23 changed files with 323 additions and 2631 deletions
--- a/.apr-util.metadata
+++ b/.apr-util.metadata
@ -0,0 +1 @@
 4cc73bc36ca697419f555476f2fc1c63df6069f4 SOURCES/apr-util-1.6.1.tar.bz2
--- a/.fmf/version
+++ b/.fmf/version
@ -1 +0,0 @@
 1
--- a/.gitignore
+++ b/.gitignore
@ -1,15 +1 @@
-apr-util-1.3.9.tar.bz2
+SOURCES/apr-util-1.6.1.tar.bz2
 /apr-util-1.3.10.tar.bz2
 /*.rpm
 /clog
 /x86_64
 /.build*.log
 /apr-util-1.3.11.tar.bz2
 /apr-util-1.3.12.tar.bz2
 /apr-util-1.4.1.tar.bz2
 /apr-util-1.5.2.tar.bz2
 /apr-util-1.5.3.tar.bz2
 /apr-util-1.5.4.tar.bz2
 /apr-util-1.6.0.tar.bz2
 /apr-util-1.6.1.tar.bz2
 /apr-util-1.6.3.tar.bz2
--- a/SOURCES/apr-util-1.2.7-pkgconf.patch
+++ b/SOURCES/apr-util-1.2.7-pkgconf.patch
--- a/SOURCES/apr-util-1.4.1-private.patch
+++ b/SOURCES/apr-util-1.4.1-private.patch
--- a/SOURCES/apr-util-1.6.1-CVE-2022-25147.patch
+++ b/SOURCES/apr-util-1.6.1-CVE-2022-25147.patch
@ -0,0 +1,127 @@
 diff --git a/encoding/apr_base64.c b/encoding/apr_base64.c
 index 1eed153..2803106 100644
 --- a/encoding/apr_base64.c
 +++ b/encoding/apr_base64.c
@@ -20,11 +20,20 @@
  * ugly 'len' functions, which is quite a nasty cost.
  */
 +#undef NDEBUG /* always abort() on assert()ion failure */
 +#include <assert.h>
 +
 #include "apr_base64.h"
 #if APR_CHARSET_EBCDIC
 #include "apr_xlate.h"
 #endif				/* APR_CHARSET_EBCDIC */
 +/* Above APR_BASE64_ENCODE_MAX length the encoding can't fit in an int >= 0 */
 +#define APR_BASE64_ENCODE_MAX 1610612733
 +
 +/* Above APR_BASE64_DECODE_MAX length the decoding can't fit in an int >= 0 */
 +#define APR_BASE64_DECODE_MAX 2863311524u
 +
 /* aaaack but it's fast and const should make it shared text page. */
 static const unsigned char pr2six[256] =
 {
@@ -109,7 +118,6 @@ APU_DECLARE(apr_status_t) apr_base64init_ebcdic(apr_xlate_t *to_ascii,
 APU_DECLARE(int) apr_base64_decode_len(const char *bufcoded)
 {
 -    int nbytesdecoded;
     register const unsigned char *bufin;
     register apr_size_t nprbytes;
@@ -117,16 +125,16 @@ APU_DECLARE(int) apr_base64_decode_len(const char *bufcoded)
     while (pr2six[*(bufin++)] <= 63);
     nprbytes = (bufin - (const unsigned char *) bufcoded) - 1;
 -    nbytesdecoded = (((int)nprbytes + 3) / 4) * 3;
 +    assert(nprbytes <= APR_BASE64_DECODE_MAX);
 -    return nbytesdecoded + 1;
 +    return (int)(((nprbytes + 3u) / 4u) * 3u + 1u);
 }
 APU_DECLARE(int) apr_base64_decode(char *bufplain, const char *bufcoded)
 {
 #if APR_CHARSET_EBCDIC
     apr_size_t inbytes_left, outbytes_left;
 -#endif				/* APR_CHARSET_EBCDIC */
 +#endif	/* APR_CHARSET_EBCDIC */
     int len;
     len = apr_base64_decode_binary((unsigned char *) bufplain, bufcoded);
@@ -153,12 +161,13 @@ APU_DECLARE(int) apr_base64_decode_binary(unsigned char *bufplain,
     bufin = (const unsigned char *) bufcoded;
     while (pr2six[*(bufin++)] <= 63);
     nprbytes = (bufin - (const unsigned char *) bufcoded) - 1;
 -    nbytesdecoded = (((int)nprbytes + 3) / 4) * 3;
 +    assert(nprbytes <= APR_BASE64_DECODE_MAX);
 +    nbytesdecoded = (int)(((nprbytes + 3u) / 4u) * 3u);
     bufout = (unsigned char *) bufplain;
     bufin = (const unsigned char *) bufcoded;
 -    while (nprbytes > 4) {
 +    while (nprbytes >= 4) {
 	*(bufout++) =
 	    (unsigned char) (pr2six[*bufin] << 2 | pr2six[bufin[1]] >> 4);
 	*(bufout++) =
@@ -178,13 +187,8 @@ APU_DECLARE(int) apr_base64_decode_binary(unsigned char *bufplain,
 	*(bufout++) =
 	    (unsigned char) (pr2six[bufin[1]] << 4 | pr2six[bufin[2]] >> 2);
     }
 -    if (nprbytes > 3) {
 -	*(bufout++) =
 -	    (unsigned char) (pr2six[bufin[2]] << 6 | pr2six[bufin[3]]);
 -    }
 -    nbytesdecoded -= (4 - (int)nprbytes) & 3;
 -    return nbytesdecoded;
 +    return nbytesdecoded - (int)((4u - nprbytes) & 3u);
 }
 static const char basis_64[] =
@@ -192,6 +196,8 @@ static const char basis_64[] =
 APU_DECLARE(int) apr_base64_encode_len(int len)
 {
 +    assert(len >= 0 && len <= APR_BASE64_ENCODE_MAX);
 +
     return ((len + 2) / 3 * 4) + 1;
 }
@@ -203,6 +209,8 @@ APU_DECLARE(int) apr_base64_encode(char *encoded, const char *string, int len)
     int i;
     char *p;
 +    assert(len >= 0 && len <= APR_BASE64_ENCODE_MAX);
 +
     p = encoded;
     for (i = 0; i < len - 2; i += 3) {
 	*p++ = basis_64[(os_toascii[string[i]] >> 2) & 0x3F];
@@ -227,7 +235,7 @@ APU_DECLARE(int) apr_base64_encode(char *encoded, const char *string, int len)
     }
     *p++ = '\0';
 -    return p - encoded;
 +    return (unsigned int)(p - encoded);
 #endif				/* APR_CHARSET_EBCDIC */
 }
@@ -240,6 +248,8 @@ APU_DECLARE(int) apr_base64_encode_binary(char *encoded,
     int i;
     char *p;
 +    assert(len >= 0 && len <= APR_BASE64_ENCODE_MAX);
 +
     p = encoded;
     for (i = 0; i < len - 2; i += 3) {
 	*p++ = basis_64[(string[i] >> 2) & 0x3F];
@@ -264,5 +274,5 @@ APU_DECLARE(int) apr_base64_encode_binary(char *encoded,
     }
     *p++ = '\0';
 -    return (int)(p - encoded);
 +    return (unsigned int)(p - encoded);
 }
--- a/SOURCES/apr-util-1.6.1-r1907242+.patch
+++ b/SOURCES/apr-util-1.6.1-r1907242+.patch
--- a/SOURCES/apr-util-mariadb-upstream.patch
+++ b/SOURCES/apr-util-mariadb-upstream.patch
@ -0,0 +1,128 @@
 Upstream patch for building with mariadb:
 Taken from https://bz.apache.org/bugzilla/show_bug.cgi?id=61517
 BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1494093
 --- a/build/dbd.m4	2017-05-03 19:18:52.000000000 -0400
 +++ a/build/dbd.m4	2017-09-13 16:58:07.369546391 -0400
@@ -163,10 +163,15 @@ 
   old_cppflags="$CPPFLAGS"
   old_ldflags="$LDFLAGS"
 +  my_library="mysqlclient"
 +
   AC_ARG_WITH([mysql], APR_HELP_STRING([--with-mysql=DIR], [enable MySQL DBD driver]),
   [
     if test "$withval" = "yes"; then
       AC_PATH_PROG([MYSQL_CONFIG],[mysql_config])
 +      if test "x$MYSQL_CONFIG" = "x"; then
 +        AC_PATH_PROG([MYSQL_CONFIG],[mariadb_config])
 +      fi
       if test "x$MYSQL_CONFIG" != 'x'; then
         mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
         mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
@@ -174,32 +179,40 @@ 
         APR_ADDTO(CPPFLAGS, [$mysql_CPPFLAGS])
         APR_ADDTO(LIBS, [$mysql_LIBS])
 +
 +	if $MYSQL_CONFIG --libs_r | grep -q mariadb; then
 +	  my_library="mariadb"
 +	fi
       fi
 -      AC_CHECK_HEADERS([mysql.h my_global.h my_sys.h],
 -                       AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
 -                       [apu_have_mysql=0; break],
 -                       [#include <my_global.h>])
 -      if test "$apu_have_mysql" = "0"; then
 -        AC_CHECK_HEADERS([mysql/mysql.h mysql/my_global.h mysql/my_sys.h],
 -                         AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
 -                         [apu_have_mysql=0; break],
 -                         [#include <mysql/my_global.h>])
 +      AC_CHECK_HEADERS([mysql.h errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
 +      if test "$apr_have_mysql" = "0"; then
 +	AC_CHECK_HEADERS([mysql/mysql.h mysql/errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
       fi
 -      if test "$apu_have_mysql" != "0" && test "x$MYSQL_CONFIG" != 'x'; then
 -        APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
 +      if test "$apr_have_mysql" = "1"; then
 +	AC_CHECK_HEADERS([my_global.h my_sys.h mysql/my_global.h mysql/my_sys.h])
 +	AC_CHECK_LIB($my_library, mysql_init,, [apu_have_mysql=0])
 +      fi
 +      if test "$apu_have_mysql" = "1" && test "x$MYSQL_CONFIG" != 'x'; then
 +	APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
       fi
     elif test "$withval" = "no"; then
       :
     else
       AC_PATH_PROG([MYSQL_CONFIG],[mysql_config],,[$withval/bin])
 +      if test "x$MYSQL_CONFIG" = "x"; then
 +	AC_PATH_PROG([MYSQL_CONFIG],[mariadb_config],,[$withval/bin])
 +      fi
       if test "x$MYSQL_CONFIG" != 'x'; then
 -        mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
 -        mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
 -        mysql_LIBS="`$MYSQL_CONFIG --libs_r`"
 +	mysql_CPPFLAGS="`$MYSQL_CONFIG --include`"
 +	mysql_LDFLAGS="`$MYSQL_CONFIG --libs_r | sed -e 's/-l[[^ ]]\+//g'`"
 +	mysql_LIBS="`$MYSQL_CONFIG --libs_r`"
 +	if $MYSQL_CONFIG --libs_r | grep -q mariadb; then
 +	  my_library="mariadb"
 +	fi
       else
 -        mysql_CPPFLAGS="-I$withval/include"
 -        mysql_LDFLAGS="-L$withval/lib "
 +	mysql_CPPFLAGS="-I$withval/include"
 +	mysql_LDFLAGS="-L$withval/lib "
       fi
       APR_ADDTO(CPPFLAGS, [$mysql_CPPFLAGS])
@@ -207,18 +220,15 @@ 
       APR_ADDTO(LIBS, [$mysql_LIBS])
       AC_MSG_NOTICE(checking for mysql in $withval)
 -      AC_CHECK_HEADERS([mysql.h my_global.h my_sys.h],
 -                       AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
 -                       [apu_have_mysql=0; break],
 -                       [#include <my_global.h>])
 -
 -      if test "$apu_have_mysql" != "1"; then
 -        AC_CHECK_HEADERS([mysql/mysql.h mysql/my_global.h mysql/my_sys.h],
 -                         AC_CHECK_LIB(mysqlclient, mysql_init, [apu_have_mysql=1]),
 -                         [apu_have_mysql=0; break],
 -                         [#include <mysql/my_global.h>])
 +      AC_CHECK_HEADERS([mysql.h errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
 +      if test "$apr_have_mysql" = "0"; then
 +	AC_CHECK_HEADERS([mysql/mysql.h mysql/errmsg.h], [apu_have_mysql=1], [apu_have_mysql=0; break])
 +      fi
 +      if test "$apr_have_mysql" = "1"; then
 +	AC_CHECK_HEADERS([my_global.h my_sys.h mysql/my_global.h mysql/my_sys.h])
 +	AC_CHECK_LIB($my_library, mysql_init,, [apu_have_mysql=0])
       fi
 -      if test "$apu_have_mysql" != "0"; then
 +      if test "$apu_have_mysql" = "1"; then
         APR_ADDTO(APRUTIL_PRIV_INCLUDES, [$mysql_CPPFLAGS])
       fi
     fi
@@ -229,7 +239,7 @@ 
   dnl Since we have already done the AC_CHECK_LIB tests, if we have it, 
   dnl we know the library is there.
