[packages/postgresql/POSTGRESQL_8_3] Fix build with GCC 15 / OpenSSL 3 / OpenLDAP 2.6, make TLS 1.2-1.3 work
arekm
arekm at pld-linux.org
Fri Aug 7 13:57:41 CEST 2026
commit 78db924617b60a0cffaf7faa0543a4581c813c70
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Fri Aug 7 13:46:12 2026 +0200
Fix build with GCC 15 / OpenSSL 3 / OpenLDAP 2.6, make TLS 1.2-1.3 work
postgresql-flexible-array-member.patch | 66 ++++++
postgresql-format-security.patch | 62 ++++++
postgresql-openldap26.patch | 17 ++
postgresql-openssl3.patch | 396 +++++++++++++++++++++++++++++++++
postgresql-tests-tzdata.patch | 234 +++++++++++++++++++
postgresql.spec | 31 ++-
6 files changed, 795 insertions(+), 11 deletions(-)
---
diff --git a/postgresql.spec b/postgresql.spec
index 185e140..3a2c41b 100644
--- a/postgresql.spec
+++ b/postgresql.spec
@@ -21,7 +21,7 @@ Summary(uk.UTF-8): PostgreSQL - система керування базами
Summary(zh_CN.UTF-8): PostgreSQL 客户端程序和库文件
Name: postgresql
Version: 8.3.23
-Release: 1
+Release: 2
License: BSD
Group: Applications/Databases
Source0: https://ftp.postgresql.org/pub/source/v%{version}/%{name}-%{version}.tar.bz2
@@ -36,6 +36,11 @@ Patch2: %{name}-ecpg-includedir.patch
Patch3: %{name}-ac_version.patch
Patch4: %{name}-disable_horology_test.patch
Patch5: %{name}-pg_ctl-fix.patch
+Patch6: %{name}-openssl3.patch
+Patch7: %{name}-flexible-array-member.patch
+Patch8: %{name}-format-security.patch
+Patch9: %{name}-tests-tzdata.patch
+Patch10: %{name}-openldap26.patch
URL: http://www.postgresql.org/
BuildRequires: autoconf
BuildRequires: automake
@@ -76,8 +81,6 @@ Obsoletes: postgresql-server
Obsoletes: postgresql-test
BuildRoot: %{tmpdir}/%{name}-%{version}-root-%(id -u -n)
-%define filterout_c -Werror=format-security
-
%define _pgmoduledir %{_libdir}/postgresql
%define _pgsqldir %{_datadir}/postgresql/contrib
@@ -755,12 +758,17 @@ Różne moduły dołączone do PostgreSQL-a.
%prep
%setup -q
-%patch0 -p1
-%{?with_absolute_dbpaths:%patch1 -p1}
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
+%patch -P0 -p1
+%{?with_absolute_dbpaths:%patch -P1 -p1}
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+%patch -P8 -p1
+%patch -P9 -p1
+%patch -P10 -p1
tar xzf doc/man*.tar.gz
@@ -777,7 +785,8 @@ find src -name \*.l -o -name \*.y | xargs touch
%{__aclocal} -I config
%{__autoconf}
%configure \
- CFLAGS="%{rpmcflags} -DNEED_REENTRANT_FUNCS" \
+ CFLAGS="%{rpmcflags} -std=gnu89 -DNEED_REENTRANT_FUNCS" \
+ %{?with_python:PYTHON=%{__python}} \
--disable-rpath \
--enable-depend \
--enable-integer-datetimes \
@@ -799,7 +808,7 @@ find src -name \*.l -o -name \*.y | xargs touch
%{__make}
for mod in %{contrib_modules}; do \
- flags="%{rpmcflags} -DNEED_REENTRANT_FUNCS"
+ flags="%{rpmcflags} -std=gnu89 -DNEED_REENTRANT_FUNCS"
if [ $mod = xml2 ]; then flags="$flags -I/usr/include/libxml2"; fi
%{__make} -C contrib/$mod CFLAGS="$flags"
done
diff --git a/postgresql-flexible-array-member.patch b/postgresql-flexible-array-member.patch
new file mode 100644
index 0000000..b1c12f8
--- /dev/null
+++ b/postgresql-flexible-array-member.patch
@@ -0,0 +1,66 @@
+--- postgresql-8.3.23.org/src/include/c.h 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/include/c.h 2026-08-07 13:24:23.506349420 +0200
+@@ -426,6 +426,13 @@ typedef struct varlena BpChar; /* blank-
+ typedef struct varlena VarChar; /* var-length char, ie SQL varchar(n) */
+
+ /*
++ * A trailing [1] is still bounded by the enclosing struct once the type is
++ * embedded in one (as these are, in the catalog structs), so the compiler may
++ * drop accesses past element 0. A real flexible array member is not bounded.
