cmcfarlen opened a new pull request, #13803: URL: https://github.com/apache/trafficserver/pull/13803
Cherry-picks for the 10.2.1 release, from the `For v10.2.1` column of the [ATS v10.2.x project](https://github.com/orgs/apache/projects/573), plus two prerequisites agreed with the RM (see below). 20 commits, in master merge order except where a prerequisite is placed next to its dependent: | # | PR | master SHA | Note | |---|---|---|---| | 1 | #13762 | `3952b186` | Python 3.15: PyYAML without CLoader — *partial* | | 2 | #13761 | `fe7cfc94` | OpenSSL 4 handshake buffer exhaustion | | 3 | #13760 | `dafd12c6` | OpenSSL 4 certificate accessors in WASM | | 4 | #13695 | `7e256037` | HTTP flow control policy reload — *autest conversion* | | 5 | #13759 | `527edda8` | Remove unused globals rejected by Clang 23 | | 6 | #13766 | `959daa1d` | Harden shutdown against repeated exit signals | | 7 | #13782 | `972a0f47` | Bodyless HTTP/2 origin responses over 4 KB | | 8 | **#13351** | `edb8476a` | **prerequisite** — H2 1xx interim responses — *autest conversion* | | 9 | #13447 | `a31be25a` | H2-to-origin session pool and reliability — *autest conversion* | | 10 | #13776 | `5e62b2b0` | compress: weak ETags for compressed responses | | 11 | #13783 | `1de91c74` | Drain an H2 origin session after GOAWAY | | 12 | #13723 | `289f48e1` | tests: drive tls_sni_groups with openssl s_client | | 13 | #13780 | `00a22f20` | Deliver H2 END_STREAM while read is throttled | | 14 | #13729 | `1a7dbe8e` | Honor TLS handshake hook pauses on BoringSSL | | 15 | #13763 | `3266bd08` | Frame empty TLS origin responses — *partial* | | 16 | #13674 | `04008efa` | hrw4u: sandbox policy on value functions | | 17 | #13767 | `2b65f92e` | cache: keep stripe locked after shutdown dir sync | | 18 | **#13559** | `71fa1dbb` | **prerequisite** — compile-time well-known-string table | | 19 | #13376 | `ff6ddf83` | Reduce repeated work in HTTP header parsing | | 20 | #13739 | `a655c6ac` | hrw4u: report each sandbox warning at its trigger | All are `MERGED`, `base=master`, single-parent squash merges, none already present on 10.2.x (checked by both `(#NNN)` subject and the `cherry picked from` trailer). ### Two prerequisites, added deliberately Neither was in the project; both were approved by the RM after the entanglement was found. - **#13351** (H2 1xx interim responses) — without it, #13447's conflicts land in `rcv_continuation_frame`'s CONTINUATION/stream-state logic, because #13351 introduced the `is_outbound_connection()` / `trailing_header_is_possible()` structure that #13447 then edits. With it, #13447 applies with **zero** source conflicts and its patch to both `Http2ConnectionState.cc` and `HttpSM.cc` is **byte-identical** to the master original. - **#13559** (compile-time WKS table) — removed `hdrtoken_tokenize_dfa` and restructured the well-known-string table that #13376 explicitly reuses. Without it, #13376 conflicts across `HdrToken.h`, `HdrToken.cc` and `MIME.cc`. With it, only two trivial resolutions remain (below) and #13376's stat matches master exactly. ### Conflicts and adaptations Every deviation from the master originals is one of these, and nothing else — each picked commit's `--stat` was diffed against its original and all remaining deltas are accounted for: - **AuTest harness** — 10.2.x registers `ssl_multicert.config`; master registers `ssl_multicert.yaml`. **Eight** new tests across #13695, #13351 and #13447 used the YAML form; each converted to the flat form and folded into its own commit via `--fixup` + `--autosquash`. - **Master-only `remap_yaml/`** — 10.2.x has no remap.yaml feature. #13762 and #13763 each carry a duplicated `remap_yaml/` copy of a change they also make under `remap/`; only the `remap/` side was applied. - **Drag-in from unpicked PRs** — resolved to add only what each commit really changes: `serial_tests.txt` (#13447 adds just the `h2_to_origin_safe_retry` entry; the abuse_shield block is master-only context), `tools/benchmark/CMakeLists.txt` (#13376 adds only `benchmark_HdrParse`; `benchmark_ascii_tolower` is master-only), and one `MIME.cc` hunk (#13376 adds only `name_scan_stale = true`; the malformed-line-ending condition beside it is master-only). ### Not picked - **#13764** (Wait for GOAWAY processing in the abuse shield AuTest) — **not applicable.** It patches only `tests/gold_tests/pluginTest/abuse_shield/h2_session_errors.py`, and the abuse_shield plugin (#13586) is not on 10.2.x. Left at `For v10.2.1` for the RM. - **#12825, #13086, #13196** — still OPEN on master. ### Local verification (macOS, `dev` preset, experimental + JA4/JAX enabled) - `cmake --build build-dev -- -k 0` — clean, with build checkpoints taken mid-batch. - `ctest -j4` — 128/129; only `test_jsonrpcserver` fails, the known macOS-local unix-socket/restart timing flake. - Directly affected suites pass: `test_proxy_hdrs`, `test_proxy_hdrs_xpack`, `test_http2`, `test_proxy`, `test_ja4`, `test_jax`. - Doc cross-reference sweep: the only targets the batch adds are `http2.flow_control.policy_in`/`policy_out`, both of which already exist on 10.2.x. - The converted AuTests are not run by this preset on macOS — this CI run is their gate. Draft on purpose: to be landed by fast-forward once CI is green, not merged via the UI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