   if test "$apu_have_mysql" = "1"; then
 -    APR_ADDTO(LDADD_dbd_mysql, [$mysql_LDFLAGS -lmysqlclient $mysql_LIBS])
 +    APR_ADDTO(LDADD_dbd_mysql, [$mysql_LDFLAGS -l$my_library $mysql_LIBS])
   fi
   AC_SUBST(LDADD_dbd_mysql)
 --- a/dbd/apr_dbd_mysql.c	2017-05-03 19:18:52.000000000 -0400
 +++ a/dbd/apr_dbd_mysql.c	2017-09-13 19:15:20.894368809 -0400
@@ -1262,7 +1262,9 @@ 
 static void dbd_mysql_init(apr_pool_t *pool)
 {
 +#if MYSQL_VERSION_ID < 100000
     my_init();
 +#endif
     mysql_thread_init();
     /* FIXME: this is a guess; find out what it really does */
--- a/SPECS/apr-util.spec
+++ b/SPECS/apr-util.spec
@ -1,21 +1,9 @@
 %define aprver 1
 %if 0%{?fedora} < 39 && 0%{?rhel} <= 9
 %global with_lmdb 0
 %else
 %global with_lmdb 1
 %endif
 %if %{with_lmdb}
 %define dbdep lmdb-devel
 %else
 %if 0%{?fedora} < 18 && 0%{?rhel} < 7
 %define dbdep db4-devel
 %else
 %define dbdep libdb-devel
 %endif
 %endif
 %if 0%{?fedora} < 27 && 0%{?rhel} <= 7
 %global with_nss 1
@ -23,53 +11,31 @@
 %global with_nss 0
 %endif
 %if 0%{?fedora} < 36 && 0%{?rhel} <= 9
 %global ldaplib ldap_r
 %else
 %global ldaplib ldap
 %endif
 # Disable .la file removal since the .la file is exported via apu-config.
 %global __brp_remove_la_files %nil
 %define apuver 1
 Summary: Apache Portable Runtime Utility library
 Name: apr-util
-Version: 1.6.3
+Version: 1.6.1
-Release: 21%{?dist}
+Release: 9%{?dist}
-# Apache-2.0:  everything
+License: ASL 2.0
-# RSA-MD:      https://gitlab.com/fedora/legal/fedora-legal-docs/-/merge_requests/187
+Group: System Environment/Libraries
-#              include\apr_md5.h, passwd\apr_md5.c, crypto\apr_md4.c, include\apr_md4.h
+URL: http://apr.apache.org/
-#
+Source0: http://www.apache.org/dist/apr/%{name}-%{version}.tar.bz2
 # LicenseRef-Fedora-Public-Domain: crypto\crypt_blowfish.c, crypto\crypt_blowfish.h
 # Beerware:                        passwd\apr_md5.c
 # OLDAP-2.7 AND BSD-4.3RENO:       ldap/apr_ldap_url.c
 License: Apache-2.0 AND (Beerware AND LicenseRef-Fedora-Public-Domain AND OLDAP-2.7 AND BSD-4.3RENO)
 URL: https://apr.apache.org/
 Source0: https://www.apache.org/dist/apr/%{name}-%{version}.tar.bz2
 Patch1: apr-util-1.2.7-pkgconf.patch
-Patch2: apr-util-1.4.1-private.patch
+Patch4: apr-util-1.4.1-private.patch
-Patch3: apr-util-1.6.3-allow-ipv6.patch
+Patch5: apr-util-mariadb-upstream.patch
-Patch4: apr-util-configure-c99.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2063562
-Patch5: apr-util-1.6.3-lmdb-support.patch
+Patch6: apr-util-1.6.1-r1907242+.patch
-Patch6: apr-util-1.6.3-r1908584.patch
+
-Patch7: apr-util-1.6.3-r1908585.patch
+# Security patches:
-Patch8: apr-util-1.6.3-r1908586.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2169652
-Patch9: apr-util-1.6.3-drop-engine-headers.patch
+Patch100: apr-util-1.6.1-CVE-2022-25147.patch
-BuildRequires: gcc
+
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-buildroot
 BuildRequires: autoconf, apr-devel >= 1.3.0
 BuildRequires: %{dbdep}, expat-devel, libuuid-devel
 Recommends: apr-util-bdb%{?_isa} = %{version}-%{release}
 Recommends: apr-util-openssl%{_isa} = %{version}-%{release}
 %if %{with_lmdb}
 Recommends: apr-util-lmdb%{_isa} = %{version}-%{release}
 %else
 %if 0%{?fedora} < 27
 Requires: apr-util-bdb%{?_isa} = %{version}-%{release}
 %else
 Recommends: apr-util-bdb%{_isa} = %{version}-%{release}
 %endif
 %endif
 %description
 The mission of the Apache Portable Runtime (APR) is to provide a
@ -78,9 +44,10 @@ contains additional utility interfaces for APR; including support
 for XML, LDAP, database interfaces, URI parsing and more.
 %package devel
 Group: Development/Libraries
 Summary: APR utility library development kit
 Requires: apr-util%{?_isa} = %{version}-%{release}, apr-devel%{?_isa}, pkgconfig
-Requires: expat-devel%{?_isa}, openldap-devel%{?_isa}
+Requires: %{dbdep}%{?_isa}, expat-devel%{?_isa}, openldap-devel%{?_isa}
 %description devel
 This package provides the support files which can be used to 
@ -89,38 +56,27 @@ of the Apache Portable Runtime (APR) is to provide a free
 library of C data structures and routines.
 %package pgsql
 Group: Development/Libraries
 Summary: APR utility library PostgreSQL DBD driver
-BuildRequires: libpq-devel
+BuildRequires: postgresql-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
 %description pgsql
 This package provides the PostgreSQL driver for the apr-util
 DBD (database abstraction) interface.
 %if %{with_lmdb}
 %package lmdb
 Summary: APR utility library LMDB driver
 Requires: apr-util%{?_isa} = %{version}-%{release}
 # Remove libdb dependency from apr-util
 # https://bugzilla.redhat.com/show_bug.cgi?id=1779267
 Obsoletes: apr-util-bdb < 1.6.3-13
 Provides: apr-util-%{aprver}(dbm)%{?_isa} = %{version}-%{release}
 %description lmdb
 This package provides the LMDB driver for the apr-util
 DBM (database abstraction) interface.
 %else
 %package bdb
 Group: Development/Libraries
 Summary: APR utility library Berkeley DB driver
 BuildRequires: postgresql-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
 Provides: apr-util-%{aprver}(dbm)%{?_isa} = %{version}-%{release}
 %description bdb
 This package provides the Berkeley DB driver for the apr-util
 DBM (database abstraction) interface.
 %endif
 %package mysql
 Group: Development/Libraries
 Summary: APR utility library MySQL DBD driver
 BuildRequires: mariadb-connector-c-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
@ -130,6 +86,7 @@ This package provides the MySQL driver for the apr-util DBD
 (database abstraction) interface.
 %package sqlite
 Group: Development/Libraries
 Summary: APR utility library SQLite DBD driver
 BuildRequires: sqlite-devel >= 3.0.0
 Requires: apr-util%{?_isa} = %{version}-%{release}
@ -139,6 +96,7 @@ This package provides the SQLite driver for the apr-util DBD
 (database abstraction) interface.
 %package odbc
 Group: Development/Libraries
 Summary: APR utility library ODBC DBD driver
 BuildRequires: unixODBC-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
@ -148,6 +106,7 @@ This package provides the ODBC driver for the apr-util DBD
 (database abstraction) interface.
 %package ldap
 Group: Development/Libraries
 Summary: APR utility library LDAP support
 BuildRequires: openldap-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
@ -156,6 +115,7 @@ Requires: apr-util%{?_isa} = %{version}-%{release}
 This package provides the LDAP support for the apr-util.
 %package openssl
 Group: Development/Libraries
 Summary: APR utility library OpenSSL crypto support
 BuildRequires: openssl-devel
 Requires: apr-util%{?_isa} = %{version}-%{release}
@ -165,9 +125,9 @@ This package provides the OpenSSL crypto support for the apr-util.
 %if %{with_nss}
 %package nss
 Group: Development/Libraries
 Summary: APR utility library NSS crypto support
 BuildRequires: nss-devel
 BuildRequires: make
 Requires: apr-util%{?_isa} = %{version}-%{release}
 %description nss
@ -175,10 +135,13 @@ This package provides the NSS crypto support for the apr-util.