++ */
++#define FLEXIBLE_ARRAY_MEMBER /* empty */
++
++/*
+ * Specialized array types. These are physically laid out just the same
+ * as regular arrays (so that the regular array subscripting code works
+ * with them). They exist as distinct types mostly for historical reasons:
+@@ -443,7 +450,7 @@ typedef struct
+ Oid elemtype;
+ int dim1;
+ int lbound1;
+- int2 values[1]; /* VARIABLE LENGTH ARRAY */
++ int2 values[FLEXIBLE_ARRAY_MEMBER];
+ } int2vector; /* VARIABLE LENGTH STRUCT */
+
+ typedef struct
+@@ -454,7 +461,7 @@ typedef struct
+ Oid elemtype;
+ int dim1;
+ int lbound1;
+- Oid values[1]; /* VARIABLE LENGTH ARRAY */
++ Oid values[FLEXIBLE_ARRAY_MEMBER];
+ } oidvector; /* VARIABLE LENGTH STRUCT */
+
+ /*
+--- postgresql-8.3.23.org/src/backend/utils/cache/relcache.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/backend/utils/cache/relcache.c 2026-08-07 13:15:15.356349731 +0200
+@@ -3083,16 +3083,28 @@ RelationGetIndexList(Relation relation)
+ while (HeapTupleIsValid(htup = systable_getnext(indscan)))
+ {
+ Form_pg_index index = (Form_pg_index) GETSTRUCT(htup);
++ Datum indclassDatum;
++ oidvector *indclass;
++ bool isnull;
+
+ /* Add index's OID to result list in the proper order */
+ result = insert_ordered_oid(result, index->indexrelid);
+
++ /*
++ * indclass cannot be referenced directly through the C struct,
++ * because it comes after the variable-width indkey field.
++ */
++ indclassDatum = heap_getattr(htup, Anum_pg_index_indclass,
++ GetPgIndexDescriptor(), &isnull);
++ Assert(!isnull);
++ indclass = (oidvector *) DatumGetPointer(indclassDatum);
++
+ /* Check to see if it is a unique, non-partial btree index on OID */
+ if (IndexIsValid(index) &&
+ index->indnatts == 1 &&
+ index->indisunique &&
+ index->indkey.values[0] == ObjectIdAttributeNumber &&
+- index->indclass.values[0] == OID_BTREE_OPS_OID &&
++ indclass->values[0] == OID_BTREE_OPS_OID &&
+ heap_attisnull(htup, Anum_pg_index_indpred))
+ oidIndex = index->indexrelid;
+ }
diff --git a/postgresql-format-security.patch b/postgresql-format-security.patch
new file mode 100644
index 0000000..ac201c9
--- /dev/null
+++ b/postgresql-format-security.patch
@@ -0,0 +1,62 @@
+--- postgresql-8.3.23.org/src/backend/commands/trigger.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/backend/commands/trigger.c 2026-08-07 13:20:15.439913579 +0200
+@@ -604,7 +604,7 @@ ConvertTriggerToFK(CreateTrigStmt *stmt,
+ ereport(NOTICE,
+ (errmsg("ignoring incomplete trigger group for constraint \"%s\" %s",
+ constr_name, buf.data),
+- errdetail(funcdescr[funcnum])));
++ errdetail("%s", _(funcdescr[funcnum]))));
+ oldContext = MemoryContextSwitchTo(TopMemoryContext);
+ info = (OldTriggerInfo *) palloc0(sizeof(OldTriggerInfo));
+ info->args = copyObject(stmt->args);
+@@ -620,7 +620,7 @@ ConvertTriggerToFK(CreateTrigStmt *stmt,
+ ereport(NOTICE,
+ (errmsg("ignoring incomplete trigger group for constraint \"%s\" %s",
+ constr_name, buf.data),
+- errdetail(funcdescr[funcnum])));
++ errdetail("%s", _(funcdescr[funcnum]))));
+ }
+ else
+ {
+@@ -632,7 +632,7 @@ ConvertTriggerToFK(CreateTrigStmt *stmt,
+ ereport(NOTICE,
+ (errmsg("converting trigger group into constraint \"%s\" %s",
+ constr_name, buf.data),
+- errdetail(funcdescr[funcnum])));
++ errdetail("%s", _(funcdescr[funcnum]))));
+ if (funcnum == 2)
+ {
+ /* This trigger is on the FK table */
+--- postgresql-8.3.23.org/src/backend/tcop/utility.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/backend/tcop/utility.c 2026-08-07 13:20:57.268351236 +0200
+@@ -129,7 +129,7 @@ DropErrorMsgWrongType(char *relname, cha
+ ereport(ERROR,
+ (errcode(ERRCODE_WRONG_OBJECT_TYPE),
+ errmsg(rentry->nota_msg, relname),
+- (wentry->kind != '\0') ? errhint(wentry->drophint_msg) : 0));
++ (wentry->kind != '\0') ? errhint("%s", _(wentry->drophint_msg)) : 0));
+ }
+
+ /*
+--- postgresql-8.3.23.org/src/bin/psql/describe.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/bin/psql/describe.c 2026-08-07 13:22:10.438273289 +0200
+@@ -1291,7 +1291,7 @@ describeOneTableDetails(const char *sche
+ footers, &count_footers, tmpbuf, false))
+ {
+ appendPQExpBuffer(&buf, ", ");
+- appendPQExpBuffer(&buf, tmpbuf.data);
++ appendPQExpBufferStr(&buf, tmpbuf.data);
+
+ count_footers -= 2;
+ }
+--- postgresql-8.3.23.org/src/backend/utils/misc/guc.c
++++ postgresql-8.3.23/src/backend/utils/misc/guc.c
+@@ -4489,7 +4489,7 @@ set_config_option(const char *name, cons
+ (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
+ errmsg("invalid value for parameter \"%s\": \"%s\"",
