x86_64 GetPageSpeed extras (freenginx-mainline) repository for CentOS/RHEL 9

Update: freenginx-1.31.5-75.el9.gps

Thu, 29 Oct 2026 15:20:37 +0000

Package: freenginx
Summary: High performance web server

Description:
nginx [engine x] is an HTTP and reverse proxy server, as well as a mail proxy server.

Changes:

freenginx-1.31.5-75.el9.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-29): - Bump bundled nginx-module-gps-license 1.10.0 -> 1.11.0: the default license token lookup now tries the canonical /etc/getpagespeed/license.jwt first (one file licenses every GetPageSpeed product on the host), then the legacy /etc/nginx/license.jwt, which keeps working forever; an explicit gps_license_token still wins
freenginx-1.31.5-74.el9.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-17): - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page button label is now reason-aware (missing="Set up your token", expired="Renew license", invalid="Fix your token", revoked="Restart subscription") and its URL carries ?ref=nginx503 so landing-page analytics can attribute 503-driven arrivals.
freenginx-1.31.4-74.el9.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-17): - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page button label is now reason-aware (missing="Set up your token", expired="Renew license", invalid="Fix your token", revoked="Restart subscription") and its URL carries ?ref=nginx503 so landing-page analytics can attribute 503-driven arrivals.
freenginx-1.31.4-73.el9.gps.x86_64 [1.1 MiB]	Changelog by Danila Vershinin (2026-10-13): - Add freenginx-rebased copy of the QUIC BPF reload/upgrade patch; the nginx.org version failed prep on freenginx branches (divergent sockmap declaration and generated BPF code), breaking all 18 freenginx-mainline CI lanes
freenginx-1.31.4-69.el9.gps.x86_64 [1.0 MiB]	Changelog by Danila Vershinin (2026-09-17): - SELinux: allow httpd_t setattr on /dev/null (nginx-gps policy 1.2). With the common "error_log /dev/null;" idiom, every logrotate USR1 log reopen produced a daily [emerg] "chown(/dev/null) failed (13: Permission denied)" because the master chowns error logs to the worker UID and the stock policy denies it silently (dontaudit, no AVC). - SELinux: ship nginx-gps as version-agnostic CIL text instead of a binary .pp. The .pp module format tracks the build chroot's checkpolicy (3.10 emits format 24), which targets one userland update behind (libsepol 3.9, reads 4-23) cannot parse — the module then silently failed to install. - SELinux: %post now emits a warning to stderr when the nginx-gps module fails to install instead of swallowing the error.
freenginx-1.31.4-68.el9.gps.x86_64 [1.0 MiB]	Changelog by Danila Vershinin (2026-09-10): - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new default-off boolean. The stock policy grants httpd_t nothing on the bpf class, so enabling quic_bpf made nginx refuse to start with "failed to create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds the empirically-captured allows (bpf map/prog permissions plus the bpf, perfmon and net_admin capability checks), all gated behind the boolean nginx_quic_bpf, off by default: nothing changes for any install until "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; with the boolean off, behavior is exactly as before.
freenginx-1.31.4-67.el9.gps.x86_64 [1.0 MiB]	Changelog by Danila Vershinin (2026-09-07): - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity probe request and every hard-enforcement 503 left one worker connection un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min monitoring probe could take a server down in about a day (reported by an Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both paths now finalize the request; hard 503s appear in access_log, probe requests remain unlogged. Regression-tested (integration + EL9 e2e with the reporter's exact ss check) and E2E-proven against production.
freenginx-1.31.4-66.el9.gps.x86_64 [1.0 MiB]	Changelog by Danila Vershinin (2026-09-03): - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's unit-test harness (POSIX feature-test macro, test path buffer); shipped module code unchanged. Supersedes the partially-published Release 65 (x86_64-only, cancelled mid-build) so all architectures converge on the E2E-proven build (verified against production: beacon machine identity row landed in repo_license_usage)
freenginx-1.31.4-64.el9.gps.x86_64 [1.0 MiB]	Changelog by Danila Vershinin (2026-08-27): - nginx-ech: new subpackage for ECH (RFC 9849) key generation and rotation, at parity with nginx-mod-ech (shared nginx-ech-keygen implementation) - assert ECH is live at build time: a bogus ssl_ech_file must fail the configuration test instead of degrading to a silent no-op

Update: freenginx-ech-1.31.5-75.el9.gps

Thu, 29 Oct 2026 15:20:37 +0000

Package: freenginx-ech
Summary: Encrypted Client Hello key management for NGINX

Description:
Key generation and rotation for Encrypted Client Hello (ECH, RFC 9849). nginx reads ECH keys while parsing its configuration, so a new key only takes effect on reload, and a client that picked up an older ECHConfigList from a cached HTTPS DNS record still needs the key it encrypted to. nginx handles that by accepting several ssl_ech_file directives: the first is advertised in retry-configs, the rest stay loaded for decryption only. This package ships nginx-ech-keygen, which maintains that rolling set under /etc/nginx/ech and regenerates the include listing them, plus a systemd timer that rotates on a schedule. The timer is not enabled on install and nothing happens until you configure it. Set ECH_PUBLIC_NAME in /etc/sysconfig/nginx-ech-rotate, run "nginx-ech-keygen --init", publish the value it prints in the HTTPS record for your ECH-enabled names, then "systemctl enable --now nginx-ech-rotate.timer". ECH only helps if the HTTPS record is served from a DNS-only zone and clients resolve over DoH. See https://nginx-extras.getpagespeed.com/ech/