 %endif
 %prep
-%autosetup -p1
+%setup -q
 %patch1 -p1 -b .pkgconf
 %patch4 -p1 -b .private
 %patch5 -p1 -b .maria
 %patch6 -p1 -b .r1907242
-: Configured for LDAP library: %{ldaplib}
+%patch100 -p1 -b .CVE-2022-25147
 : Configured for DBM library: %{dbdep}
 %build
 autoheader && autoconf
@ -187,26 +150,21 @@ autoheader && autoconf
 export ac_cv_ldap_set_rebind_proc_style=three
 %configure --with-apr=%{_prefix} \
        --includedir=%{_includedir}/apr-%{apuver} \
-        --with-ldap=%{ldaplib} --without-gdbm \
+        --with-ldap=ldap_r --without-gdbm \
        --with-sqlite3 --with-pgsql --with-mysql --with-odbc \
 %if %{with_lmdb}
        --with-dbm=lmdb --with-lmdb \
 %else
        --with-dbm=db5 --with-berkeley-db \
 %endif
        --without-sqlite2 \
        --with-crypto --with-openssl \
 %if %{with_nss}
-        --with-nss \
+        --with-nss
 %else
-        --without-nss \
+        --without-nss
 %endif
-   || { cat config.log; exit 1; }
+make %{?_smp_mflags}
 %{make_build}
 %install
 rm -rf $RPM_BUILD_ROOT
-%{make_install}
+make install DESTDIR=$RPM_BUILD_ROOT
 mkdir -p $RPM_BUILD_ROOT/%{_datadir}/aclocal
 install -m 644 build/find_apu.m4 $RPM_BUILD_ROOT/%{_datadir}/aclocal
@ -231,178 +189,79 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/apr-util-%{apuver}/*.*a
 # Run the less verbose test suites
 export MALLOC_CHECK_=2 MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
 cd test
-%{make_build} testall
+make %{?_smp_mflags} testall
 # testall breaks with DBD DSO; ignore
 export LD_LIBRARY_PATH=%{buildroot}/%{_libdir}/apr-util-%{apuver}
 ./testall -v -q
-%ldconfig_scriptlets
+%clean
 rm -rf $RPM_BUILD_ROOT
 %post -p /sbin/ldconfig
 %postun -p /sbin/ldconfig
 %files
 %defattr(-,root,root,-)
 %doc CHANGES LICENSE NOTICE
 %{_libdir}/libaprutil-%{apuver}.so.*
 %dir %{_libdir}/apr-util-%{apuver}
 %if %{with_lmdb}
 %files lmdb
 %{_libdir}/apr-util-%{apuver}/apr_dbm_lmdb*
 %else
 %files bdb
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_dbm_db*
 %endif
 %files pgsql
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_dbd_pgsql*
 %files mysql
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_dbd_mysql*
 %files sqlite
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_dbd_sqlite*
 %files odbc
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_dbd_odbc*
 %files ldap
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_ldap*
 %files openssl
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_crypto_openssl*
 %if %{with_nss}
 %files nss
 %defattr(-,root,root,-)
 %{_libdir}/apr-util-%{apuver}/apr_crypto_nss*
 %endif
 %files devel
 %defattr(-,root,root,-)
 %{_bindir}/apu-%{apuver}-config
-%{_libdir}/libaprutil-%{apuver}.la
+%{_libdir}/libaprutil-%{apuver}.*a
 %{_libdir}/libaprutil-%{apuver}.so
 %{_includedir}/apr-%{apuver}/*.h
 %{_libdir}/pkgconfig/*.pc
 %{_datadir}/aclocal/*.m4
 %changelog
-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1.6.3-21
+* Tue Jun 27 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.1-9
- Bump release for October 2024 mass rebuild:
+- Related: #2063562 - mod_auth_openidc fails with IPv6 OIDCMemCacheServers
  Resolves: RHEL-64018
-* Tue Aug  6 2024 Joe Orton <jorton@redhat.com> - 1.6.3-20
+* Mon Jun 12 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.1-8
- restore -devel dep on openldap-devel to fix mod_perl FTBFS
+- Resolves: #2063562 - mod_auth_openidc fails with IPv6 OIDCMemCacheServers
  Related: RHEL-50386
-* Mon Jul 29 2024 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-19
+* Wed May 31 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.1-7
- Resolves: RHEL-50386 - drop unnecessary apr-util-devel dependencies
+- Resolves: #2196573 - CVE-2022-25147 apr-util: out-of-bounds writes in the apr_base64
 - Related: RHEL-33728 - drop ENGINE support from apr_crypto
-* Tue Jun 25 2024 Joe Orton <jorton@redhat.com> - 1.6.3-18
+* Mon Oct  1 2018 Joe Orton <jorton@redhat.com> - 1.6.1-6
- drop ENGINE support from apr_crypto (RHEL-33728)
+- Recommends: apr-util-openssl, apr-util-bdb (#1633973)
 - fix (harmless) gcc snprintf warning in testbuckets.c
 * Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 1.6.3-17
 - Bump release for June 2024 mass rebuild
 * Thu Feb  8 2024 Joe Orton <jorton@redhat.com> - 1.6.3-16
 - fix ODBC type mismatch (r1908586)
 - use autosetup
 * Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.3-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.3-14
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 * Tue Dec 12 2023 Joe Orton <jorton@redhat.com> - 1.6.3-13
 - re-enable LMDB by default again for Fedora >= 40 (#1779267)
 * Thu Nov  2 2023 Joe Orton <jorton@redhat.com> - 1.6.3-12
 - add apr-util-1(dbm) as virtual provide for dbm drivers
 - disable LMDB for now
 * Fri Oct 27 2023 Joe Orton <jorton@redhat.com> - 1.6.3-11
 - remove Provides: for -bdb
 * Tue Oct 24 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-10
 - add LMDB support and use it on Fedora >= 40
 - Resolves: #1779267 - Remove libdb dependency from apr-util
 * Tue Oct 03 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-7
 - SPDX migration
 * Wed Aug 30 2023 Florian Weimer <fweimer@redhat.com> - 1.6.3-5
 - Restore configure script port to C99
 * Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.3-4
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 * Fri Jun 23 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-3
 - regression in IPv4 handling in r1907242. Cycle through the address list
  handling v4/v6 addresses correctly
 * Fri Feb 10 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-2
 - memcache/apr_memcache.c (conn_connect): Allow use of IPv6
 * Thu Feb 02 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.6.3-1
 - new version 1.6.3
 * Wed Jan 18 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-24
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 * Thu Dec 22 2022 Florian Weimer <fweimer@redhat.com> - 1.6.1-23
 - Port configure script to C99
 * Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-22
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 * Fri May 13 2022 Joe Orton <jorton@redhat.com> - 1.6.1-21
 - disable .la file removal
 * Fri Jan 28 2022 Joe Orton <jorton@redhat.com> - 1.6.1-20
 - fix build with OpenLDAP 2.6 (#2032706)
 * Wed Jan 19 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-19
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 1.6.1-18
 - Rebuilt with OpenSSL 3.0.0
 * Wed Jul 21 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-17
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 * Mon Feb 08 2021 Pavel Raiskup <praiskup@redhat.com> - 1.6.1-16
 - rebuild for libpq ABI fix rhbz#1908268
 * Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 * Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-14
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 * Mon May 04 2020 Tom Stellard <tstellar@redhat.com> - 1.6.1-13
 - Use make_build and make_install macros
 - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make
 * Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-12
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 * Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 * Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 * Mon Jan 14 2019 Björn Esser <besser82@fedoraproject.org> - 1.6.1-9
 - Rebuilt for libcrypt.so.2 (#1666033)
 * Wed Sep 26 2018 Joe Orton <jorton@redhat.com> - 1.6.1-8
 - Recommends: -openssl and -bdb so default crypto, dbm drivers are
  always available (#1491151, #1633152)
 * Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 * Fri Mar  9 2018 Bojan Smojver <bojan@rexursive.com> - 1.6.1-6
 - add gcc build requirement
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.1-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
--- a/apr-util-1.4.1.tar.bz2.asc
+++ b/apr-util-1.4.1.tar.bz2.asc
@ -1,8 +0,0 @@
 -----BEGIN PGP SIGNATURE-----
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 iEYEABECAAYFAk7f7loACgkQNEqETXUdfyfQtwCePykrvmWzOLE4E0mIIHbWDhzW
 cdUAn2rBabd2Ab1HSDArwjow6B8hMGal
 =n6ut
 -----END PGP SIGNATURE-----
--- a/apr-util-1.6.3-drop-engine-headers.patch
+++ b/apr-util-1.6.3-drop-engine-headers.patch
@ -1,23 +0,0 @@
 diff --git a/crypto/apr_crypto_openssl.c b/crypto/apr_crypto_openssl.c
 index 34d0559..4069cf9 100644
 --- a/crypto/apr_crypto_openssl.c
 +++ b/crypto/apr_crypto_openssl.c
@@ -37,7 +37,6 @@
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 -#include <openssl/engine.h>
 #include <openssl/opensslv.h>
 #if OPENSSL_VERSION_NUMBER >= 0x30000000
 #include <openssl/macros.h>
@@ -92,6 +91,10 @@
 #define APR_USE_OPENSSL_ENGINE_API 0
 #endif
 +#if APR_USE_OPENSSL_ENGINE_API
 +#include <openssl/engine.h>
 +#endif
 +
 #define LOG_PREFIX "apr_crypto_openssl: "
 struct apr_crypto_t {
--- a/apr-util-1.6.3-lmdb-support.patch
+++ b/apr-util-1.6.3-lmdb-support.patch
@ -1,745 +0,0 @@
 commit 3df6492e1ef6f027629d81f0834636e791bdd4f3
 Author: Luboš Uhliarik <luhliari@redhat.com>
 Date:   Wed Oct 25 12:45:58 2023 +0200
    Add lmdb support
 diff --git a/Makefile.in b/Makefile.in
 index 811ca1d..3be9864 100644
 --- a/Makefile.in
 +++ b/Makefile.in
@@ -39,6 +39,7 @@ LDADD_dbd_odbc = @LDADD_dbd_odbc@
 LDADD_dbm_db = @LDADD_dbm_db@
 LDADD_dbm_gdbm = @LDADD_dbm_gdbm@
 LDADD_dbm_ndbm = @LDADD_dbm_ndbm@
 +LDADD_dbm_lmdb = @LDADD_dbm_lmdb@
 LDADD_ldap = @LDADD_ldap@
 LDADD_crypto_openssl = @LDADD_crypto_openssl@
 LDADD_crypto_nss = @LDADD_crypto_nss@
 diff --git a/build-outputs.mk b/build-outputs.mk
 index a8ae1c9..4aedd4a 100644
 --- a/build-outputs.mk
 +++ b/build-outputs.mk
@@ -145,6 +145,12 @@ MODULE_dbm_ndbm = dbm/apr_dbm_ndbm.la
 dbm/apr_dbm_ndbm.la: dbm/apr_dbm_ndbm.lo
 	$(LINK_MODULE) -o $@ $(OBJECTS_dbm_ndbm) $(LDADD_dbm_ndbm)
 +dbm/apr_dbm_lmdb.lo: dbm/apr_dbm_lmdb.c .make.dirs include/apr_dbm.h include/private/apr_dbm_private.h
 +OBJECTS_dbm_lmdb = dbm/apr_dbm_lmdb.lo
 +MODULE_dbm_lmdb = dbm/apr_dbm_lmdb.la
 +dbm/apr_dbm_lmdb.la: dbm/apr_dbm_lmdb.lo
 +	$(LINK_MODULE) -o $@ $(OBJECTS_dbm_lmdb) $(LDADD_dbm_lmdb)
 +
 BUILD_DIRS = buckets crypto dbd dbm dbm/sdbm encoding hooks ldap memcache misc redis strmatch uri xlate xml
 .make.dirs: $(srcdir)/build-outputs.mk
 diff --git a/build.conf b/build.conf
 index 86e8c34..60e6084 100644
 --- a/build.conf
 +++ b/build.conf
@@ -41,7 +41,7 @@ headers = include/*.h include/private/*.h
 modules =
   ldap crypto_openssl crypto_nss crypto_commoncrypto dbd_pgsql
   dbd_sqlite2 dbd_sqlite3 dbd_oracle dbd_mysql dbd_odbc
 -  dbm_db dbm_gdbm dbm_ndbm
 +  dbm_db dbm_gdbm dbm_ndbm dbm_lmdb
 # gen_uri_delim.c
@@ -102,3 +102,6 @@ paths = ldap/apr_ldap_init.c
         ldap/apr_ldap_rebind.c
 target = ldap/apr_ldap.la
 +[dbm_lmdb]
 +paths = dbm/apr_dbm_lmdb.c
 +target = dbm/apr_dbm_lmdb.la
 diff --git a/build/dbm.m4 b/build/dbm.m4
 index ffdbdbc..247fe18 100644
 --- a/build/dbm.m4
 +++ b/build/dbm.m4
@@ -498,11 +498,13 @@ dnl APU_CHECK_DBM: see what kind of DBM backend to use for apr_dbm.