+ name, value),
+- hintmsg ? errhint(hintmsg) : 0));
++ hintmsg ? errhint("%s", _(hintmsg)) : 0));
+ return false;
+ }
+ if (newval < conf->min || newval > conf->max)
diff --git a/postgresql-openldap26.patch b/postgresql-openldap26.patch
new file mode 100644
index 0000000..de11838
--- /dev/null
+++ b/postgresql-openldap26.patch
@@ -0,0 +1,17 @@
+--- postgresql-8.3.23.org/configure.in 2026-08-07 13:17:13.879699632 +0200
++++ postgresql-8.3.23/configure.in 2026-08-07 13:29:14.119682554 +0200
+@@ -1272,10 +1272,11 @@ if test "$with_ldap" = yes ; then
+ LDAP_LIBS_BE="-lldap $EXTRA_LDAP_LIBS"
+ if test "$enable_thread_safety" = yes; then
+ # on some platforms ldap_r fails to link without PTHREAD_LIBS
+- AC_CHECK_LIB(ldap_r, ldap_simple_bind, [],
+- [AC_MSG_ERROR([library 'ldap_r' is required for LDAP])],
++ # OpenLDAP 2.5 and later have no libldap_r; libldap is thread-safe there
++ AC_CHECK_LIB(ldap_r, ldap_simple_bind,
++ [LDAP_LIBS_FE="-lldap_r $EXTRA_LDAP_LIBS"],
++ [LDAP_LIBS_FE="-lldap $EXTRA_LDAP_LIBS"],
+ [$PTHREAD_CFLAGS $PTHREAD_LIBS $EXTRA_LDAP_LIBS])
+- LDAP_LIBS_FE="-lldap_r $EXTRA_LDAP_LIBS"
+ else
+ LDAP_LIBS_FE="-lldap $EXTRA_LDAP_LIBS"
+ fi
diff --git a/postgresql-openssl3.patch b/postgresql-openssl3.patch
new file mode 100644
index 0000000..ee7558f
--- /dev/null
+++ b/postgresql-openssl3.patch
@@ -0,0 +1,396 @@
+--- postgresql-8.3.23.org/configure.in 2026-08-07 13:17:13.879699632 +0200
++++ postgresql-8.3.23/configure.in 2026-08-07 13:29:14.119682554 +0200
+@@ -781,7 +781,7 @@ if test "$with_openssl" = yes ; then
+ dnl Order matters!
+ if test "$PORTNAME" != "win32"; then
+ AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, [], [AC_MSG_ERROR([library 'crypto' is required for OpenSSL])])
+- AC_CHECK_LIB(ssl, SSL_library_init, [], [AC_MSG_ERROR([library 'ssl' is required for OpenSSL])])
++ AC_CHECK_LIB(ssl, SSL_new, [], [AC_MSG_ERROR([library 'ssl' is required for OpenSSL])])
+ else
+ AC_CHECK_LIB(eay32, CRYPTO_new_ex_data, [], [AC_MSG_ERROR([library 'eay32' is required for OpenSSL])])
+ AC_CHECK_LIB(ssleay32, SSL_library_init, [], [AC_MSG_ERROR([library 'ssleay32' is required for OpenSSL])])
+--- postgresql-8.3.23.org/src/backend/libpq/be-secure.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/backend/libpq/be-secure.c 2026-08-07 13:03:36.433016920 +0200
+@@ -128,6 +128,9 @@ static const char *SSLerrmessage(void);
+ int ssl_renegotiation_limit;
+
+ #ifdef USE_SSL
++/* are we in the middle of a renegotiation? */
++static bool in_ssl_renegotiation = false;
++
+ static SSL_CTX *SSL_context = NULL;
+
+ /* GUC variable controlling SSL cipher list */
+@@ -339,29 +342,55 @@ secure_write(Port *port, void *ptr, size
+ {
+ int err;
+
+- if (ssl_renegotiation_limit && port->count > ssl_renegotiation_limit * 1024L)
++ /*
++ * If SSL renegotiations are enabled and we're getting close to the
++ * limit, start one now; but avoid it if there's one already in
++ * progress. Request the renegotiation 1kB before the limit has
++ * actually expired.
++ */
++ if (ssl_renegotiation_limit && !in_ssl_renegotiation &&
++ port->count > (ssl_renegotiation_limit - 1) * 1024L)
+ {
++ in_ssl_renegotiation = true;
++
++ /*
++ * The way we determine that a renegotiation has completed is by
++ * observing OpenSSL's internal renegotiation counter. Make sure
++ * we start out at zero, and assume that the renegotiation is
++ * complete when the counter advances.
++ *
++ * OpenSSL provides SSL_renegotiation_pending(), but this doesn't
++ * seem to work in testing.
++ */
++ SSL_clear_num_renegotiations(port->ssl);
++
+ SSL_set_session_id_context(port->ssl, (void *) &SSL_context,
+ sizeof(SSL_context));
+ if (SSL_renegotiate(port->ssl) <= 0)
+ ereport(COMMERROR,
+ (errcode(ERRCODE_PROTOCOL_VIOLATION),
+- errmsg("SSL renegotiation failure")));
+- if (SSL_do_handshake(port->ssl) <= 0)
+- ereport(COMMERROR,
+- (errcode(ERRCODE_PROTOCOL_VIOLATION),
+- errmsg("SSL renegotiation failure")));
+- if (port->ssl->state != SSL_ST_OK)
+- ereport(COMMERROR,
+- (errcode(ERRCODE_PROTOCOL_VIOLATION),
+- errmsg("SSL failed to send renegotiation request")));
+- port->ssl->state |= SSL_ST_ACCEPT;
+- SSL_do_handshake(port->ssl);
+- if (port->ssl->state != SSL_ST_OK)
+- ereport(COMMERROR,
+- (errcode(ERRCODE_PROTOCOL_VIOLATION),
+- errmsg("SSL renegotiation failure")));
+- port->count = 0;
++ errmsg("SSL failure during renegotiation start")));
++ else
++ {
++ int retries;
++
++ /*
++ * A handshake can fail, so be prepared to retry it, but only
++ * a few times.
