builddir)/lib/libngtcp2.la \ @BORINGSSL_LIBS@ \ @BORINGSSL_STDCXXLIB@