 dnl
 AC_DEFUN([APU_CHECK_DBM], [
   apu_use_sdbm=0
 +  apu_use_lmdb=0
   apu_use_ndbm=0
   apu_use_gdbm=0
   apu_use_db=0
   dnl it's in our codebase
   apu_have_sdbm=1
 +  apu_have_lmdb=0
   apu_have_gdbm=0
   apu_have_ndbm=0
   apu_have_db=0
@@ -514,7 +516,7 @@ AC_DEFUN([APU_CHECK_DBM], [
   # Although we search for all versions up to 6.9,
   # we should only include existing versions in our
   # help string.
 -  dbm_list="sdbm, gdbm, ndbm, db, db1, db185, db2, db3, db4"
 +  dbm_list="sdbm, lmdb, gdbm, ndbm, db, db1, db185, db2, db3, db4"
   db_max_version=48
   db_min_version=41
   db_version="$db_min_version"
@@ -541,7 +543,7 @@ AC_DEFUN([APU_CHECK_DBM], [
   done
   AC_ARG_WITH(dbm, [APR_HELP_STRING([--with-dbm=DBM], [choose the DBM type to use.
 -      DBM={sdbm,gdbm,ndbm,db,db1,db185,db2,db3,db4,db4X,db5X,db6X} for some X=0,...,9])],
 +      DBM={sdbm,lmdb,gdbm,ndbm,db,db1,db185,db2,db3,db4,db4X,db5X,db6X} for some X=0,...,9])],
   [
     if test "$withval" = "yes"; then
       AC_MSG_ERROR([--with-dbm needs to specify a DBM type to use.
@@ -552,6 +554,35 @@ AC_DEFUN([APU_CHECK_DBM], [
     requested=default
   ])
 +  AC_ARG_WITH([lmdb], [APR_HELP_STRING([--with-lmdb=DIR], [enable LMDB support])],
 +  [
 +    apu_have_lmdb=0
 +    if test "$withval" = "yes"; then
 +      AC_CHECK_HEADER(lmdb.h, AC_CHECK_LIB(lmdb, mdb_dbi_open, [apu_have_lmdb=1]))
 +    elif test "$withval" = "no"; then
 +      apu_have_lmdb=0
 +    else
 +      saved_cppflags="$CPPFLAGS"
 +      saved_ldflags="$LDFLAGS"
 +      CPPFLAGS="$CPPFLAGS -I$withval/include"
 +      LDFLAGS="$LDFLAGS -L$withval/lib "
 +
 +      AC_MSG_CHECKING(checking for lmdb in $withval)
 +      AC_CHECK_HEADER(lmdb.h, AC_CHECK_LIB(lmdb, mdb_dbi_open, [apu_have_lmdb=1]))
 +      if test "$apu_have_lmdb" != "0"; then
 +        APR_ADDTO(LDFLAGS, [-L$withval/lib])
 +        APR_ADDTO(INCLUDES, [-I$withval/include])
 +      fi
 +      CPPFLAGS="$saved_cppflags"
 +      LDFLAGS="$saved_ldflags"
 +    fi
 +
 +    if test "$requested" = "lmdb" -a "$apu_have_lmdb" = 0; then
 +       AC_MSG_ERROR([LMDB requested, but not found])
 +    fi
 +  ])
 +
 +
   dnl We don't pull in GDBM unless the user asks for it, since it's GPL
   AC_ARG_WITH([gdbm], [APR_HELP_STRING([--with-gdbm=DIR], [enable GDBM support])],
   [
@@ -668,6 +699,7 @@ AC_DEFUN([APU_CHECK_DBM], [
     fi
     if test "$apu_want_db" != "0"; then
 +      AC_MSG_NOTICE([checking for Berkeley DB $requested in $user_places])
       APU_CHECK_DB($requested, $user_places)
       if test "$apu_have_db" = "0"; then
         AC_ERROR(Berkeley DB not found.)
@@ -680,7 +712,7 @@ AC_DEFUN([APU_CHECK_DBM], [
   fi
   case "$requested" in
 -    sdbm | gdbm | ndbm | db)
 +    lmdb | sdbm | gdbm | ndbm | db)
       eval "apu_use_$requested=1"
       apu_default_dbm=$requested
       ;;
@@ -709,11 +741,13 @@ AC_DEFUN([APU_CHECK_DBM], [
   AC_MSG_CHECKING(for default DBM)
   AC_MSG_RESULT($apu_default_dbm)
 +  AC_SUBST(apu_use_lmdb)
   AC_SUBST(apu_use_sdbm)
   AC_SUBST(apu_use_gdbm)
   AC_SUBST(apu_use_ndbm)
   AC_SUBST(apu_use_db)
 +  AC_SUBST(apu_have_lmdb)
   AC_SUBST(apu_have_sdbm)
   AC_SUBST(apu_have_gdbm)
   AC_SUBST(apu_have_ndbm)
@@ -738,8 +772,13 @@ AC_DEFUN([APU_CHECK_DBM], [
     APR_ADDTO(LDADD_dbm_ndbm, [-l$apu_ndbm_lib])
   fi
 +  if test "$apu_have_lmdb" = "1"; then
 +    APR_ADDTO(LDADD_dbm_lmdb, [-llmdb])
 +  fi
 +
   AC_SUBST(LDADD_dbm_db)
   AC_SUBST(LDADD_dbm_gdbm)
   AC_SUBST(LDADD_dbm_ndbm)
 +  AC_SUBST(LDADD_dbm_lmdb)
 ])
 diff --git a/build/dso.m4 b/build/dso.m4
 index 2c5df6b..7ac6e03 100644
 --- a/build/dso.m4
 +++ b/build/dso.m4
@@ -60,6 +60,7 @@ yes
      test $apu_have_db = 1 && objs="$objs dbm/apr_dbm_berkeleydb.lo"
      test $apu_have_gdbm = 1 && objs="$objs dbm/apr_dbm_gdbm.lo"
      test $apu_have_ndbm = 1 && objs="$objs dbm/apr_dbm_ndbm.lo"
 +     test $apu_have_lmdb = 1 && objs="$objs dbm/apr_dbm_lmdb.lo"
      test $apu_has_ldap = 1 && objs="$objs ldap/apr_ldap_init.lo"
      test $apu_has_ldap = 1 && objs="$objs ldap/apr_ldap_option.lo"
      test $apu_has_ldap = 1 && objs="$objs ldap/apr_ldap_rebind.lo"
@@ -81,11 +82,11 @@ yes
      APRUTIL_LIBS="$APRUTIL_LIBS $LDADD_crypto_openssl $LDADD_crypto_nss $LDADD_crypto_commoncrypto"
      APRUTIL_LIBS="$APRUTIL_LIBS $LDADD_dbd_pgsql $LDADD_dbd_sqlite2 $LDADD_dbd_sqlite3 $LDADD_dbd_oracle $LDADD_dbd_mysql $LDADD_dbd_odbc"
 -     APRUTIL_LIBS="$APRUTIL_LIBS $LDADD_dbm_db $LDADD_dbm_gdbm $LDADD_dbm_ndbm"
 +     APRUTIL_LIBS="$APRUTIL_LIBS $LDADD_dbm_db $LDADD_dbm_gdbm $LDADD_dbm_ndbm $LDADD_dbm_lmdb"
      APRUTIL_LIBS="$APRUTIL_LIBS $LDADD_ldap"
      APRUTIL_EXPORT_LIBS="$APRUTIL_EXPORT_LIBS $LDADD_crypto_openssl $LDADD_crypto_nss $LDADD_crypto_commoncrypto"
      APRUTIL_EXPORT_LIBS="$APRUTIL_EXPORT_LIBS $LDADD_dbd_pgsql $LDADD_dbd_sqlite2 $LDADD_dbd_sqlite3 $LDADD_dbd_oracle $LDADD_dbd_mysql $LDADD_dbd_odbc"
 -     APRUTIL_EXPORT_LIBS="$APRUTIL_EXPORT_LIBS $LDADD_dbm_db $LDADD_dbm_gdbm $LDADD_dbm_ndbm"
 +     APRUTIL_EXPORT_LIBS="$APRUTIL_EXPORT_LIBS $LDADD_dbm_db $LDADD_dbm_gdbm $LDADD_dbm_ndbm $LDADD_dbm_lmdb"
      APRUTIL_EXPORT_LIBS="$APRUTIL_EXPORT_LIBS $LDADD_ldap"
   else
@@ -104,6 +105,7 @@ yes
      test $apu_have_db = 1 && dsos="$dsos dbm/apr_dbm_db.la"
      test $apu_have_gdbm = 1 && dsos="$dsos dbm/apr_dbm_gdbm.la"
      test $apu_have_ndbm = 1 && dsos="$dsos dbm/apr_dbm_ndbm.la"
 +     test $apu_have_lmdb = 1 && dsos="$dsos dbm/apr_dbm_lmdb.la"
      test $apu_has_ldap = 1 && dsos="$dsos ldap/apr_ldap.la"
      if test -n "$dsos"; then
 diff --git a/dbm/apr_dbm.c b/dbm/apr_dbm.c
 index 8b58f83..c846dd0 100644
 --- a/dbm/apr_dbm.c
 +++ b/dbm/apr_dbm.c
@@ -53,6 +53,9 @@
 #elif APU_USE_SDBM
 #define DBM_VTABLE apr_dbm_type_sdbm
 #define DBM_NAME   "sdbm"
 +#elif APU_USE_LMDB
 +#define DBM_VTABLE apr_dbm_type_lmdb
 +#define DBM_NAME   "lmdb"
 #else /* Not in the USE_xDBM list above */
 #error a DBM implementation was not specified
 #endif
@@ -85,6 +88,9 @@ static apr_status_t dbm_open_type(apr_dbm_type_t const* * vtable,
     if (!strcasecmp(type, "default"))     *vtable = &DBM_VTABLE;
 #if APU_HAVE_DB
     else if (!strcasecmp(type, "db"))     *vtable = &apr_dbm_type_db;
 +#endif
 +#if APU_HAVE_LMDB
 +    else if (!strcasecmp(type, "lmdb"))   *vtable = &apr_dbm_type_lmdb;
 #endif
     else if (*type && !strcasecmp(type + 1, "dbm")) {
 #if APU_HAVE_GDBM
@@ -112,6 +118,7 @@ static apr_status_t dbm_open_type(apr_dbm_type_t const* * vtable,
     if (!strcasecmp(type, "default"))        type = DBM_NAME;
     else if (!strcasecmp(type, "db"))        type = "db";
 +    else if (!strcasecmp(type, "lmdb"))      type = "lmdb";
     else if (*type && !strcasecmp(type + 1, "dbm")) {
         if      (*type == 'G' || *type == 'g') type = "gdbm"; 
         else if (*type == 'N' || *type == 'n') type = "ndbm"; 
 diff --git a/dbm/apr_dbm_lmdb.c b/dbm/apr_dbm_lmdb.c
 new file mode 100644
 index 0000000..fe76779
 --- /dev/null
 +++ b/dbm/apr_dbm_lmdb.c
@@ -0,0 +1,376 @@
 +/* Licensed to the Apache Software Foundation (ASF) under one or more
 + * contributor license agreements.  See the NOTICE file distributed with
 + * this work for additional information regarding copyright ownership.