++ */
++ for (retries = 0;; retries++)
++ {
++ if (SSL_do_handshake(port->ssl) > 0)
++ break; /* done */
++ ereport(COMMERROR,
++ (errcode(ERRCODE_PROTOCOL_VIOLATION),
++ errmsg("SSL handshake failure on renegotiation, retrying")));
++ if (retries >= 20)
++ ereport(FATAL,
++ (errcode(ERRCODE_PROTOCOL_VIOLATION),
++ errmsg("could not complete SSL handshake on renegotiation, too many failures")));
++ }
++ }
+ }
+
+ wloop:
+@@ -407,6 +436,28 @@ wloop:
+ n = -1;
+ break;
+ }
++
++ if (n >= 0)
++ {
++ /* is renegotiation complete? */
++ if (in_ssl_renegotiation &&
++ SSL_num_renegotiations(port->ssl) >= 1)
++ {
++ in_ssl_renegotiation = false;
++ port->count = 0;
++ }
++
++ /*
++ * if renegotiation is still ongoing, and we've gone beyond the
++ * limit, kill the connection now -- continuing to use it can be
++ * considered a security problem.
++ */
++ if (in_ssl_renegotiation &&
++ port->count > ssl_renegotiation_limit * 1024L)
++ ereport(FATAL,
++ (errcode(ERRCODE_PROTOCOL_VIOLATION),
++ errmsg("SSL failed to renegotiate connection before limit expired")));
++ }
+ }
+ else
+ #endif
+@@ -421,48 +472,91 @@ wloop:
+ #ifdef USE_SSL
+
+ /*
+- * Private substitute BIO: this wraps the SSL library's standard socket BIO
+- * so that we can enable and disable interrupts just while calling recv().
+- * We cannot have interrupts occurring while the bulk of openssl runs,
+- * because it uses malloc() and possibly other non-reentrant libc facilities.
++ * Private substitute BIO: this does the sending and receiving using send() and
++ * recv() instead, so that we can enable and disable interrupts just while
++ * calling recv(). We cannot have interrupts occurring while the bulk of
++ * openssl runs, because it uses malloc() and possibly other non-reentrant libc
++ * facilities.
+ *
+- * As of openssl 0.9.7, we can use the reasonably clean method of interposing
+- * a wrapper around the standard socket BIO's sock_read() method. This relies
+- * on the fact that sock_read() doesn't call anything non-reentrant, in fact
+- * not much of anything at all except recv(). If this ever changes we'd
+- * probably need to duplicate the code of sock_read() in order to push the
+- * interrupt enable/disable down yet another level.
++ * These functions are closely modelled on the standard socket BIO in OpenSSL;
++ * see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
+ */
+
+-static bool my_bio_initialized = false;
+-static BIO_METHOD my_bio_methods;
+-static int (*std_sock_read) (BIO *h, char *buf, int size);
++static BIO_METHOD *my_bio_methods = NULL;
+
+ static int
+ my_sock_read(BIO *h, char *buf, int size)
+ {
+- int res;
++ int res = 0;
+
+ prepare_for_client_read();
+
+- res = std_sock_read(h, buf, size);
++ if (buf != NULL)
++ {
++ res = recv(BIO_get_fd(h, NULL), buf, size, 0);
++ BIO_clear_retry_flags(h);
++ if (res <= 0)
++ {
++ /* If we were interrupted, tell caller to retry */
++ if (errno == EINTR)
++ {
++ BIO_set_retry_read(h);
++ }
++ }
++ }
+
+ client_read_ended();
+
+ return res;
+ }
+
++static int
++my_sock_write(BIO *h, const char *buf, int size)
++{
++ int res = 0;
++
++ res = send(BIO_get_fd(h, NULL), buf, size, 0);
++ BIO_clear_retry_flags(h);
++ if (res <= 0)
++ {
++ if (errno == EINTR)
++ {
++ BIO_set_retry_write(h);
++ }
++ }
++
++ return res;
++}
++
+ static BIO_METHOD *
+ my_BIO_s_socket(void)
+ {
+- if (!my_bio_initialized)
++ if (!my_bio_methods)
+ {
+- memcpy(&my_bio_methods, BIO_s_socket(), sizeof(BIO_METHOD));
+- std_sock_read = my_bio_methods.bread;
+- my_bio_methods.bread = my_sock_read;
+- my_bio_initialized = true;
++ const BIO_METHOD *biom = BIO_s_socket();
++ int my_bio_index;
++
++ my_bio_index = BIO_get_new_index();
++ if (my_bio_index == -1)
