Backport tests from upstream commit 3d1ef3a15c3 (adapted for PG16):
- Test that invalid ssl_ecdh_curve values (colon-separated) are rejected
- Test that valid colon-separated groups are accepted
- Add multi-group configuration to SSL test infrastructure
Resolves: RHEL-119229
Co-authored-by: Cursor <cursoragent@cursor.com>
Backport SSL_CTX_set1_groups_list() from upstream PG18 (commit 3d1ef3a15c3)
to replace the legacy OBJ_sn2nid()/EC_KEY_new_by_curve_name() API in
initialize_ecdh(). This enables ssl_ecdh_curve to accept colon-separated
lists of TLS group names, including post-quantum hybrid groups such as
X25519MLKEM768.
Changes:
- Replace legacy ECDH API with SSL_CTX_set1_groups_list()
- Backport SSLerrmessageExt() helper for proper error messages
- Add errhint for invalid group name diagnostics
- Update GUC description to document colon-separated list support
- Update postgresql.conf.sample with explanatory comment
Resolves: RHEL-119229
Co-authored-by: Cursor <cursoragent@cursor.com>
Rebase postgresql16 from version 16.13 to 16.14.
Updated the source tarball and checksums for the new upstream
release. Added BuildRequires: perl(FindBin) to fix a build
failure caused by FindBin being split out from core Perl in
Perl 5.40 (used by gen_node_support.pl and genbki.pl during
the build). The previous version (13.23) used for upgrades
remains unchanged.
Resolves: RHEL-208694
This commit was created by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
- Fix CVE-2025-12818: libpq undersizes allocations, via integer wraparound
Integer wraparound in PostgreSQL libpq client library functions allows
an application input provider or network peer to cause libpq to undersize
an allocation and write out-of-bounds by hundreds of megabytes, resulting
in segmentation fault.
Resolves: RHEL-128802 [rhel-10.2]
Resolves: RHEL-128801 [rhel-10.1.z]
- Add --with-openssl parameter to upgrade_configure function
- This ensures upgrade server is compiled with OpenSSL support
- Required for SSL/TLS connections during database upgrades
Resolves: RHEL-115264
Symbol postgresql is now used only for setting the default version
of postgresql in the repository. The majorname cant be
used for such usecase due to different behavior of dnf install and dnf
builddep
More about it:
https://github.com/rpm-software-management/dnf5/issues/620
Related: 2255013