 + * The ASF licenses this file to You under the Apache License, Version 2.0
 + * (the "License"); you may not use this file except in compliance with
 + * the License.  You may obtain a copy of the License at
 + *
 + *     http://www.apache.org/licenses/LICENSE-2.0
 + *
 + * Unless required by applicable law or agreed to in writing, software
 + * distributed under the License is distributed on an "AS IS" BASIS,
 + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 + * See the License for the specific language governing permissions and
 + * limitations under the License.
 + */
 +
 +#include "apr_strings.h"
 +#define APR_WANT_MEMFUNC
 +#include "apr_want.h"
 +#include <stdio.h>
 +
 +#if APR_HAVE_STDLIB_H
 +#include <stdlib.h> /* for abort() */
 +#endif
 +
 +#include "apu.h"
 +
 +#if APU_HAVE_LMDB
 +
 +#include <lmdb.h>
 +
 +#include "apr_dbm_private.h"
 +
 +typedef struct {
 +    MDB_dbi dbi;
 +    MDB_cursor *cursor;
 +    MDB_txn *txn;
 +    MDB_env *env;
 +} real_file_t;
 +
 +
 +#define APR_DBM_LMDBMODE_RO       MDB_RDONLY
 +#define APR_DBM_LMDBMODE_RWCREATE MDB_CREATE
 +#define APR_DBM_LMDBMODE_RW       (MDB_RDONLY + MDB_CREATE + 1)
 +#define APR_DBM_LMDBMODE_RWTRUNC  (APR_DBM_LMDBMODE_RW + 1)
 +
 +/* --------------------------------------------------------------------------
 +**
 +** UTILITY FUNCTIONS
 +*/
 +
 +/* Map a DB error to an apr_status_t */
 +static apr_status_t db2s(int dberr)
 +{
 +    /* MDB_* error codes are negative, which are mapped to EGENERAL;
 +     * positive error codes are errno which maps directly to
 +     * apr_status_t. MDB_ codes could be mapped to some status code
 +     * region. */
 +    return dberr < 0 ? APR_EGENERAL : dberr;
 +}
 +
 +/* Handle the return code of an mdb_* function (dberr), store the
 + * error string for access via apr_dbm_geterror(), return translated
 + * to an apr_status_t. */
 +static apr_status_t set_error(apr_dbm_t *dbm, int dberr)
 +{
 +    if ((dbm->errcode = dberr) == MDB_SUCCESS) {
 +        dbm->errmsg = NULL;
 +    }
 +    else {
 +        dbm->errmsg = mdb_strerror(dberr);
 +    }
 +
 +    return db2s(dberr);
 +}
 +
 +
 +/* --------------------------------------------------------------------------
 +**
 +** DEFINE THE VTABLE FUNCTIONS FOR LMDB
 +**
 +*/
 +
 +#define DEFAULT_ENV_FLAGS (MDB_NOSUBDIR|MDB_NOSYNC)
 +
 +static apr_status_t vt_lmdb_open(apr_dbm_t **pdb, const char *pathname,
 +                                 apr_int32_t mode, apr_fileperms_t perm,
 +                                 apr_pool_t *pool)
 +{
 +    real_file_t file;
 +    int dbi_open_flags = 0;
 +    int dbmode = 0;
 +    int truncate = 0;
 +
 +    *pdb = NULL;
 +    switch (mode) {
 +    case APR_DBM_READONLY:
 +        dbmode = APR_DBM_LMDBMODE_RO;
 +        break;
 +    case APR_DBM_READWRITE:
 +        dbmode = APR_DBM_LMDBMODE_RW;
 +        break;
 +    case APR_DBM_RWCREATE:
 +        dbi_open_flags = APR_DBM_LMDBMODE_RWCREATE;
 +        break;
 +    case APR_DBM_RWTRUNC:
 +        truncate = APR_DBM_LMDBMODE_RWTRUNC;
 +        break;
 +    default:
 +        return APR_EINVAL;
 +    }
 +
 +    {
 +        int dberr;
 +        file.txn = NULL;
 +        file.cursor = NULL;
 +        file.env = NULL;
 +
 +        dberr = mdb_env_create(&file.env);
 +        if (dberr == 0) {
 +            /*   Default to 2GB map size which limits the total database
 +             *   size to something reasonable. */
 +            dberr = mdb_env_set_mapsize(file.env, INT32_MAX);
 +        }
 +
 +        if (dberr == 0) {
 +            dberr = mdb_env_open(file.env, pathname, dbmode | DEFAULT_ENV_FLAGS, apr_posix_perms2mode(perm));
 +        }
 +
 +        if (dberr == 0) {
 +            dberr = mdb_txn_begin(file.env, NULL, dbmode, &file.txn);
 +        }
 +
 +        if (dberr == 0) {
 +            dberr = mdb_dbi_open(file.txn, NULL, dbi_open_flags, &file.dbi);
 +
 +            /* if mode == APR_DBM_RWTRUNC, drop database */
 +            if ((dberr == 0) && truncate) {
 +                dberr = mdb_drop(file.txn, file.dbi, 0);
 +                if (dberr != 0) {
 +                    mdb_dbi_close(file.env, file.dbi);
 +                }
 +            }
 +        }
 +
 +        if (dberr != 0) {
 +            /* close the env handler */
 +            if (file.env) 
 +                mdb_env_close(file.env);
 +
 +            return db2s(dberr);
 +        }
 +    }
 +
 +    /* we have an open database... return it */
 +    *pdb = apr_pcalloc(pool, sizeof(**pdb));
 +    (*pdb)->pool = pool;
 +    (*pdb)->type = &apr_dbm_type_lmdb;
 +    (*pdb)->file = apr_pmemdup(pool, &file, sizeof(file));
 +
 +    /* ### register a cleanup to close the DBM? */
 +
 +    return APR_SUCCESS;
 +}
 +
 +static void vt_lmdb_close(apr_dbm_t *dbm)
 +{
 +    real_file_t *f = dbm->file;
 +
 +    /* try to commit all transactions that haven't been commited yet on close */
 +    if (f->txn) {
 +       mdb_txn_commit(f->txn);
 +       f->txn = NULL;
 +       f->cursor = NULL;
 +    }
 +
 +    if (f->cursor) {
 +        mdb_cursor_close(f->cursor);
 +        f->cursor = NULL;
 +    }
 +
 +    mdb_dbi_close(f->env, f->dbi);
 +    mdb_env_close(f->env);
 +
 +    f->env = NULL;
 +    f->dbi = 0;
 +}
 +
 +static apr_status_t vt_lmdb_fetch(apr_dbm_t *dbm, apr_datum_t key,
 +                                  apr_datum_t * pvalue)
 +{
 +    real_file_t *f = dbm->file;
 +    MDB_val ckey = { 0 };
 +    MDB_val rd = { 0 };
 +    int dberr;
 +
 +    ckey.mv_data = key.dptr;
 +    ckey.mv_size = key.dsize;
 +
 +    dberr = mdb_get(f->txn, f->dbi, &(ckey), &(rd));
 +
 +    /* "not found" is not an error. return zero'd value. */
 +    if (dberr == MDB_NOTFOUND) {
 +        memset(&rd, 0, sizeof(rd));
 +        dberr = 0;
 +    }
 +
 +    pvalue->dptr = rd.mv_data;
 +    pvalue->dsize = rd.mv_size;
 +
 +    /* store the error info into DBM, and return a status code. Also, note
 +       that *pvalue should have been cleared on error. */
 +    return set_error(dbm, dberr);
 +}
 +
 +static apr_status_t vt_lmdb_store(apr_dbm_t *dbm, apr_datum_t key,
 +                                  apr_datum_t value)
 +{
 +    real_file_t *f = dbm->file;
 +    int rv;
 +    MDB_val ckey = { 0 };
 +    MDB_val cvalue = { 0 };
 +
 +    ckey.mv_data = key.dptr;
 +    ckey.mv_size = key.dsize;
 +
 +    cvalue.mv_data = value.dptr;
 +    cvalue.mv_size = value.dsize;
 +
 +    if ((rv = mdb_put(f->txn, f->dbi, &ckey, &cvalue, 0)) == 0) {
 +        /* commit transaction */
 +        if ((rv = mdb_txn_commit(f->txn)) == MDB_SUCCESS) {
 +            f->cursor = NULL;
 +            rv = mdb_txn_begin(f->env, NULL, 0, &f->txn);
 +        }
 +
 +        /* if mdb_txn_commit OR mdb_txn_begin fails ... */
 +        if (rv != MDB_SUCCESS) {
 +            f->txn = NULL;
 +        }
 +    }
 +
 +    /* store any error info into DBM, and return a status code. */
 +    return set_error(dbm, rv);
 +}
 +
 +static apr_status_t vt_lmdb_del(apr_dbm_t *dbm, apr_datum_t key)
 +{
 +    real_file_t *f = dbm->file;
 +    int rv;
 +    MDB_val ckey = { 0 };
 +
 +    ckey.mv_data = key.dptr;
 +    ckey.mv_size = key.dsize;
 +
 +    if ((rv = mdb_del(f->txn, f->dbi, &ckey, NULL)) == 0) {
 +        /* commit transaction */
 +        if ((rv = mdb_txn_commit(f->txn)) == MDB_SUCCESS) {
 +            f->cursor = NULL;
 +            rv = mdb_txn_begin(f->env, NULL, 0, &f->txn);
 +        }
 +
 +        /* if mdb_txn_commit OR mdb_txn_begin fails ... */
 +        if (rv != MDB_SUCCESS) {