++ return NULL;
++ my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
++ if (!my_bio_methods)
++ return NULL;
++ if (!BIO_meth_set_write(my_bio_methods, my_sock_write) ||
++ !BIO_meth_set_read(my_bio_methods, my_sock_read) ||
++ !BIO_meth_set_gets(my_bio_methods, BIO_meth_get_gets(biom)) ||
++ !BIO_meth_set_puts(my_bio_methods, BIO_meth_get_puts(biom)) ||
++ !BIO_meth_set_ctrl(my_bio_methods, BIO_meth_get_ctrl(biom)) ||
++ !BIO_meth_set_create(my_bio_methods, BIO_meth_get_create(biom)) ||
++ !BIO_meth_set_destroy(my_bio_methods, BIO_meth_get_destroy(biom)) ||
++ !BIO_meth_set_callback_ctrl(my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
++ {
++ BIO_meth_free(my_bio_methods);
++ my_bio_methods = NULL;
++ return NULL;
++ }
+ }
+- return &my_bio_methods;
++ return my_bio_methods;
+ }
+
+ /* This should exactly match openssl's SSL_set_fd except for using my BIO */
+@@ -470,15 +564,16 @@ static int
+ my_SSL_set_fd(SSL *s, int fd)
+ {
+ int ret = 0;
+- BIO *bio = NULL;
++ BIO *bio;
++ BIO_METHOD *bio_method;
+
+- bio = BIO_new(my_BIO_s_socket());
++ bio_method = my_BIO_s_socket();
++ if (bio_method == NULL)
++ goto err;
++ bio = BIO_new(bio_method);
+
+ if (bio == NULL)
+- {
+- SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
+ goto err;
+- }
+ BIO_set_fd(bio, fd, BIO_NOCLOSE);
+ SSL_set_bio(s, bio, bio);
+ ret = 1;
+@@ -721,7 +816,7 @@ initialize_SSL(void)
+ #endif
+ SSL_library_init();
+ SSL_load_error_strings();
+- SSL_context = SSL_CTX_new(SSLv23_method());
++ SSL_context = SSL_CTX_new(TLS_method());
+ if (!SSL_context)
+ ereport(FATAL,
+ (errmsg("could not create SSL context: %s",
+--- postgresql-8.3.23.org/src/interfaces/libpq/fe-secure.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/interfaces/libpq/fe-secure.c 2026-08-07 13:03:32.396350259 +0200
+@@ -1035,7 +1035,7 @@ init_ssl_system(PGconn *conn)
+ SSL_library_init();
+ SSL_load_error_strings();
+ }
+- SSL_context = SSL_CTX_new(TLSv1_method());
++ SSL_context = SSL_CTX_new(TLS_method());
+ if (!SSL_context)
+ {
+ char *err = SSLerrmessage();
+@@ -1050,6 +1050,9 @@ init_ssl_system(PGconn *conn)
+ return -1;
+ }
+
++ /* Disable old protocol versions */
++ SSL_CTX_set_options(SSL_context, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
++
+ /*
+ * Disable OpenSSL's moving-write-buffer sanity check, because it
+ * causes unnecessary failures in nonblocking send cases.
+--- postgresql-8.3.23.org/contrib/pgcrypto/openssl.c 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/contrib/pgcrypto/openssl.c 2026-08-07 13:04:29.264965533 +0200
+@@ -202,7 +202,7 @@ compat_find_digest(const char *name, PX_
+ typedef struct OSSLDigest
+ {
+ const EVP_MD *algo;
+- EVP_MD_CTX ctx;
++ EVP_MD_CTX *ctx;
+ } OSSLDigest;
+
+ static unsigned
+@@ -210,7 +210,7 @@ digest_result_size(PX_MD * h)
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- return EVP_MD_CTX_size(&digest->ctx);
++ return EVP_MD_CTX_size(digest->ctx);
+ }
+
+ static unsigned
+@@ -218,7 +218,7 @@ digest_block_size(PX_MD * h)
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- return EVP_MD_CTX_block_size(&digest->ctx);
++ return EVP_MD_CTX_block_size(digest->ctx);
+ }
+
+ static void
+@@ -226,7 +226,7 @@ digest_reset(PX_MD * h)
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- EVP_DigestInit_ex(&digest->ctx, digest->algo, NULL);
++ EVP_DigestInit_ex(digest->ctx, digest->algo, NULL);
+ }
+
+ static void
+@@ -234,7 +234,7 @@ digest_update(PX_MD * h, const uint8 *da
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- EVP_DigestUpdate(&digest->ctx, data, dlen);
++ EVP_DigestUpdate(digest->ctx, data, dlen);
+ }
+
+ static void
+@@ -242,7 +242,7 @@ digest_finish(PX_MD * h, uint8 *dst)