Changes:

freenginx-ech-1.31.5-75.el9.gps.x86_64 [25 KiB]	Changelog by Danila Vershinin (2026-10-29): - Bump bundled nginx-module-gps-license 1.10.0 -> 1.11.0: the default license token lookup now tries the canonical /etc/getpagespeed/license.jwt first (one file licenses every GetPageSpeed product on the host), then the legacy /etc/nginx/license.jwt, which keeps working forever; an explicit gps_license_token still wins
freenginx-ech-1.31.5-74.el9.gps.x86_64 [25 KiB]	Changelog by Danila Vershinin (2026-10-17): - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page button label is now reason-aware (missing="Set up your token", expired="Renew license", invalid="Fix your token", revoked="Restart subscription") and its URL carries ?ref=nginx503 so landing-page analytics can attribute 503-driven arrivals.
freenginx-ech-1.31.4-74.el9.gps.x86_64 [25 KiB]	Changelog by Danila Vershinin (2026-10-17): - Bump bundled nginx-module-gps-license 1.9.1 -> 1.10.0: the 503 page button label is now reason-aware (missing="Set up your token", expired="Renew license", invalid="Fix your token", revoked="Restart subscription") and its URL carries ?ref=nginx503 so landing-page analytics can attribute 503-driven arrivals.
freenginx-ech-1.31.4-73.el9.gps.x86_64 [25 KiB]	Changelog by Danila Vershinin (2026-10-13): - Add freenginx-rebased copy of the QUIC BPF reload/upgrade patch; the nginx.org version failed prep on freenginx branches (divergent sockmap declaration and generated BPF code), breaking all 18 freenginx-mainline CI lanes
freenginx-ech-1.31.4-69.el9.gps.x86_64 [22 KiB]	Changelog by Danila Vershinin (2026-09-17): - SELinux: allow httpd_t setattr on /dev/null (nginx-gps policy 1.2). With the common "error_log /dev/null;" idiom, every logrotate USR1 log reopen produced a daily [emerg] "chown(/dev/null) failed (13: Permission denied)" because the master chowns error logs to the worker UID and the stock policy denies it silently (dontaudit, no AVC). - SELinux: ship nginx-gps as version-agnostic CIL text instead of a binary .pp. The .pp module format tracks the build chroot's checkpolicy (3.10 emits format 24), which targets one userland update behind (libsepol 3.9, reads 4-23) cannot parse — the module then silently failed to install. - SELinux: %post now emits a warning to stderr when the nginx-gps module fails to install instead of swallowing the error.
freenginx-ech-1.31.4-68.el9.gps.x86_64 [21 KiB]	Changelog by Danila Vershinin (2026-09-10): - SELinux: support "quic_bpf on;" (QUIC connection migration) behind a new default-off boolean. The stock policy grants httpd_t nothing on the bpf class, so enabling quic_bpf made nginx refuse to start with "failed to create BPF map (13: Permission denied)". nginx-gps policy module 1.1 adds the empirically-captured allows (bpf map/prog permissions plus the bpf, perfmon and net_admin capability checks), all gated behind the boolean nginx_quic_bpf, off by default: nothing changes for any install until "setsebool -P nginx_quic_bpf 1". Verified on Rocky Linux 10 enforcing: start, reload, binary upgrade and HTTP/3 traffic all clean with zero AVCs; with the boolean off, behavior is exactly as before.
freenginx-ech-1.31.4-67.el9.gps.x86_64 [20 KiB]	Changelog by Danila Vershinin (2026-09-07): - gps-license module 1.9.1: fix CLOSE-WAIT connection leak. Every identity probe request and every hard-enforcement 503 left one worker connection un-finalized (CLOSE-WAIT) until worker_connections exhausted - a 1/min monitoring probe could take a server down in about a day (reported by an Ultra subscriber with a clean 20-probes = +20 CLOSE-WAIT repro). Both paths now finalize the request; hard 503s appear in access_log, probe requests remain unlogged. Regression-tested (integration + EL9 e2e with the reporter's exact ss check) and E2E-proven against production.
freenginx-ech-1.31.4-66.el9.gps.x86_64 [20 KiB]	Changelog by Danila Vershinin (2026-09-03): - gps-license 1.9.0 tarball refresh: fix Linux compilation of the module's unit-test harness (POSIX feature-test macro, test path buffer); shipped module code unchanged. Supersedes the partially-published Release 65 (x86_64-only, cancelled mid-build) so all architectures converge on the E2E-proven build (verified against production: beacon machine identity row landed in repo_license_usage)
freenginx-ech-1.31.4-64.el9.gps.x86_64 [19 KiB]	Changelog by Danila Vershinin (2026-08-27): - nginx-ech: new subpackage for ECH (RFC 9849) key generation and rotation, at parity with nginx-mod-ech (shared nginx-ech-keygen implementation) - assert ECH is live at build time: a bogus ssl_ech_file must fail the configuration test instead of degrading to a silent no-op