 +            f->txn = NULL;
 +        }
 +    }
 +
 +    /* store any error info into DBM, and return a status code. */
 +    return set_error(dbm, rv);
 +}
 +
 +static int vt_lmdb_exists(apr_dbm_t *dbm, apr_datum_t key)
 +{
 +    real_file_t *f = dbm->file;
 +    MDB_val ckey = { 0 };   /* converted key */
 +    MDB_val data = { 0 };
 +    int dberr;
 +
 +    ckey.mv_data = key.dptr;
 +    ckey.mv_size = key.dsize;
 +
 +    dberr = mdb_get(f->txn, f->dbi, &(ckey), &(data));
 +
 +    /* note: the result data is "loaned" to us; we don't need to free it */
 +
 +    /* DB returns DB_NOTFOUND if it doesn't exist. but we want to say
 +       that *any* error means it doesn't exist. */
 +    return dberr == 0;
 +}
 +
 +static apr_status_t vt_lmdb_firstkey(apr_dbm_t *dbm, apr_datum_t * pkey)
 +{
 +    real_file_t *f = dbm->file;
 +    MDB_val first, data;
 +    int dberr;
 +
 +    if ((dberr = mdb_cursor_open(f->txn, f->dbi, &f->cursor)) == 0) {
 +        dberr = mdb_cursor_get(f->cursor, &first, &data, MDB_FIRST);
 +        if (dberr == MDB_NOTFOUND) {
 +            memset(&first, 0, sizeof(first));
 +            mdb_cursor_close(f->cursor);
 +            f->cursor = NULL;
 +            dberr = 0;
 +        }
 +    }
 +    else {
 +        /* clear first if mdb_cursor_open fails */
 +        memset(&first, 0, sizeof(first));
 +    }
 +
 +    pkey->dptr = first.mv_data;
 +    pkey->dsize = first.mv_size;
 +
 +    /* store any error info into DBM, and return a status code. */
 +    return set_error(dbm, dberr);
 +}
 +
 +static apr_status_t vt_lmdb_nextkey(apr_dbm_t *dbm, apr_datum_t * pkey)
 +{
 +    real_file_t *f = dbm->file;
 +    MDB_val ckey, data;
 +    int dberr;
 +
 +    ckey.mv_data = pkey->dptr;
 +    ckey.mv_size = pkey->dsize;
 +
 +    if (f->cursor == NULL) {
 +        return APR_EINVAL;
 +    }
 +
 +    dberr = mdb_cursor_get(f->cursor, &ckey, &data, MDB_NEXT);
 +    if (dberr == MDB_NOTFOUND) {
 +        mdb_cursor_close(f->cursor);
 +        f->cursor = NULL;
 +        dberr = 0;
 +        ckey.mv_data = NULL;
 +        ckey.mv_size = 0;
 +    }
 +
 +    pkey->dptr = ckey.mv_data;
 +    pkey->dsize = ckey.mv_size;
 +
 +    /* store any error info into DBM, and return a status code. */
 +    return set_error(dbm, dberr);
 +}
 +
 +static void vt_lmdb_freedatum(apr_dbm_t *dbm, apr_datum_t data)
 +{
 +    /* nothing to do */
 +}
 +
 +static void vt_lmdb_usednames(apr_pool_t *pool, const char *pathname,
 +                              const char **used1, const char **used2)
 +{
 +    *used1 = apr_pstrdup(pool, pathname);
 +    *used2 = apr_pstrcat(pool, pathname, "-lock", NULL);
 +}
 +
 +
 +APU_MODULE_DECLARE_DATA const apr_dbm_type_t apr_dbm_type_lmdb = {
 +    "lmdb",
 +
 +    vt_lmdb_open,
 +    vt_lmdb_close,
 +    vt_lmdb_fetch,
 +    vt_lmdb_store,
 +    vt_lmdb_del,
 +    vt_lmdb_exists,
 +    vt_lmdb_firstkey,
 +    vt_lmdb_nextkey,
 +    vt_lmdb_freedatum,
 +    vt_lmdb_usednames
 +};
 +
 +#endif /* APU_HAVE_LMDB */
 diff --git a/include/apr_dbm.h b/include/apr_dbm.h
 index ad1b4f3..fba0cdd 100644
 --- a/include/apr_dbm.h
 +++ b/include/apr_dbm.h
@@ -64,6 +64,7 @@ typedef struct
  * @param type The type of the DBM (not all may be available at run time)
  * <pre>
  *  db   for Berkeley DB files
 + *  lmdb for LMDB files
  *  gdbm for GDBM files
  *  ndbm for NDBM files
  *  sdbm for SDBM files (always available)
 diff --git a/include/apu.h.in b/include/apu.h.in
 index 184682d..cb89779 100644
 --- a/include/apu.h.in
 +++ b/include/apu.h.in
@@ -100,6 +100,7 @@
  * we always have SDBM (it's in our codebase)
  */
 #define APU_HAVE_SDBM   @apu_have_sdbm@
 +#define APU_HAVE_LMDB   @apu_have_lmdb@
 #define APU_HAVE_GDBM   @apu_have_gdbm@
 #define APU_HAVE_NDBM   @apu_have_ndbm@
 #define APU_HAVE_DB     @apu_have_db@
 diff --git a/include/apu.hnw b/include/apu.hnw
 index 0bc3a2c..c902bae 100644
 --- a/include/apu.hnw
 +++ b/include/apu.hnw
@@ -86,6 +86,7 @@
 #define APU_HAVE_SDBM           1
 #ifndef APU_DSO_MODULE_BUILD
 +#define APU_HAVE_LMDB           0
 #define APU_HAVE_GDBM           0
 #define APU_HAVE_NDBM           0
 #define APU_HAVE_DB             0
 diff --git a/include/apu.hw b/include/apu.hw
 index 21fbedf..e86bdb4 100644
 --- a/include/apu.hw
 +++ b/include/apu.hw
@@ -108,6 +108,7 @@
 #define APU_HAVE_SDBM           1
 #ifndef APU_DSO_MODULE_BUILD
 +#define APU_HAVE_LMDB           0
 #define APU_HAVE_GDBM           0
 #define APU_HAVE_NDBM           0
 #define APU_HAVE_DB             0
 diff --git a/include/apu.hwc b/include/apu.hwc
 index 2c3fa00..6eebe0b 100644
 --- a/include/apu.hwc
 +++ b/include/apu.hwc
@@ -108,6 +108,7 @@
 #define APU_HAVE_SDBM           1
 #ifndef APU_DSO_MODULE_BUILD
 +#define APU_HAVE_LMDB           0
 #define APU_HAVE_GDBM           0
 #define APU_HAVE_NDBM           0
 #define APU_HAVE_DB             0
 diff --git a/include/private/apr_dbm_private.h b/include/private/apr_dbm_private.h
 index 020d3a6..e2032b4 100644
 --- a/include/private/apr_dbm_private.h
 +++ b/include/private/apr_dbm_private.h
@@ -112,6 +112,7 @@ struct apr_dbm_t
 APU_MODULE_DECLARE_DATA extern const apr_dbm_type_t apr_dbm_type_sdbm;
 APU_MODULE_DECLARE_DATA extern const apr_dbm_type_t apr_dbm_type_gdbm;
 APU_MODULE_DECLARE_DATA extern const apr_dbm_type_t apr_dbm_type_ndbm;
 +APU_MODULE_DECLARE_DATA extern const apr_dbm_type_t apr_dbm_type_lmdb;
 APU_MODULE_DECLARE_DATA extern const apr_dbm_type_t apr_dbm_type_db;
 #ifdef __cplusplus
 diff --git a/include/private/apu_select_dbm.h.in b/include/private/apu_select_dbm.h.in
 index b69aec0..b431c61 100644
 --- a/include/private/apu_select_dbm.h.in
 +++ b/include/private/apu_select_dbm.h.in
@@ -21,6 +21,7 @@
 ** The following macros control what features APRUTIL will use
 */
 #define APU_USE_SDBM    @apu_use_sdbm@
 +#define APU_USE_LMDB    @apu_use_lmdb@
 #define APU_USE_NDBM    @apu_use_ndbm@
 #define APU_USE_GDBM    @apu_use_gdbm@
 #define APU_USE_DB      @apu_use_db@
 diff --git a/test/testdbm.c b/test/testdbm.c
 index 4f6becb..df679f4 100644
 --- a/test/testdbm.c
 +++ b/test/testdbm.c
@@ -153,6 +153,9 @@ static void test_dbm_traversal(abts_case *tc, apr_dbm_t *db, dbm_table_t *table)
         rv = apr_dbm_nextkey(db, &key);
         ABTS_INT_EQUAL(tc, APR_SUCCESS, rv);
 +
 +        /** avoid infinite loop */
 +        if (rv != APR_SUCCESS) break;
     } while (1);
     for (i = 0; i < NUM_TABLE_ROWS; i++) {
@@ -170,6 +173,7 @@ static void test_dbm(abts_case *tc, void *data)
     dbm_table_t *table;
     const char *type = data;
     const char *file = apr_pstrcat(p, "data/test-", type, NULL);
 +    const char *nofile = apr_pstrcat(p, "data/no-such-test-", type, NULL);
     rv = apr_dbm_open_ex(&db, type, file, APR_DBM_RWCREATE, APR_OS_DEFAULT, p);
     ABTS_INT_EQUAL(tc, APR_SUCCESS, rv);
@@ -198,12 +202,18 @@ static void test_dbm(abts_case *tc, void *data)
     test_dbm_fetch(tc, db, table);
     apr_dbm_close(db);
 +
 +    rv = apr_dbm_open_ex(&db, type, nofile, APR_DBM_READONLY, APR_FPROT_OS_DEFAULT, p);
 +    ABTS_TRUE(tc, rv != APR_SUCCESS);
 }
 abts_suite *testdbm(abts_suite *suite)
 {
     suite = ADD_SUITE(suite);
 +#if APU_HAVE_LMDB
 +    abts_run_test(suite, test_dbm, "lmdb");
 +#endif
 #if APU_HAVE_GDBM
     abts_run_test(suite, test_dbm, "gdbm");
 #endif
--- a/apr-util-1.6.3-r1908584.patch
+++ b/apr-util-1.6.3-r1908584.patch
@ -1,486 +0,0 @@
 # ./pullrev.sh 1908584
 http://svn.apache.org/viewvc?view=revision&revision=1908584
 + Forcibly disable ENGINE support.