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- EVP_DigestFinal_ex(&digest->ctx, dst, NULL);
++ EVP_DigestFinal_ex(digest->ctx, dst, NULL);
+ }
+
+ static void
+@@ -250,7 +250,7 @@ digest_free(PX_MD * h)
+ {
+ OSSLDigest *digest = (OSSLDigest *) h->p.ptr;
+
+- EVP_MD_CTX_cleanup(&digest->ctx);
++ EVP_MD_CTX_free(digest->ctx);
+
+ px_free(digest);
+ px_free(h);
+@@ -280,9 +280,14 @@ px_find_digest(const char *name, PX_MD *
+ digest = px_alloc(sizeof(*digest));
+ digest->algo = md;
+
+- EVP_MD_CTX_init(&digest->ctx);
+- if (EVP_DigestInit_ex(&digest->ctx, digest->algo, NULL) == 0)
++ digest->ctx = EVP_MD_CTX_new();
++ if (digest->ctx == NULL)
+ return -1;
++ if (EVP_DigestInit_ex(digest->ctx, digest->algo, NULL) == 0)
++ {
++ EVP_MD_CTX_free(digest->ctx);
++ return -1;
++ }
+
+ h = px_alloc(sizeof(*h));
+ h->result_size = digest_result_size;
+--- postgresql-8.3.23.org/src/backend/utils/misc/postgresql.conf.sample 2026-08-07 13:17:13.876538497 +0200
++++ postgresql-8.3.23/src/backend/utils/misc/postgresql.conf.sample 2026-08-07 13:01:31.906350315 +0200
+@@ -76,7 +76,9 @@
+ #ssl = off # (change requires restart)
+ #ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers
+ # (change requires restart)
+-#ssl_renegotiation_limit = 512MB # amount of data between renegotiations
++#ssl_renegotiation_limit = 0 # amount of data between renegotiations
++ # 0 disables renegotiation; TLS 1.3 has no
++ # renegotiation at all
+ #password_encryption = on
+ #db_user_namespace = off
+
+--- postgresql-8.3.23.org/src/backend/utils/misc/guc.c
++++ postgresql-8.3.23/src/backend/utils/misc/guc.c
+@@ -1728,7 +1728,7 @@ static struct config_int ConfigureNamesI
+ GUC_UNIT_KB,
+ },
+ &ssl_renegotiation_limit,
+- 512 * 1024, 0, MAX_KILOBYTES, NULL, NULL
++ 0, 0, MAX_KILOBYTES, NULL, NULL
+ },
+
+ {
diff --git a/postgresql-tests-tzdata.patch b/postgresql-tests-tzdata.patch
new file mode 100644
index 0000000..e7b7285
--- /dev/null
+++ b/postgresql-tests-tzdata.patch
@@ -0,0 +1,234 @@
+--- postgresql-8.3.23.org/src/test/regress/expected/date.out 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/test/regress/expected/date.out 2026-08-07 13:17:21.169682970 +0200
+@@ -1028,7 +1028,7 @@ SELECT DATE_TRUNC('MILLENNIUM', TIMESTAM
+ SELECT DATE_TRUNC('MILLENNIUM', DATE '1970-03-20'); -- 1001-01-01
+ date_trunc
+ ------------------------------
+- Thu Jan 01 00:00:00 1001 PST
++ Thu Jan 01 00:00:00 1001 LMT
+ (1 row)
+
+ SELECT DATE_TRUNC('CENTURY', TIMESTAMP '1970-03-20 04:30:00.00000'); -- 1901
+@@ -1040,7 +1040,7 @@ SELECT DATE_TRUNC('CENTURY', TIMESTAMP '
+ SELECT DATE_TRUNC('CENTURY', DATE '1970-03-20'); -- 1901
+ date_trunc
+ ------------------------------
+- Tue Jan 01 00:00:00 1901 PST
++ Tue Jan 01 00:00:00 1901 LMT
+ (1 row)
+
+ SELECT DATE_TRUNC('CENTURY', DATE '2004-08-10'); -- 2001-01-01
+@@ -1052,13 +1052,13 @@ SELECT DATE_TRUNC('CENTURY', DATE '2004-
+ SELECT DATE_TRUNC('CENTURY', DATE '0002-02-04'); -- 0001-01-01
+ date_trunc
+ ------------------------------
+- Mon Jan 01 00:00:00 0001 PST
++ Mon Jan 01 00:00:00 0001 LMT
+ (1 row)
+
+ SELECT DATE_TRUNC('CENTURY', DATE '0055-08-10 BC'); -- 0100-01-01 BC
+ date_trunc
+ ---------------------------------
+- Tue Jan 01 00:00:00 0100 PST BC
++ Tue Jan 01 00:00:00 0100 LMT BC
+ (1 row)
+
+ SELECT DATE_TRUNC('DECADE', DATE '1993-12-25'); -- 1990-01-01
+@@ -1070,12 +1070,12 @@ SELECT DATE_TRUNC('DECADE', DATE '1993-1
+ SELECT DATE_TRUNC('DECADE', DATE '0004-12-25'); -- 0001-01-01 BC
+ date_trunc
+ ---------------------------------
+- Sat Jan 01 00:00:00 0001 PST BC
++ Sat Jan 01 00:00:00 0001 LMT BC
+ (1 row)
+
+ SELECT DATE_TRUNC('DECADE', DATE '0002-12-31 BC'); -- 0011-01-01 BC
+ date_trunc
+ ---------------------------------
+- Mon Jan 01 00:00:00 0011 PST BC
++ Mon Jan 01 00:00:00 0011 LMT BC
+ (1 row)
+
+--- postgresql-8.3.23.org/src/test/regress/expected/timestamp.out 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/test/regress/expected/timestamp.out 2026-08-07 13:17:21.169682970 +0200
+@@ -1578,13 +1578,13 @@ SELECT '' AS to_char_11, to_char(d1, 'FM
+ SELECT '' AS to_timestamp_1, to_timestamp('0097/Feb/16 --> 08:14:30', 'YYYY/Mon/DD --> HH:MI:SS');
+ to_timestamp_1 | to_timestamp
+ ----------------+------------------------------
+- | Sat Feb 16 08:14:30 0097 PST
++ | Sat Feb 16 08:14:30 0097 LMT
+ (1 row)
+
+ SELECT '' AS to_timestamp_2, to_timestamp('97/2/16 8:14:30', 'FMYYYY/FMMM/FMDD FMHH:FMMI:FMSS');
+ to_timestamp_2 | to_timestamp
+ ----------------+------------------------------
+- | Sat Feb 16 08:14:30 0097 PST
++ | Sat Feb 16 08:14:30 0097 LMT
+ (1 row)
+
+ SELECT '' AS to_timestamp_3, to_timestamp('1985 January 12', 'YYYY FMMonth DD');
+@@ -1603,7 +1603,7 @@ SELECT '' AS to_timestamp_4, to_timestam
+ SELECT '' AS to_timestamp_5, to_timestamp('1,582nd VIII 21', 'Y,YYYth FMRM DD');
+ to_timestamp_5 | to_timestamp
+ ----------------+------------------------------
+- | Sat Aug 21 00:00:00 1582 PST
++ | Sat Aug 21 00:00:00 1582 LMT
+ (1 row)
+
+ SELECT '' AS to_timestamp_6, to_timestamp('15 "text between quote marks" 98 54 45',
+--- postgresql-8.3.23.org/src/test/regress/expected/timestamptz.out 2013-02-04 22:29:07.000000000 +0100
++++ postgresql-8.3.23/src/test/regress/expected/timestamptz.out 2026-08-07 13:17:21.173016303 +0200
+@@ -260,13 +260,13 @@ SELECT '' AS "64", d1 FROM TIMESTAMPTZ_T
+ | Fri Feb 14 17:32:01 1997 PST
+ | Sat Feb 15 17:32:01 1997 PST
+ | Sun Feb 16 17:32:01 1997 PST
+- | Tue Feb 16 17:32:01 0097 PST BC
+- | Sat Feb 16 17:32:01 0097 PST
+- | Thu Feb 16 17:32:01 0597 PST
+- | Tue Feb 16 17:32:01 1097 PST
+- | Sat Feb 16 17:32:01 1697 PST
+- | Thu Feb 16 17:32:01 1797 PST
+- | Tue Feb 16 17:32:01 1897 PST
++ | Tue Feb 16 17:32:01 0097 LMT BC
++ | Sat Feb 16 17:32:01 0097 LMT
++ | Thu Feb 16 17:32:01 0597 LMT
++ | Tue Feb 16 17:32:01 1097 LMT
++ | Sat Feb 16 17:32:01 1697 LMT
++ | Thu Feb 16 17:32:01 1797 LMT
++ | Tue Feb 16 17:32:01 1897 LMT
+ | Sun Feb 16 17:32:01 1997 PST
+ | Sat Feb 16 17:32:01 2097 PST
+ | Wed Feb 28 17:32:01 1996 PST
+@@ -348,13 +348,13 @@ SELECT '' AS "15", d1 FROM TIMESTAMPTZ_T
+ ----+---------------------------------
+ | -infinity
+ | Wed Dec 31 16:00:00 1969 PST
+- | Tue Feb 16 17:32:01 0097 PST BC
+- | Sat Feb 16 17:32:01 0097 PST
+- | Thu Feb 16 17:32:01 0597 PST
+- | Tue Feb 16 17:32:01 1097 PST
+- | Sat Feb 16 17:32:01 1697 PST
+- | Thu Feb 16 17:32:01 1797 PST
+- | Tue Feb 16 17:32:01 1897 PST
++ | Tue Feb 16 17:32:01 0097 LMT BC
++ | Sat Feb 16 17:32:01 0097 LMT
++ | Thu Feb 16 17:32:01 0597 LMT
++ | Tue Feb 16 17:32:01 1097 LMT
++ | Sat Feb 16 17:32:01 1697 LMT
++ | Thu Feb 16 17:32:01 1797 LMT
++ | Tue Feb 16 17:32:01 1897 LMT
+ | Wed Feb 28 17:32:01 1996 PST
+ | Thu Feb 29 17:32:01 1996 PST
+ | Fri Mar 01 17:32:01 1996 PST
+@@ -416,13 +416,13 @@ SELECT '' AS "63", d1 FROM TIMESTAMPTZ_T
+ | Fri Feb 14 17:32:01 1997 PST
+ | Sat Feb 15 17:32:01 1997 PST
+ | Sun Feb 16 17:32:01 1997 PST
+- | Tue Feb 16 17:32:01 0097 PST BC
+- | Sat Feb 16 17:32:01 0097 PST
+- | Thu Feb 16 17:32:01 0597 PST
+- | Tue Feb 16 17:32:01 1097 PST
+- | Sat Feb 16 17:32:01 1697 PST
+- | Thu Feb 16 17:32:01 1797 PST
+- | Tue Feb 16 17:32:01 1897 PST
++ | Tue Feb 16 17:32:01 0097 LMT BC
++ | Sat Feb 16 17:32:01 0097 LMT
++ | Thu Feb 16 17:32:01 0597 LMT
++ | Tue Feb 16 17:32:01 1097 LMT
++ | Sat Feb 16 17:32:01 1697 LMT
++ | Thu Feb 16 17:32:01 1797 LMT
++ | Tue Feb 16 17:32:01 1897 LMT
+ | Sun Feb 16 17:32:01 1997 PST