 --- apr-1.6.3/build/crypto.m4
 +++ apr-1.6.3/build/crypto.m4
@@ -53,11 +53,11 @@
             crypto_library_enabled=1
           fi
         done
 -	if test "$crypto_library_enabled" = "1"; then
 +        if test "$crypto_library_enabled" = "1"; then
           AC_MSG_NOTICE([Crypto was requested but no crypto library was found; autodetecting possible libraries])
         else
           AC_ERROR([Crypto was requested but all possible crypto libraries were disabled.])
 -	fi
 +        fi
       fi
       APU_CHECK_CRYPTO_OPENSSL
@@ -91,15 +91,14 @@
     if test "$withval" = "yes"; then
       AC_CHECK_HEADERS(openssl/x509.h, [openssl_have_headers=1])
       AC_CHECK_LIB(crypto, EVP_CIPHER_CTX_new, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto))
 -      if test "$openssl_have_headers" != "0" && test "$openssl_have_libs" != "0"; then
 +      if test "$openssl_have_headers" = "1" && test "$openssl_have_libs" = "1"; then
         apu_have_openssl=1
       fi
     elif test "$withval" = "no"; then
       apu_have_openssl=0
     else
 -
       openssl_CPPFLAGS="-I$withval/include"
 -      openssl_LDFLAGS="-L$withval/lib "
 +      openssl_LDFLAGS="-L$withval/lib -L$withval/lib64"
       APR_ADDTO(CPPFLAGS, [$openssl_CPPFLAGS])
       APR_ADDTO(LDFLAGS, [$openssl_LDFLAGS])
@@ -107,16 +106,16 @@
       AC_MSG_NOTICE(checking for openssl in $withval)
       AC_CHECK_HEADERS(openssl/x509.h, [openssl_have_headers=1])
       AC_CHECK_LIB(crypto, EVP_CIPHER_CTX_new, AC_CHECK_LIB(ssl, SSL_accept, [openssl_have_libs=1],,-lcrypto))
 -      if test "$openssl_have_headers" != "0" && test "$openssl_have_libs" != "0"; then
 +      if test "$openssl_have_headers" = "1" && test "$openssl_have_libs" = "1"; then
         apu_have_openssl=1
 -        APR_ADDTO(APRUTIL_LDFLAGS, [-L$withval/lib])
 -        APR_ADDTO(APRUTIL_INCLUDES, [-I$withval/include])
 +        APR_ADDTO(APRUTIL_INCLUDES, [$openssl_CPPFLAGS])
 +        APR_ADDTO(APRUTIL_LDFLAGS, [$openssl_LDFLAGS])
       fi
 -
 -      AC_CHECK_DECLS([EVP_PKEY_CTX_new], [], [],
 -                     [#include <openssl/evp.h>])
 -
     fi
 +    if test "$apu_have_openssl" = "1"; then
 +        AC_CHECK_LIB(crypto, OPENSSL_init_crypto)
 +        AC_CHECK_FUNCS([OPENSSL_init_crypto])
 +    fi
   ], [
     apu_have_openssl=0
   ])
@@ -130,18 +129,12 @@
     apu_have_crypto=1
     AC_MSG_CHECKING([for const input buffers in OpenSSL])
 -    AC_TRY_COMPILE([#include <openssl/rsa.h>],
 -        [ const unsigned char * buf;
 -          unsigned char * outbuf;
 -          RSA rsa;
 -
 -                RSA_private_decrypt(1,
 -                                                        buf,
 -                                                        outbuf,
 -                                                        &rsa,
 -                                                        RSA_PKCS1_PADDING);
 -
 -        ],
 +    AC_TRY_COMPILE(
 +        [#include <openssl/evp.h>],
 +        [ EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
 +          const unsigned char key[128] = {0}, iv[128] = {0};
 +          EVP_EncryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv);
 +          EVP_CIPHER_CTX_free(ctx); ],
         [AC_MSG_RESULT([yes])]
         [AC_DEFINE([CRYPTO_OPENSSL_CONST_BUFFERS], 1, [Define that OpenSSL uses const buffers])],
         [AC_MSG_RESULT([no])])
 --- apr-1.6.3/crypto/apr_crypto_openssl.c
 +++ apr-1.6.3/crypto/apr_crypto_openssl.c
@@ -17,6 +17,7 @@
 #include "apr_lib.h"
 #include "apu.h"
 #include "apu_errno.h"
 +#include "apu_config.h"
 #include <ctype.h>
 #include <assert.h>
@@ -30,24 +31,69 @@
 #if APU_HAVE_CRYPTO
 +#ifndef OPENSSL_API_COMPAT
 +#define OPENSSL_API_COMPAT 0x10101000L /* for ENGINE API */
 +#endif
 +
 #include <openssl/evp.h>
 #include <openssl/rand.h>
 #include <openssl/engine.h>
 +#include <openssl/opensslv.h>
 +#if OPENSSL_VERSION_NUMBER >= 0x30000000
 +#include <openssl/macros.h>
 +#include <openssl/core_names.h>
 +#endif
 -#define LOG_PREFIX "apr_crypto_openssl: "
 +#if defined(LIBRESSL_VERSION_NUMBER)
 -#ifndef APR_USE_OPENSSL_PRE_1_1_API
 -#if defined(LIBRESSL_VERSION_NUMBER)
 /* LibreSSL declares OPENSSL_VERSION_NUMBER == 2.0 but does not include most
  * changes from OpenSSL >= 1.1 (new functions, macros, deprecations, ...), so
  * we have to work around this...
  */
 -#define APR_USE_OPENSSL_PRE_1_1_API (1)
 +#define APR_USE_OPENSSL_PRE_1_0_API     0
 +#if LIBRESSL_VERSION_NUMBER < 0x2070000f
 +#define APR_USE_OPENSSL_PRE_1_1_API     1
 #else
 -#define APR_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
 +#define APR_USE_OPENSSL_PRE_1_1_API     0
 #endif
 +/* TODO: keep up with LibreSSL latest versions */
 +#define APR_USE_OPENSSL_PRE_1_1_1_API   1
 +#define APR_USE_OPENSSL_PRE_3_0_API     1
 +
 +#else  /* defined(LIBRESSL_VERSION_NUMBER) */
 +
 +#if OPENSSL_VERSION_NUMBER < 0x10000000L
 +#define APR_USE_OPENSSL_PRE_1_0_API     1
 +#else
 +#define APR_USE_OPENSSL_PRE_1_0_API     0
 #endif
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +#define APR_USE_OPENSSL_PRE_1_1_API     1
 +#else
 +#define APR_USE_OPENSSL_PRE_1_1_API     0
 +#endif
 +#if OPENSSL_VERSION_NUMBER < 0x10101000L
 +#define APR_USE_OPENSSL_PRE_1_1_1_API   1
 +#else
 +#define APR_USE_OPENSSL_PRE_1_1_1_API   0
 +#endif
 +#if OPENSSL_VERSION_NUMBER < 0x30000000L
 +#define APR_USE_OPENSSL_PRE_3_0_API     1
 +#else
 +#define APR_USE_OPENSSL_PRE_3_0_API     0
 +#endif
 +#endif /* defined(LIBRESSL_VERSION_NUMBER) */
 +
 +#if APR_USE_OPENSSL_PRE_3_0_API \
 +    || (defined(OPENSSL_API_LEVEL) && OPENSSL_API_LEVEL < 30000)
 +#define APR_USE_OPENSSL_ENGINE_API 0
 +#else
 +#define APR_USE_OPENSSL_ENGINE_API 0
 +#endif
 +
 +#define LOG_PREFIX "apr_crypto_openssl: "
 +
 struct apr_crypto_t {
     apr_pool_t *pool;
     const apr_crypto_driver_t *provider;
@@ -58,7 +104,11 @@
 };
 struct apr_crypto_config_t {
 +#if APR_USE_OPENSSL_ENGINE_API
     ENGINE *engine;
 +#else
 +    void *engine;
 +#endif
 };
 struct apr_crypto_key_t {
@@ -113,9 +163,21 @@
  */
 static apr_status_t crypto_shutdown(void)
 {
 +#if HAVE_OPENSSL_INIT_CRYPTO
 +    /* Openssl v1.1+ handles all termination automatically. Do
 +     * nothing in this case.
 +     */
 +
 +#else
 +    /* Termination below is for legacy Openssl versions v1.0.x and
 +     * older.
 +     */
 +
     ERR_free_strings();
     EVP_cleanup();
     ENGINE_cleanup();
 +#endif
 +
     return APR_SUCCESS;
 }
@@ -130,6 +192,19 @@
 static apr_status_t crypto_init(apr_pool_t *pool, const char *params,
         const apu_err_t **result)
 {
 +#if HAVE_OPENSSL_INIT_CRYPTO
 +    /* Openssl v1.1+ handles all initialisation automatically, apart
 +     * from hints as to how we want to use the library.
 +     *
 +     * We tell openssl we want to include engine support.
 +     */
 +    OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL);
 +
 +#else
 +    /* Configuration below is for legacy versions Openssl v1.0 and
 +     * older.
 +     */
 +
 #if APR_USE_OPENSSL_PRE_1_1_API
     (void)CRYPTO_malloc_init();
 #else
@@ -140,6 +215,7 @@
     OpenSSL_add_all_algorithms();
     ENGINE_load_builtin_engines();
     ENGINE_register_all_complete();
 +#endif
     apr_pool_cleanup_register(pool, pool, crypto_shutdown_helper,
             apr_pool_cleanup_null);
@@ -203,12 +279,13 @@
  */
 static apr_status_t crypto_cleanup(apr_crypto_t *f)
 {
 -
 +#if APR_USE_OPENSSL_ENGINE_API
     if (f->config->engine) {
         ENGINE_finish(f->config->engine);
         ENGINE_free(f->config->engine);
         f->config->engine = NULL;
     }
 +#endif
     return APR_SUCCESS;
 }
@@ -235,11 +312,10 @@
         const apr_crypto_driver_t *provider, const char *params,
         apr_pool_t *pool)
 {
 -    apr_crypto_config_t *config = NULL;
 -    apr_crypto_t *f = apr_pcalloc(pool, sizeof(apr_crypto_t));
 -
 +    apr_crypto_t *f;
 +    apr_crypto_config_t *config;
     const char *engine = NULL;
 -
 +    apr_status_t status = APR_SUCCESS;
     struct {
         const char *field;
         const char *value;
@@ -253,8 +329,9 @@
     char **elts = NULL;
     char *elt;
     int i = 0, j;
 -    apr_status_t status;
 +    *ff = NULL;
 +
     if (params) {
         if (APR_SUCCESS != (status = apr_tokenize_to_argv(params, &elts, pool))) {
             return status;
@@ -287,25 +364,45 @@
         engine = fields[0].value;
     }
 +    f = apr_pcalloc(pool, sizeof(apr_crypto_t));
     if (!f) {
         return APR_ENOMEM;
     }
 -    *ff = f;
 -    f->pool = pool;
 -    f->provider = provider;
 -    config = f->config = apr_pcalloc(pool, sizeof(apr_crypto_config_t));
 +    f->config = config = apr_pcalloc(pool, sizeof(apr_crypto_config_t));
     if (!config) {
         return APR_ENOMEM;
     }
 +    f->pool = pool;
 +    f->provider = provider;
 +    /* The default/builtin "openssl" engine is the same as NULL though with
 +     * openssl-3+ it's called something else, keep NULL for that name.
 +     */
 +    if (engine && strcasecmp(engine, "openssl") != 0) {
 +#if APR_USE_OPENSSL_ENGINE_API
 +        config->engine = ENGINE_by_id(engine);
 +        if (!config->engine) {
 +            return APR_ENOENGINE;
 +        }
 +        if (!ENGINE_init(config->engine)) {
 +            status = APR_EINITENGINE;
 +            goto cleanup;
 +        }
 +#else
 +        return APR_ENOTIMPL;
 +#endif
 +    }
 +
     f->result = apr_pcalloc(pool, sizeof(apu_err_t));
     if (!f->result) {
 -        return APR_ENOMEM;
 +        status = APR_ENOMEM;
 +        goto cleanup;
     }
     f->types = apr_hash_make(pool);
     if (!f->types) {
 -        return APR_ENOMEM;
 +        status = APR_ENOMEM;
 +        goto cleanup;
     }
     apr_hash_set(f->types, "3des192", APR_HASH_KEY_STRING, &(key_types[0]));
     apr_hash_set(f->types, "aes128", APR_HASH_KEY_STRING, &(key_types[1]));
@@ -314,28 +411,20 @@
     f->modes = apr_hash_make(pool);
     if (!f->modes) {
 -        return APR_ENOMEM;
 +        status = APR_ENOMEM;
 +        goto cleanup;
     }
     apr_hash_set(f->modes, "ecb", APR_HASH_KEY_STRING, &(key_modes[0]));
     apr_hash_set(f->modes, "cbc", APR_HASH_KEY_STRING, &(key_modes[1]));
 +    *ff = f;
     apr_pool_cleanup_register(pool, f, crypto_cleanup_helper,
 -            apr_pool_cleanup_null);
 -
 -    if (engine) {
 -        config->engine = ENGINE_by_id(engine);
 -        if (!config->engine) {
 -            return APR_ENOENGINE;
 -        }
 -        if (!ENGINE_init(config->engine)) {
 -            ENGINE_free(config->engine);
 -            config->engine = NULL;
 -            return APR_EINITENGINE;
 -        }
 -    }
 -
 +                              apr_pool_cleanup_null);
     return APR_SUCCESS;
 +cleanup:
 +    crypto_cleanup(f);
 +    return status;
 }
 /**
@@ -435,7 +524,7 @@
         return APR_ENOMEM;
     }
     apr_crypto_clear(p, key->key, key->keyLen);
 -
 + 
     return APR_SUCCESS;
 }
 --- apr-1.6.3/test/testcrypto.c
 +++ apr-1.6.3/test/testcrypto.c
@@ -483,6 +483,10 @@
     f1 = make(tc, pool, driver1);
     f2 = make(tc, pool, driver2);
 +    if (!f1 || !f2) {
 +        return;
 +    }
 +
     key1 = passphrase(tc, pool, driver1, f1, type, mode, doPad, description);
     key2 = passphrase(tc, pool, driver2, f2, type, mode, doPad, description);
@@ -577,6 +581,10 @@
     driver = get_openssl_driver(tc, pool);
     f = make(tc, pool, driver);
 +    if (!f) {
 +        return;
 +    }
 +
     keysecret(tc, pool, driver, f, APR_KEY_AES_256, APR_MODE_CBC, 1, 32,
             "KEY_AES_256/MODE_CBC");
     apr_pool_destroy(pool);
@@ -596,6 +604,10 @@
     driver = get_nss_driver(tc, pool);
     f = make(tc, pool, driver);
 +    if (!f) {
 +        return;
 +    }
 +
     keysecret(tc, pool, driver, f, APR_KEY_AES_256, APR_MODE_CBC, 1, 32,
             "KEY_AES_256/MODE_CBC");
     apr_pool_destroy(pool);
@@ -615,6 +627,10 @@
     driver = get_commoncrypto_driver(tc, pool);
     f = make(tc, pool, driver);
 +    if (!f) {
 +        return;
 +    }
 +
     keysecret(tc, pool, driver, f, APR_KEY_AES_256, APR_MODE_CBC, 1, 32,
             "KEY_AES_256/MODE_CBC");
     apr_pool_destroy(pool);
@@ -1166,6 +1182,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_types(&types, f);
         key_3des_192 = apr_hash_get(types, "3des192", APR_HASH_KEY_STRING);
@@ -1209,6 +1229,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_types(&types, f);
         key_3des_192 = apr_hash_get(types, "3des192", APR_HASH_KEY_STRING);
@@ -1252,6 +1276,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_types(&types, f);
         key_3des_192 = apr_hash_get(types, "3des192", APR_HASH_KEY_STRING);
@@ -1293,6 +1321,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_modes(&modes, f);
         mode_ecb = apr_hash_get(modes, "ecb", APR_HASH_KEY_STRING);
@@ -1326,6 +1358,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_modes(&modes, f);
         mode_ecb = apr_hash_get(modes, "ecb", APR_HASH_KEY_STRING);
@@ -1359,6 +1395,10 @@
     if (driver) {
         f = make(tc, pool, driver);
 +        if (!f) {
 +            return;
 +        }
 +
         apr_crypto_get_block_key_modes(&modes, f);
         mode_ecb = apr_hash_get(modes, "ecb", APR_HASH_KEY_STRING);
--- a/apr-util-1.6.3-r1908585.patch
+++ b/apr-util-1.6.3-r1908585.patch
@ -1,22 +0,0 @@
 # ./pullrev.sh 1908585
 http://svn.apache.org/viewvc?view=revision&revision=1908585
 --- apr-util-1.6.3/test/testbuckets.c
 +++ apr-util-1.6.3/test/testbuckets.c
@@ -100,12 +100,12 @@
     apr_size_t len = elen;
     char msg[200];
 -    sprintf(msg, "%s: flatten brigade", ctx);
 +    apr_snprintf(msg, sizeof msg, "%s: flatten brigade", ctx);
     apr_assert_success(tc, msg, apr_brigade_flatten(bb, buf, &len));
 -    sprintf(msg, "%s: length match (%ld not %ld)", ctx,
 -            (long)len, (long)elen);
 +    apr_snprintf(msg, sizeof msg, "%s: length match (%ld not %ld)", ctx,
 +                 (long)len, (long)elen);
     ABTS_ASSERT(tc, msg, len == elen);
 -    sprintf(msg, "%s: result match", msg);
 +    apr_snprintf(msg, sizeof msg, "%s: result match", ctx);
     ABTS_STR_NEQUAL(tc, expect, buf, len);
     free(buf);
 }
--- a/apr-util-1.6.3-r1908586.patch
+++ b/apr-util-1.6.3-r1908586.patch
@ -1,16 +0,0 @@
 https://svn.apache.org/viewvc?view=revision&revision=1908586
 --- apr-util/dbd/apr_dbd_odbc.c
 +++ apr-util/dbd/apr_dbd_odbc.c
@@ -582,8 +582,8 @@
                     (textmode ? atoi(args[*argp]) : *(short *)args[*argp]);
                 break;
             case SQL_INTEGER:
 -                ptr = apr_palloc(pool, sizeof(int));
 -                len = sizeof(int);
 +                ptr = apr_palloc(pool, sizeof(long));
 +                len = sizeof(long);
                 *(long *)ptr =
                     (textmode ? atol(args[*argp]) : *(long *)args[*argp]);
                 break;
--- a/apr-util-configure-c99.patch
+++ b/apr-util-configure-c99.patch
@ -1,18 +0,0 @@
 Add a missing implied int in the Berkeley DB configure probe.  This
 avoids build failures with future Fedora toolchain defaults.
 Submitted upstream: <https://bz.apache.org/bugzilla/show_bug.cgi?id=66396>
 diff --git a/build/dbm.m4 b/build/dbm.m4
 index 57bd131fc3b74099..ffdbdbc0f43e04da 100644
 --- a/build/dbm.m4
 +++ b/build/dbm.m4
@@ -235,7 +235,7 @@ AC_DEFUN([APU_TRY_BERKELEY_DB],
 #include <stdlib.h>
 #include <stdio.h>
 #include <$apu_try_berkeley_db_header>
 -main ()
 +int main ()
 {
   int major, minor, patch;
--- a/ci.fmf
+++ b/ci.fmf
@ -1 +0,0 @@
 resultsdb-testcase: separate
--- a/gating.yaml
+++ b/gating.yaml
@ -1,7 +0,0 @@
 #gating rhel
 --- !Policy
 product_versions:
  - rhel-*
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
--- a/1
+++ b/1
@ -1 +0,0 @@
 http://www.apache.org/dist/apr/
--- a/plans/tier1-internal.fmf
+++ b/plans/tier1-internal.fmf
@ -1,10 +0,0 @@
 summary: Internal Tier1 beakerlib tests
 discover:
    how: fmf
    url: https://gitlab.com/redhat/rhel/tests/apr-util
    filter: "tier:1"
 execute:
    how: tmt
 adjust:
    enabled: false
    when: distro == centos-stream-10
--- a/1
+++ b/1
@ -1 +0,0 @@
 SHA512 (apr-util-1.6.3.tar.bz2) = 8050a481eeda7532ef3751dbd8a5aa6c48354d52904a856ef9709484f4b0cc2e022661c49ddf55ec58253db22708ee0607dfa7705d9270e8fee117ae4f06a0fe
--- a/1
+++ b/1
@ -1 +0,0 @@
 apr-util-1.2.8.tar.gz
--- a/upstream-key.gpg
+++ b/upstream-key.gpg
		`@ -0,0 +1 @@`
							`4cc73bc36ca697419f555476f2fc1c63df6069f4 SOURCES/apr-util-1.6.1.tar.bz2`
		`@ -1 +0,0 @@`
			`SHA512 (apr-util-1.6.3.tar.bz2) = 8050a481eeda7532ef3751dbd8a5aa6c48354d52904a856ef9709484f4b0cc2e022661c49ddf55ec58253db22708ee0607dfa7705d9270e8fee117ae4f06a0fe`