+ | Sat Feb 16 17:32:01 2097 PST
+ | Wed Feb 28 17:32:01 1996 PST
+@@ -448,13 +448,13 @@ SELECT '' AS "16", d1 FROM TIMESTAMPTZ_T
+ | -infinity
+ | Wed Dec 31 16:00:00 1969 PST
+ | Thu Jan 02 00:00:00 1997 PST
+- | Tue Feb 16 17:32:01 0097 PST BC
+- | Sat Feb 16 17:32:01 0097 PST
+- | Thu Feb 16 17:32:01 0597 PST
+- | Tue Feb 16 17:32:01 1097 PST
+- | Sat Feb 16 17:32:01 1697 PST
+- | Thu Feb 16 17:32:01 1797 PST
+- | Tue Feb 16 17:32:01 1897 PST
++ | Tue Feb 16 17:32:01 0097 LMT BC
++ | Sat Feb 16 17:32:01 0097 LMT
++ | Thu Feb 16 17:32:01 0597 LMT
++ | Tue Feb 16 17:32:01 1097 LMT
++ | Sat Feb 16 17:32:01 1697 LMT
++ | Thu Feb 16 17:32:01 1797 LMT
++ | Tue Feb 16 17:32:01 1897 LMT
+ | Wed Feb 28 17:32:01 1996 PST
+ | Thu Feb 29 17:32:01 1996 PST
+ | Fri Mar 01 17:32:01 1996 PST
+@@ -1647,14 +1647,14 @@ SELECT '' AS to_char_11, to_char(d1, 'FM
+ SELECT '' AS to_timestamp_1, to_timestamp('0097/Feb/16 --> 08:14:30', 'YYYY/Mon/DD --> HH:MI:SS');
+ to_timestamp_1 | to_timestamp
+ ----------------+------------------------------
+- | Sat Feb 16 08:14:30 0097 PST
++ | Sat Feb 16 08:14:30 0097 LMT
+ (1 row)
+
+
+ SELECT '' AS to_timestamp_2, to_timestamp('97/2/16 8:14:30', 'FMYYYY/FMMM/FMDD FMHH:FMMI:FMSS');
+ to_timestamp_2 | to_timestamp
+ ----------------+------------------------------
+- | Sat Feb 16 08:14:30 0097 PST
++ | Sat Feb 16 08:14:30 0097 LMT
+ (1 row)
+
+ SELECT '' AS to_timestamp_3, to_timestamp('1985 January 12', 'YYYY FMMonth DD');
+@@ -1673,7 +1673,7 @@ SELECT '' AS to_timestamp_4, to_timestam
+ SELECT '' AS to_timestamp_5, to_timestamp('1,582nd VIII 21', 'Y,YYYth FMRM DD');
+ to_timestamp_5 | to_timestamp
+ ----------------+------------------------------
+- | Sat Aug 21 00:00:00 1582 PST
++ | Sat Aug 21 00:00:00 1582 LMT
+ (1 row)
+
+ SELECT '' AS to_timestamp_6, to_timestamp('15 "text between quote marks" 98 54 45',
+--- postgresql-8.3.23.org/src/test/regress/expected/horology.out 2026-08-07 13:17:13.881466632 +0200
++++ postgresql-8.3.23/src/test/regress/expected/horology.out 2026-08-07 13:17:21.173016303 +0200
+@@ -685,13 +685,13 @@ SELECT '' AS "64", d1 + interval '1 year
+ | Sat Feb 14 17:32:01 1998 PST
+ | Sun Feb 15 17:32:01 1998 PST
+ | Mon Feb 16 17:32:01 1998 PST
+- | Thu Feb 16 17:32:01 0096 PST BC
+- | Sun Feb 16 17:32:01 0098 PST
+- | Fri Feb 16 17:32:01 0598 PST
+- | Wed Feb 16 17:32:01 1098 PST
+- | Sun Feb 16 17:32:01 1698 PST
+- | Fri Feb 16 17:32:01 1798 PST
+- | Wed Feb 16 17:32:01 1898 PST
++ | Thu Feb 16 17:32:01 0096 LMT BC
++ | Sun Feb 16 17:32:01 0098 LMT
++ | Fri Feb 16 17:32:01 0598 LMT
++ | Wed Feb 16 17:32:01 1098 LMT
++ | Sun Feb 16 17:32:01 1698 LMT
++ | Fri Feb 16 17:32:01 1798 LMT
++ | Wed Feb 16 17:32:01 1898 LMT
+ | Mon Feb 16 17:32:01 1998 PST
+ | Sun Feb 16 17:32:01 2098 PST
+ | Fri Feb 28 17:32:01 1997 PST
+@@ -756,13 +756,13 @@ SELECT '' AS "64", d1 - interval '1 year
+ | Wed Feb 14 17:32:01 1996 PST
+ | Thu Feb 15 17:32:01 1996 PST
+ | Fri Feb 16 17:32:01 1996 PST
+- | Mon Feb 16 17:32:01 0098 PST BC
+- | Thu Feb 16 17:32:01 0096 PST
+- | Tue Feb 16 17:32:01 0596 PST
+- | Sun Feb 16 17:32:01 1096 PST
+- | Thu Feb 16 17:32:01 1696 PST
+- | Tue Feb 16 17:32:01 1796 PST
+- | Sun Feb 16 17:32:01 1896 PST
++ | Mon Feb 16 17:32:01 0098 LMT BC
++ | Thu Feb 16 17:32:01 0096 LMT
++ | Tue Feb 16 17:32:01 0596 LMT
++ | Sun Feb 16 17:32:01 1096 LMT
++ | Thu Feb 16 17:32:01 1696 LMT
++ | Tue Feb 16 17:32:01 1796 LMT
++ | Sun Feb 16 17:32:01 1896 LMT
+ | Fri Feb 16 17:32:01 1996 PST
+ | Thu Feb 16 17:32:01 2096 PST
+ | Tue Feb 28 17:32:01 1995 PST
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/postgresql.git/commitdiff/78db924617b60a0cffaf7faa0543a4581c813c70
More information about the pld-cvs-commit
mailing list